Login to Explorer webapp through rest or automated form filler

[zorro1212]

Hello,
I am trying to use the rest api to login to the explorer webapp. I using the webapp through an iframe, so I am limited in my options to integrate the webapp since the host site is written in ruby. I have tried this url http://localhost:8080/activiti-rest/service/login, which clearly does not work, and returns a 401 code. I followed the user guide and included the content type and accept as application/json. From the user guide I have not seen anything that talks about this or on the forums, where most questions are directed towards starting a process from rest. Is there a way to do this using rest? I would like to limit the amount of custom code in activiti and keep it more on the ruby side. Another method that I have tried is to use a ruby gem that fills forms, however because of the VAADIN script I have been unable to post anything to the form and have it submit. For this, I used the mechanize gem on the url's http://localhost:8080/activiti-webapp-explorer2-5.18.0/activiti-webapp-explorer2-5.18.0/ui/APP/2/log..., http://localhost:8080/activiti-webapp-explorer2-5.18.0/ui/1/loginHandler, and neither of them worked. Any help would be greatly appreciated.

PS: Curl requests to the endpoints mentioned in different forums topics do work, and I can login manually. Furthermore, the rest and explorer both point to the same database.I dont think this is a CORS problem since I have also added this to the tomcat web.xml :
<filter>
    <filter-name>CorsFilter</filter-name>
    <filter-class>org.apache.catalina.filters.CorsFilter</filter-class>
    <init-param>
        <param-name>cors.allowed.origins</param-name>
        <param-value>*</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.methods</param-name>
        <param-value>GET,POST,HEAD,OPTIONS,PUT</param-value>
    </init-param>
    <init-param>
        <param-name>cors.allowed.headers</param-name>
        <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers</param-value>
    </init-param>
    <init-param>
        <param-name>cors.exposed.headers</param-name>
        <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials</param-value>
    </init-param>
    <init-param>
        <param-name>cors.support.credentials</param-name>
        <param-value>true</param-value>
    </init-param>
    <init-param>
        <param-name>cors.preflight.maxage</param-name>
        <param-value>10</param-value>
    </init-param>
</filter>
<filter-mapping>
    <filter-name>CorsFilter</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>

[zorro1212]

Typo:  http://localhost:8080/activiti-webapp-explorer2-5.18.0/ui/APP/2/login, not what is above with activiti-webapp-explorer etc repeated twice.

[jbarrez]

So it seems like you're trying to do two things here: embed the UI and call rest endpoints.
Both are possible, but you'd have to point both UI and rest to the same database to start with.

However, what I'd like to understand first is your use case: what are you trying to do? Is it embedding the UI in your application? Or rather, is it starting processes / completing tasks / … through the REST API? In the latter case, you don't need the Vaadin UI at all.

[zorro1212]

You are correct, so I have both the rest and the explorer war files pointed to the same mysql database. I am able to get information from rest that was created in the UI. I followed these instructions: http://forums.activiti.org/content/activiti-rest-explorer-sharing-process-engine-v57. I dont necessarily need the REST api, I just used it as a way to be able to automate tasks in the UI and have those tasks completed reflect in the UI. So essentially I want the functionality of the UI, but the ability to use rest calls all in one. This is my db.properties file:
<blockcode>
db=mysql
jdbc.driver=com.mysql.jdbc.Driver
jdbc.url=jdbc:mysql://localhost:3306/activiti
jdbc.username=activiti
jdbc.password=activiti
</blockcode>

I also tried modifying the authenticate method in the defaultLoginHandler, hoping that this would allow for login to reflect from http request to UI.
<java>
public LoggedInUser authenticate(HttpServletRequest request, HttpServletResponse response) {
    // No automatic authentication is used by default, always through credentials.
     String userName="";
      String password="";
     Logger LOG=null;
     LoggedInUserImpl loggedInUser = null;
     String authHeader = request.getHeader("Authorization");
       if (authHeader != null) {
           StringTokenizer st = new StringTokenizer(authHeader);
           if (st.hasMoreTokens()) {
               String basic = st.nextToken();

               if (basic.equalsIgnoreCase("Basic")) {
                       String credentials = new String(st.nextToken());

                       int p = credentials.indexOf(":");
                       if (p != -1) {
                            userName = credentials.substring(0, p).trim();
                            password = credentials.substring(p + 1).trim();
                       } else {
                           LOG.error("Invalid authentication token");
                       }
               }
           }
       }
      loggedInUser= authenticate(userName,password);
      return loggedInUser;
  }
</java>
The problem with this is that after this method gets called, the log shows a logged in user. But it calls the get explorer application servlet twice (must be a bug in my code), and the second time its called the user is null.

