topic Re: [SOLVED] Logout using REST fails in Alfresco Archive

[SOLVED] Logout using REST fails

mwildam — Fri, 12 Jun 2009 13:32:58 GMT

In my first attempts to program against Alfresco I managed to get the login working.For the logout it takes xml instead of json by default - don't know why - anyway how exactly must the xml look like? I tried giving it just the ticket in post parameters.I always get 403 Forbidden as the http result

Re: [SOLVED] Logout using REST fails

mrogers — Fri, 12 Jun 2009 14:45:39 GMT

The logout script does not take any input.

Just a DELETE to /api/login/ticket/{ticket}.

Re: [SOLVED] Logout using REST fails

mwildam — Mon, 15 Jun 2009 07:41:55 GMT

I did this:

DELETE http://localhost:8080/alfresco/service/api/login/ticket/TICKET_044c71c492fdc2199d76381718941a769eeea15f‍

first without posting any parameter. I got a 401 response code which means "Unauthorized"
Reading then ( :wink: ) in the documentation (http://wiki.alfresco.com/wiki/Repository_RESTful_API_Reference#Logout) it told me
Requirements:

Default Format: xml

Authentication: user

Transaction: required

Format Style: any

So it seems that it requires authentication first (although I cannot understand why because the ticket should be authentication enough).

After your post I tried again, but I get the same response code again - so that simply does not work that way.

The next thing is writing as format "xml" and then for style "any" seems like kidding…

I tried pasting the url

http://localhost:8080/alfresco/service/api/login/ticket/TICKET_f42700bb5490c9a05b02a15fc7d2fd026f0866ad‍

to the browser location and guess what happened: It asked me for a login ?!?

I tried again posting some parameters getting an error that the DELETE command does not support output parameters. So now I do not understand anything of what is going on here. And it is a simple shitty logout…

Re: [SOLVED] Logout using REST fails

mikeh — Mon, 15 Jun 2009 07:59:12 GMT

The API requires authentication, otherwise you could delete any other user's session by sniffing their ticket.

Mike

Re: [SOLVED] Logout using REST fails

mwildam — Mon, 15 Jun 2009 08:14:19 GMT

The API requires authentication, otherwise you could delete any other user's session by sniffing their ticket.

Shouldn't a https connection be way to avoid sniffing?

In the meantime I found out that you must do a normal http authentication for the logout - but not for the login.
So for login you do not need http authentification but for logout you need.

I cannot understand this logic. And http login without https does not really seem to be a sure-way to avoid sniffing…

Re: [SOLVED] Logout using REST fails

mikeh — Mon, 15 Jun 2009 08:17:48 GMT

Of course, https should be configured if your security policies require it - and there's nothing stopping you configuring that. Obviously you need to apply your own SSL certificate, so it's not something we can ship out-of-the-box.

The logic is sound: if you're trying to login, then you don't need to authenticate because you don't have a session (or ticket) yet. To logout, the server must be certain it's you making the request.

Thanks,
Mike

Re: [SOLVED] Logout using REST fails

t_broyer — Mon, 15 Jun 2009 08:31:15 GMT

I did this:
DELETE http://localhost:8080/alfresco/service/api/login/ticket/TICKET_044c71c492fdc2199d76381718941a769eeea15f‍
first without posting any parameter. I got a 401 response code which means "Unauthorized"
Reading then ( :wink: ) in the documentation (http://wiki.alfresco.com/wiki/Repository_RESTful_API_Reference#Logout) it told me
Requirements:
Default Format: xml

Authentication: user

Transaction: required

Format Style: any
So it seems that it requires authentication first (although I cannot understand why because the ticket should be authentication enough).

You probably don't want someone else to be able to log you out, do you?

After your post I tried again, but I get the same response code again - so that simply does not work that way.

It's working very well, for me at least.

I tried pasting the url
http://localhost:8080/alfresco/service/api/login/ticket/TICKET_f42700bb5490c9a05b02a15fc7d2fd026f0866ad‍
to the browser location and guess what happened: It asked me for a login ?!?

This webscript will tell you if the ticket is still valid, so obviously you have to be authenticated (moreover authenticated with the same user as the one "attached" to the ticket) or it would be quite easy to use brute force until you find a valid ticket and then use it to authenticate to other webscripts.

