OTCS RestAPI: how to authentication a user which is in an Async Partition with SAML2.0?

what you say Async partition is that what OT calls a Non-Synchronized?

A non Non Synchronized user just means the user is known only to OTDS and the user has been created using APIs inside the Livelink(OTCS) database. If you go to OTCS and try to find the user it should exist. you can use the users&groups function to find the user or the table KUAF.OTDS creates the nonsync and synchronized users using soap API (now may have a rest equivalent).I would first check that and then the resources (like CS) should be available to the partition. The non-synch user should exist in one of the 4 places like otexternalid 1 through 4. The OTDS logs should indicate successful login to the OTDS application and the difficulties that the downstream app does.

If nothing works create a session using a user like otadmin@otds.admin(any user with System Admin privs) and impersonate the smaller user if that works then the smaller user is known to livelink

I always pass OTDSTicket to rule out such difficulties, OTCS is coded to accept one of the tickets…

That is because when the RESTAPI is received in Oscipt it explicitly looks for an OTCSTicket or a OTDSTicket so that is what I would probably do. Explained as a postman sequence

• Hit the authentication of OTDS(not the CS AUTH) you should be able to test this in your OTDS server restapi endpoint, start with something known as a userid/password, and look at its output you will most likely see an OTDSSSO******** thing. This is what Livelink/Content Server CGI REST API needs
• Execute a REST API with that ticket passed as OTDSTicket it will work….
• OpenText has even included a basic auth command so you will be able to even hardcode a userid: password with your API testing most likely you may have to base64 encrypt the userid:password what I am talking about is the most unsafe way an IISwebserver can be done so many organizations will not allow it and it is to allow RAD against CS one can almost say bypass OTDS while developing

Once you are happy with the above example you should now try to work the real requirement which is something out on the web that gave you an OAUTH convert that to an OTDSTicket and you should be able to get it going(I see an OT employee tag so you should be able to harness tonnes of your inside colleague goodwill)

I am not aware of OTDS giving an OTCSTicket perhaps your colleagues meant what I said OTDS is actually tasked with issuing tickets against a resource like OTCS, in your case, it may be the one that starts with OTDS****or the video Jeremy Pepper posted(thank heavens he was helping us before he left)

again if the SmarTUI is correctly working in your scenario you can also look at the way it performs authentication.I think it actually is doing the same thing that a external developer does with REST

If the authentication works for the user in non sync using the SmartUI then it is actually doing REST API calls. The Jeremy Pepper example shows this flow with OAUTH2 so the authority in his example is Google and he gets a Ticket, he converts that ticket into something that OTCS understands like

it will say OTDSSSO*. I think you are missing that action and trying to think that calling the Oauth to Microsoft is all you have to do.This OTDSSSO is akin to you asking otds with a userid/password(or in saml kerberos)

If you do not want to use this you can simply use Impersonate

perhaps this is an old thread I could not find Jeremy Pepper's video https://support.opentext.com/community?id=community_question&sys_id=78eb3b991b18d51022d432a3cc4bcb20&anchor=answer_8869b52d87d49910781b0ed8dabb3530&view_source=searchResult