Supported ways to authenticate in CS 21.2 and up

Hi,

In the CS 21.2 release notes, it states (section 2.2.4) that Basic authentication is turned off by default, and that it can be turned on if desired. This is no doubt to support legacy applications already written that use basic authentication. What I would like to know is what should we be doing instead if we're starting off from scratch? I suspect we're supposed to take advantage of oAuth2 or SAML (and I beg pardon if I'm conflating these two things - it's been ages since I developed anything that leverages either technology and it was not much above the Hello World stage). Is there a KB article that discusses ways that developers should be authenticating in CS 21.2 and up? Or could someone give me the broad strokes of what sort of infrastructure is required? I'm doing a lot of work for the Canadian Government, and this is going to come up. We discussed this once internally and our view is that if OpenText is turning basic authentication by default, there is probably a good reason for this, and we'd like to know more.

-Hugh

Find more posts tagged with

Comments

Karen Weir

Hi @HF_PSPC , I shared your post internally. Thanks for your patience.

HF_PSPC

We can safely let this one go. After opening a support ticket, and after much back and forth of (what do you mean by ...) we finally realized that we were talking about two different things. The CS REST Auth API is not going away, but support for passing user/passwd in the request body is. The confusion what that I had *no idea* that passing credentials that way was even supported so I interpreted that release note differently.

I did a Postman test and verified you can in fact still is the CS REST Auth API which is just as secure a way of authenticating as the OTDS authentication API (although admittedly, OTDS tickets are longer meaning probably more heavily encrypted).

-Hugh

Karen Weir

Thanks for the update Hugh, much appreciated!