I tried again posting some parameters getting an error that the DELETE command does not support output parameters. So now I do not understand anything of what is going on here. And it is a simple shitty logout…

1. you login (using either login.get or login.post) and obtain a ticket
2. you make requests to webscripts using this ticket to authenticate
3. you make a DELETE on /api/login/ticket/<ticket> to logout

…obviously, you can also use HTTP Basic auth; it frees you from steps 1 and 3 but you have to send username/password pair on each request (which means keeping them around…)

Re: [SOLVED] Logout using REST fails

mwildam — Mon, 15 Jun 2009 08:53:42 GMT

1. you login (using either login.get or login.post) and obtain a ticket
2. you make requests to webscripts using this ticket to authenticate
3. you make a DELETE on /api/login/ticket/<ticket> to logout

…obviously, you can also use HTTP Basic auth; it frees you from steps 1 and 3 but you have to send username/password pair on each request (which means keeping them around…)

Thanks for your explanations.
I tried now using http authentication for login and that did not work.
I still do not find the API (although only looking at login and logout now) following some clear convention. For login I may not use http authentication but for logout I must. Why isn't it enough posting the security token which I should have only and no other person probably having the desire to log me out?

Then we have the login via url parameters that returns XML but using POST it wants and returns JSON. This is confusing (at least for me).

But anyway - I can login and logout now and this is a begin - topic solved.

Re: [SOLVED] Logout using REST fails

mikeh — Mon, 15 Jun 2009 09:11:29 GMT

Then we have the login via url parameters that returns XML but using POST it wants and returns JSON. This is confusing (at least for me).

They support both, but the default is json (have a look at the webscript description http://localhost:8080/alfresco/service/script/org/alfresco/repository/login.post - there are two response templates)

Thanks,
Mike

Re: [SOLVED] Logout using REST fails

bgl — Tue, 14 Jul 2009 22:00:07 GMT

Hello,

sorry to insist on this point but I don't understand how this is working.

The argument of brute force does not really convince me since size of ticket is pretty huge.

Sniffing sounds better but I would just say that if you get the ticket, you can do much more than just logout the user so this argument about authentication and supply your login/password does not seem very good for me. I must miss something. Any lights on this interest me 🙂

My problem is the following : I use restlet library for communicating between my GWT Servlet and Alfresco. When making a call to the URL for logout, I get a 401 error as mwildam raised. And I don't understand what is happening. I need to authenticate according to what I understood in this thread. Do I need to make a new authentication ? then how to use it ?

Here is what I have done : I got a ticket from my server, made some calls in my application and then I want to logout. So I pass the ticket to my GWT servlet which makes this call :


http://localhost:8080/alfresco/service/api/login/ticket/TICKET_36fad5c9f03d97c7f319c0b04216d9bd77a9c3e7
‍‍‍

and I get this in my logs:


14 juil. 2009 14:45:57 com.noelios.restlet.ext.httpclient.HttpClientHelper start
INFO: Starting the HTTP client
14 juil. 2009 14:45:57 org.apache.commons.httpclient.HttpMethodDirector isAuthenticationNeeded
INFO: Authentication requested but doAuthentication is disabled
[DEBUG] Déconnexion échouée. Code erreur : 401
‍‍‍‍‍‍‍

Reading what you said, I would believe that I have to pass some extra parameters as for login and password (so u=login&pw=password).

I miss something but I cannot see what. Anyone can tell me ?

Thank you !

Re: [SOLVED] Logout using REST fails

bgl — Tue, 14 Jul 2009 22:27:40 GMT

Ok I found the way to do it : simply by doing as usual when a script is authenticated…….. Using this call


"/api/login/ticket/"+p_TicketSession + "?alf_ticket="+p_TicketSession
‍‍‍

is working. I have submitted another URL with my ticket and the ressource is not anymore accessible. So it is working 🙂

So forget my questions in my previous post 🙂

Re: [SOLVED] Logout using REST fails

johanpi — Wed, 06 Oct 2010 08:33:50 GMT

It may sound stupid but I have no idea how to do this.

