topic Authentication and Automation APIs in Nuxeo Forum

Authentication and Automation APIs

franck102_ — Fri, 09 Nov 2012 09:30:16 GMT

I am a bit confused about how authentication works with the Java automation APIs. I would like to use a shared secret between the client and the server, and to use impersonation when a client request comes in to switch the the requesting user's security context. I also need to authenticate the user. Roughly I am trying something along those lines:

// client init
session = client.getSession("Administrator", "Administrator"); // will replace with shared secret

// request comes in from user Bob
session.verifyCredentials("bob", bob's password) // how do I do this??
session.newRequest("Auth.LoginAs").set("name", "bob");
session.do_some_stuff()
session.newRequest("Auth.Logout");

I have two issues:

How can I validate Bob's credentials (without starting a new session, which is too slow)?
after Auth.LoginAs, I can still successfully use the session to readDocument for which Bob has been denied the READ permission - is LoginAs really impersonating the user?

Thanks!

Re: Authentication and Automation APIs

franck102_ — Fri, 09 Nov 2012 12:29:09 GMT

Looking into the source code it seems that LoginAs would work only if I chain it with my "do_some_stuff" on the server side... however that doesn't work well for me, I would need to define automation chains for every operation I ever want to use.

Re: Authentication and Automation APIs

franck102_ — Mon, 12 Nov 2012 10:12:21 GMT

I finally realized that establishing a session is really fast (as opposed to creating a new automation client), so I don't actually have a need for impersonation.