C# POST and Authentication

[holein1]

Here's a weird one. I'm POSTing content to a Web Script using C# and UploadData. The content comes to the C# method as bytes (not a file reference). UploadData in C# allows me to Authenticate, POST metadata and the content all in one call, which is great. However, if the web script requires authentication, there is a delay in the POST equal to the setting of <Connector connectionTimeout …. /> in Tomcat's server.xml while the script authenticates the user - as though the URI hadn't been presented.

If I remove authentication from the script's post.desc.xml file, the same POST executes immediately.

Anyone else experience this problem? I've temporarily worked around it by using the kludge where you tack "guest" on to the POST as a parameter, change the script's authentication to "guest", and give guest the Contributor role to the space I'm creating the content in. But, that's not going to fly for long, because I'm effectively removing security for that script.

[ejholmgren]

Have you tried using a ticket appended to the url for authentication instead?

[holein1]

No I haven't. Can you elaborate? I'm not familiar with what you're suggesting.

[ejholmgren]

<cfhttp url="#APPLICATION.alfrescoRoot#/service/api/login?u=#APPLICATION.alfrescoUsername#&pw=#APPLICATION.alfrescoPassword#" method="GET"/>

<cfset myTicket = XMLParse(CFHTTP.FileContent).ticket.XmlText>

<cfhttp url="http://localhost:8080/alfresco/upload/test.pdf?ticket=#myTicket#" method="put">
   <cfhttpparam type="file" name="myFile" file="C:\test.pdf">
</cfhttp>‍‍‍‍‍‍‍

Although the above is in ColdFusion and not C#, it should be a decent enough example. Basically you make an HTTP call to the alfresco server @ http://serveraddress:8080/alfresco/service/api/login?u=username&pw=password with some real credentials, and the server will respond back with XML that contains a ticket. Append that ticket at the end of your requests with "&alf_ticket=whatvertheticketis" and you won't need to pass the credentials in the header.

Note: the UploadContentServlet expects the url arg as "ticket" whilst the other services use "alf_ticket"

[holein1]

That worked great! Now I just request a ticket, send it along with the upload POST, and forget about setting credentials.

Do I need to delete the ticket after I'm done with it or does it matter?

Thanks.

[ejholmgren]

No idea :mrgreen:

I'm guessing if you had a massive amount of transactions going on, you'd hit some sort of limit if you left them all open until they expired.

Consequently, you can easily close a ticket with an HTTP DELETE call to

http://server:port/alfresco/service/api/login/ticket/APPEND_TICKET_HERE‍