I did:
In the .ftl it redirected to this url… Where ticket = TICKET_ce0049993f48b9996c48dd1e855c22dd8b24f97d
location = "http://seraecmdev001.sita.co.za:8080/alfresco/service/api/login/ticket/${ticket}?alf_ticket=${ticket}"

It returns:
<ticket>TICKET_862b5e324cbd5f7bfc4d84ea5fa74be70aebca3d</ticket>

But the ticket is still valid.
Could you please supply an example.

Thanks
Johan

Re: [SOLVED] Logout using REST fails

bgl — Wed, 06 Oct 2010 09:25:55 GMT

Hi Johan,

Don't worry it does not seem stupid at all ! I had the same question !!

Here is a method (from a servlet) to require disconnection (code does not compile since it requires some other classes but it should be quite easy to clean it up). I use the library restlet - http://www.restlet.org/ - here (most classes in this code are coming from it )


public void disconnect(String p_TicketSession,
      String p_Login,
      String p_Password) {
    // Alfresco is over HTTP
    Client client = new Client(Protocol.HTTP);

    // URL for Alfresco (I'm using an external servlet so I have to get the URL to reach Alfresco)
    String urlRequete = getBaseUrlServicesAlfresco() +
      "/api/login/ticket/"+p_TicketSession +
      "?"+PARAM_TICKET+"="+p_TicketSession;

    // NOTE HERE THE METHOD USED FOR REST CALL : DELETE and not POST or GET
    Request request = new Request(Method.DELETE, urlRequete);

    // Calling
    Response reponse = client.handle(requete);
    Status status = reponse.getStatus();
    int returnCode = status.getCode();

    // Checking return code
    if ( returnCode == SUCCESS ) {
      logDebug("Disconnection succeeded");
    } else {
      logDebug("Disconnection failed. Error code is : " + status.getCode());
      throw new RuntimeException("Disconnection failed with http error code "+ status.getCode());
    }

  }
‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍‍

Should make the work !

Boris

Re: [SOLVED] Logout using REST fails

johanpi — Wed, 06 Oct 2010 12:11:51 GMT

We are primarily working in webscripts so java is not the way now.

I did:
location = "${url.context}/service/api/login/ticket/${ticket}?alf_method=DELETE"

Result:
<response>
−<status>

200‍

<name>OK</name>
<description>The request succeeded normally.</description>
</status>
−<message>
Deleted Ticket TICKET_9d42ac57c421c13c23af75c533bafdc3649d8003
</message>
<exception/>
<callstack>
</callstack>
<server>Enterprise v3.3.1 (96) schema 4,013</server>
<time>06 Oct 2010 1:50:37 PM</time>
</response>

which seems to work. But as soon as I press back button, it assigns a new Ticket without asking to log in, which I can delete again without asking for a login.
The user is not logged out as the user van still do queries…

Any ideas?
Thanks

Re: [SOLVED] Logout using REST fails

bgl — Wed, 06 Oct 2010 13:07:37 GMT

Did you try to use the ticket you had without using back button ? For instance use the ticket to list contents in a folder.

I ask this because your case seems to be : you delete the ticket and when pressing back, you automagically get connected with a new ticket (may be there are somewhere login/pwd and they are passed when you are not connected ?)

What you do to check this assertion (or discard it 🙂 ) is : get disconnected. Write the content of the ticket. Then Press back button and again disconnect. Another ticket is displayed. Compare the 2 tickets : they must be different.

What is the result of this test ?

Re: [SOLVED] Logout using REST fails

johanpi — Wed, 06 Oct 2010 13:10:03 GMT

The ticket is deleted.

And I agree a new tickets is created. The 2 tickets differ.

Re: [SOLVED] Logout using REST fails

bgl — Wed, 06 Oct 2010 13:19:29 GMT

So you have now to find out why a new ticket is created 😉

Boris

Re: [SOLVED] Logout using REST fails

soriaedu79 — Wed, 19 Jan 2011 21:29:54 GMT

Any clue about this second ticket?

I have the same problem.

Thank you

Re: [SOLVED] Logout using REST fails

nileshyadav326 — Tue, 03 Oct 2017 09:06:07 GMT

Thanks for highlighting the issue.

well did u find the solution for this issue?