SSO + REST?

Hi,
I am investigating writting a custom gui to call to OpenText Content Server just to get and display certain information. We only need a specific subset, and this may be easier that trying to trim down the standard UI. This would be written using the REST webservices to talk back and forth.

That said, the content server is currently setup with SSO. Is there a way to translate the local authentication into a webservice ticket to get a similar effect?

Thanks
Frank

Find more posts tagged with

Comments

Beaty_Frank

Guess I should note, this is CS 16 with OTDS 16, and again it's attempting to use the REST services...

does this still work with a bit of jiggering?

http://knowledge.opentext.com/knowledge/cs.dll/kcs/kbarticle/view/KB494406

Ferdinand Prantl

The term "webservice" is usually used for SOAP webservices. CWS, when speaking about CS. CS REST API works differently, that B2B APIs like SOAP WS. What is available in a native application, is not available in the web browser, which has the primary client for CS REST API.

There is no SSO for CS REST API clients. (We could not find a solution resistant against CSRF attacks in general, without tightening the API to one application. REST API is general for any client.)

The application, which uses CS REST API, should obtain OTCSTicket (or other ticket accepted by CS, like OTDSTicket) by SSO. What should provide the user authentication, is not the REST API; it should be the application, which the user enters first, before the REST API gets to be used. The application usually uses some SSO; either impersonation, or other solution like using IWA or ADFS. OTDSTicket is usually available. Once you get OTDSTicket in your application, you can pass it to CS REST API as request header.

Beaty_Frank

So if I understand correctly...

I am possibly looking to create a custom webpage which calls into CS via REST to get/set data, but otherwise the user never actually goes to CS itself. In this case, the only authentication method possible for them is to sign in, passing username and password to the OTDS via /authentication/credentials, and then to use the returned token to query data in CS?

Thanks
Frank

Quoted Ferdinand Prantl on 04/19/2017 03:32 PM:

There is no SSO for CS REST API clients. (We could not find a solution resistant against CSRF attacks in general, without tightening the API to one application. REST API is general for any client.)

Beaty_Frank

Or the other thought... Is there a way to host the html and supporting files (cs, js, etc) in CS so they can be viewed as a regular webpage? But then maybe will be authenticated as any user going into the CS GUI?

Thanks
Frank

Ferdinand Prantl

If you mean a plain HTML page, served from a web server as a static asset - being it the web server in front of CS or other web server - there is no SSO offered by the CS core product. (AGA offered an SSO based on a hidden OTDS iframe, but it was a part of the SharePoint integration only.) In this case you would have to provide SSO and ensure, that your page is trusted.

If your page is generated on the server side (ASP.NET, JSP, WebLingo etc.), you can use the authentication available on the server side. When the user navigates to the page, it gets authenticated by SSO and you can read OTDS ticket on the server side. When you generate the page, you write also a piece of JavaScript with the ticket there.

For example, if you write a CS request handler, you get "SSO" by CS itself and you can make an AJAX call back to the server, once you expose the ticket for the JavaScript on the page, for example, by WebLingo like this:

<script type="text/javascript">  ...  var otcsTicket = '`%S $CSUI.Utils.GetOTCSTicket(this)`';  $.ajax({    headers: {OTCSTicket: otcsTicket},    ...  })  ...</script>