Impersonating user using CWS

Guy_Pomerleau · 2022-04-13T19:43:36+00:00

There was an error rendering this rich post.

Hi all

We have code that was working in Content server 16.2.11 that is no longer work in Content server 21.2. Even worst then that, the same code work in our DEV 21.2 environnment but not in PROD. The main fiddrence between Dev and prod: dev= 1 single server behind a load balancer and prod= 1 admin server and 2 front-end server that are behin the load balancer. If we run the code without impersonate in prod it work but as soon as we enble impersonate, it fails. Here what we see in the CWS log:

 IServiceContext = BasicServiceContext[fServer=localhost,fServerPort=2099,fServerEncoding=UTF8]
2022-04-13 14:49:38,1065 TRACE [10]  IRequestContext = BasicRequestContext[fClientIPAddress=x.x.x.x,fServiceToken=,]
2022-04-13 14:49:38,1065 TRACE [10]  IRequestContext.ServiceToken = YQdqFICKsYP1gC3Wp9TOur7f5IGET517krOkBJ1FRODPS3t10Z3iIbGrfcbkd0NgIKcCk%2FTFLUJB2aAJMvlPhDL1hrSa82%2BG6nEd48VGhcB8wwMl47j8EG%2BiNkjvg6pjiTZg0HWeYaS0f9rovU%2F7PNHhWh3hCCkl65aKu8Wnh9fUjNyyE93YZA%3D%3D
2022-04-13 14:49:38,1065 TRACE [10] begin: Authentication.ImpersonateUser(joe@doomain.com)
2022-04-13 14:49:38,1533 TRACE [10] end:  Authentication.ImpersonateUser()
2022-04-13 14:49:38,1533 TRACE [10]  IRequestContext.ServiceToken = 
2022-04-13 14:49:39,1377 TRACE [12] BasicServiceContext(): fServer = localhost, fServerPort = 2099, fServerEncoding = UTF8
2022-04-13 14:49:39,1377 TRACE [12] Service()
2022-04-13 14:49:39,1377 TRACE [12]  IServiceContext = BasicServiceContext[fServer=localhost,fServerPort=2099,fServerEncoding=UTF8]
2022-04-13 14:49:39,1377 TRACE [12]  IRequestContext = BasicRequestContext[fClientIPAddress=x.x.x.x7,fServiceToken=,]
2022-04-13 14:49:39,1377 TRACE [12]  IRequestContext.ServiceToken = L54IMP8KzV0ultsVJdgNybwrdP%2F3ulO4ofY10rJH5Tr1Ln6Du0r82WWdJ3pQnF%2F2L3z8GJJGbVzwQpzZYU9ekQntU5D8Q0EV%2BpiQqJNBzoxohEtYXQxLRT5tbTOutF9idOtTT5F3U75ehIIqI3VlehU7Yy13VfrVV1cVFMhNcI%2FEY8%2BdSiCNFtZhgEdykNUJ3WvEEmHBO3A%3D
2022-04-13 14:49:39,1377 TRACE [12] begin: DocumentManagement.CreateFolder(12887476,xxxxxxTestImpersonated_637854725764891885,,)
2022-04-13 14:49:39,1533 TRACE [12] ThrowLivelinkException( -2147482642,Your session has timed-out.,,,urn:DocMan.service.livelink.opentext.com)
2022-04-13 14:49:39,1690 WARN [12] Livelink error occurred
2022-04-13 14:49:39,1690 WARN [12]  Status: -2147482642
2022-04-13 14:49:39,1690 WARN [12]  Error Code: Your session has timed-out.
2022-04-13 14:49:39,1690 WARN [12]  Error Message: Your session has timed-out.
2022-04-13 14:49:39,1690 WARN [12]  ApiError: 
2022-04-13 14:49:39,1690 TRACE [12]  IRequestContext.ServiceToken =

The service account has system admin privileged. What else could have changed? is it a new config on 21.2? "require secure request token for log-in" is enable in DEv and PROD

Find more posts tagged with

Comments

MV Adam

Yeah, I ran into this too, in a similar upgrade, though I was using the even older GetTicketForUser OTDS soap method. Seems they took out all of the OTAuthentication soap headers. This doesn't matter for a regular login operation, but for the GetTicketForUser, it wouldn't work, as it needs that first authentication.

They couldn't officially say why they did that, but just that it had changed.

My workaround was:

1) POST to the OTDS REST credentials action with an OTDS Admin-level username and password. https://otdsserver:8080/otdsws/authentication/credentials

2) POST to the OTDS REST GetTicketForUser action with the ticket from 1) and the userName of the user to be impersonated.

You'll get another ticket that can be sent to the Content Server Authorization Web Service ValidateUser method.

That will finally get you an impersonation ticket you can use for the OTAuthentication SOAP headers for documentManagement, ContentService, Search, etc.

According to OpenText, the tickets from REST should always remain compatible for the tickets to CWS.

Appu Nair

Try to disable in your security parameters the IP address mask which is 255.255.255.255 there is a setting that says ‘Do not use IP address for authentication’ since you mention a service user it is not clear what the code is doing as in is the code a windows service running as a sys admin user but I would start there

As Adam said in my impersonating application I get a OTDSSSO token and I use that to impersonate the other user so that works . I am not using anything CWS but the createupdateworkspaces call is a soap call and the auth token works even if I retirieve that using Rest

Greg Griffiths

There is a KB Article covering the steps - https://knowledge.opentext.com/knowledge/llisapi.dll/kcs/kbarticle/view/KB8295770.