topic Re: Webscript with guest access requiring authentication in Alfresco Forum

Webscript with guest access requiring authentication

hiten_rastogi1 — Tue, 17 Apr 2018 10:18:54 GMT

Hi,I have a webscript that have guest access enabled but it still requires me to authenticate when I try to access it on my production instance, though it work fine on my local.Below is the desc file for the webscript<webscript> <shortname>doclist</shortname> <description&

Re: Webscript with guest access requiring authentication

mikel_asla — Tue, 17 Apr 2018 13:01:29 GMT

Maybe you got guest user disabled on production (check all susbsystems that may apply)

Btw, you can also set to none like that

If you really know what your doing and you need a non authenticated service

Authenticating web scripts | Alfresco Documentation

Regards

Re: Webscript with guest access requiring authentication

hiten_rastogi1 — Wed, 18 Apr 2018 10:41:13 GMT

Hi Mikel,

Correction in above. I just checked and YES the guest user is disabled in the production instance but so in my local. I did a bit of googling and found out that by default the Guest user is disabled in Alfresco.

In my local I am running the same code as in my production but in my local I am not prompted with the authentication login. If I put username and password as guest/guest in my production I am able successfully authenticate and view the content that the webscript returns. So, I am writing down certain questions please help me in answering them.

1. Does guest need to authenticate by using guest/guest as username/password ?

2. I have read the documentation and if the authentication is set to none then the transaction is by default set to none but in my case I do need a readonly transaction ??

3. Also, setting the authentication to none anyone who can form the webscript url can get access to data that the webscript return. How can I avoid it ?

Re: Webscript with guest access requiring authentication

mikel_asla — Wed, 18 Apr 2018 11:25:39 GMT

Maybe some context of what you're trying to achieve will help,

1. The guest has no authentication behind, it can be seen as the FTP annonimous

This is the default value for AlfrescoNtlm auth subsystem (tipically the one you're hitting locally)

alfresco.authentication.allowGuestLogin=true

alfresco-repository/alfresco-authentication.properties at master · Alfresco/alfresco-repository · GitHub

On production this normally differs

2. It totally depends on your implementation code

3. Creating a ws as guest or none will make it public to the world, why can't you just use "user"?

Re: Webscript with guest access requiring authentication

hiten_rastogi1 — Wed, 18 Apr 2018 11:49:47 GMT

Thanks Mikel for your reply.

I am trying to make a folder and its content in Alfresco accessible to outside world without authentication, for this purpose we have used an addon and with some modification created our own from it, so none and guest works for me.

The folder has an action that generates a unique URL and gives Consumer access to guest user on all the content inside that folder.

The unique URL generates a page which displays the all the content inside the folder which is fetched through the webscript. This webscript has guest authentication which as stated above works well on local but not on production and demand authentication on the same code.

I am not able to figure out the reason for this behaviour. Here is the link to the project .

Re: Webscript with guest access requiring authentication

mikel_asla — Wed, 18 Apr 2018 12:26:21 GMT

I see,

Maybe there is something with the order of your authentication chain, what's the value for authentication.chain property on production?

Re: Webscript with guest access requiring authentication

hiten_rastogi1 — Wed, 18 Apr 2018 12:31:07 GMT

I am using default authentication on the production as well as local instance.

Re: Webscript with guest access requiring authentication

mikel_asla — Wed, 18 Apr 2018 12:37:49 GMT

OK, so only Alfresco internal users and allowGuest enabled on both environments

And do you have any http server / balancer or anything in between?

Re: Webscript with guest access requiring authentication

hiten_rastogi1 — Thu, 19 Apr 2018 06:22:06 GMT

Yes,

We are using an apache web server.

Re: Webscript with guest access requiring authentication

mikel_asla — Thu, 19 Apr 2018 06:36:22 GMT

Maybe apache is causing the auth promp

Can you try the service bypassing apache? maybe some curl from the production server console or so.

Re: Webscript with guest access requiring authentication

hiten_rastogi1 — Thu, 19 Apr 2018 08:04:05 GMT

Hi Mikel,

I tried bypassing the apache by accessing the tomcat directly but to no avail. I was still prompted for authentication.

Any other that I can try ??

Re: Webscript with guest access requiring authentication

mikel_asla — Thu, 19 Apr 2018 10:41:32 GMT

It's hard to tell.... If you got same code, same Alfresco version, same auth configuration and nothing in between.

What about tomcat configuration? you could inpect both server.xml files to see if you got a valve or something causing your trouble.

Re: Webscript with guest access requiring authentication

hiten_rastogi1 — Thu, 10 May 2018 09:32:45 GMT

Hi Mikel,

Sorry for the late reply.

I did some testing and it wasn't pretty clear as to why this is happening as on some instances that are behind the same apache server. I also checked the Valve in <TOMCAT_HOME>/conf/server.xml and didn't find any custom changes.

Finally I have to change the authentication in the webscript desc.xml file that fetches the list of children of a folder from

<authentication>guest</authentication>

<authentication user=guest>none</authentication>

and now it is working correctly.