How to validate session token using content web service.

Sahil Chauhan

To download a document using CWS I am using the below method:

DataHandler com.opentext.livelink.service.core.ContentService.downloadContent(@WebParam(name="contextID", targetNamespace="urn:Core.service.livelink.opentext.com") String contextID)

Sometimes, I am getting some error messages from the web service call: (Server did not accept open request, RCS-TTL expired or OTDS Error).

Can anyone please help me how to validate a user session of (RCS Authentication (OTDS))

Appu Nair

RCS is a very old legacy product that is now rolled into some new names including OTDS or ECMLink but I think what will help you in your endeavor is session management correctly. It looks to me that your primary mode is CWS(SOAP) so here are my suggestions in the order of simplicity.

1. Is it possible in your organization that your code can hit a single Livelink server big organizations will have a web of front end Livelink servers load-balanced and your code thread is under the mercy of how the Ll servers handle authentication. For trouble-free operations ee if the organization is using "Sticky" for their algorithm.
2. If that is not possible try to eliminate the cookie expiry from the default of 30 to some limit where your code is "talking" to the server.
3. The OTDS is a "pass-thru mechanism".Its job is to make sure the caller can be found in its LDAP store through the company's PDC, and then it just says OK here's an API call into Livelink can I send it if it thinks it can it hands it off to Livelink and now you are working within its constraints.
4. Make sure your Livelink server has the same cookie key and its IP restriction on security params is relaxed(Do not use IP for authentication).
5. OT CWS developers in a later version of code included a cookie key expiration TTL. Simply put if a call came into Livelink and you are given a cookie it is valid for 30 minutes. So in your session constructor, there is a TTL inclusion. So what we used to do in pseudo-code is while some api calls are progressing whether in java or .NET you always have to pass an auth object. So what one does before calling any API one goes and checks if time could be expired, if so re-authenticate.If you were using REST with every call OT would have given you a refreshed token so you can chain your rest calls like that. Unfortunately, they did not include the chaining in the soap structure as that was developed probably 10 years prior. Examples of the cookie's time component are in the CWS documentation as well as many examples in the old CWS forum
6. https://knowledge.opentext.com/knowledge/cs.dll?func=ll&objId=15633041&objAction=view
7. https://knowledge.opentext.com/knowledge/cs.dll?func=ll&objId=76916827&objAction=viewincontainer&ShowReplyEntry=76917498#forum_topic_76917498