[zorro1212]

For clarification on the part about servlet called twice: EAS= Explorer application servlet, EA= explorerapp DLH= default login handler
<blockcode>
EAS init
EAS getNewApplication
EAS request org.apache.catalina.core.ApplicationHttpRequest@7695ed9b
EApp RequestStart Method
org.activiti.explorer.ExplorerApp@24155b6
EA User null
EA request: org.apache.catalina.core.ApplicationHttpRequest@7695ed9b
EA response: org.apache.catalina.connector.ResponseFacade@5179f6a
DLH request authenticates
DLH authHeader Basic kermit:kermit
DLH st.hasMoreTokens() true
DHL username: kermit
DHL password: kermit
DHL loggedInUser org.activiti.explorer.identity.LoggedInUserImpl@2c97b5d7
setting user
EA User After Authenticate Response: org.activiti.explorer.identity.LoggedInUserImpl@2c97b5d7
true
true
showing default page
10:28:31,294 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/VacationRequest.png
10:28:31,294 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/FixSystemFailureProcess.bpmn20.xml
10:28:31,360 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/FixSystemFailureProcess.png
10:28:31,360 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/createTimersProcess.bpmn20.xml
10:28:31,369 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/VacationRequest.bpmn20.xml
10:28:31,373 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/simple-approval.simpleApprovalProcess.png
10:28:31,373 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/reviewSalesLead.bpmn20.xml
10:28:31,378 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/reviewSalesLead.reviewSaledLead.png
10:28:31,378 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/Helpdesk.png
10:28:31,378 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/Helpdesk.bpmn20.xml
10:28:31,379 [http-nio-8080-exec-2] INFO  org.activiti.engine.impl.bpmn.deployer.BpmnDeployer  - Processing resource org/activiti/explorer/demo/process/simple-approval.bpmn20.xml
DLH onRequestStart
org.activiti.explorer.identity.LoggedInUserImpl@2c97b5d7
org.apache.catalina.session.StandardSessionFacade@7c61898c
ExplorerApp init
EA LoggedInUser org.activiti.explorer.identity.LoggedInUserImpl@2c97b5d7
!!EAS getApplicationClass!!
!!EAS getApplicationClass!!
EAS getNewApplication
EAS request org.apache.catalina.core.ApplicationHttpRequest@92e5ec4
EApp RequestStart Method
org.activiti.explorer.ExplorerApp@69ed628f
EA User null
EA request: org.apache.catalina.core.ApplicationHttpRequest@92e5ec4
EA response: org.apache.catalina.connector.ResponseFacade@5179f6a
DLH request authenticates
DLH authHeader Basic kermit:kermit
DLH st.hasMoreTokens() true
DHL username: kermit
DHL password: kermit
DHL loggedInUser org.activiti.explorer.identity.LoggedInUserImpl@13eaff
setting user
EA User After Authenticate Response: org.activiti.explorer.identity.LoggedInUserImpl@13eaff
true
true
showing default page
DLH onRequestStart
org.activiti.explorer.identity.LoggedInUserImpl@13eaff
org.apache.catalina.session.StandardSessionFacade@27025142
ExplorerApp init
EA LoggedInUser org.activiti.explorer.identity.LoggedInUserImpl@13eaff
!!EAS getApplicationClass!!
!!EAS getApplicationClass!!
EAS getNewApplication
EAS request org.apache.catalina.core.ApplicationHttpRequest@aac0dac
EApp RequestStart Method
org.activiti.explorer.ExplorerApp@785f5cb8
EA User null
EA request: org.apache.catalina.core.ApplicationHttpRequest@aac0dac
EA response: org.apache.catalina.connector.ResponseFacade@5179f6a
DLH request authenticates
DLH authHeader null
DHL loggedInUser null
EA User After Authenticate Response: null
DLH onRequestStart
null
org.apache.catalina.session.StandardSessionFacade@1baeb1e9
ExplorerApp init
EA LoggedInUser null
!!EAS getApplicationClass!!
!!EAS getApplicationClass!!
EApp RequestStart Method
org.activiti.explorer.ExplorerApp@785f5cb8
EA User null
EA request: org.apache.catalina.connector.RequestFacade@5c6b48f7
EA response: org.apache.catalina.connector.ResponseFacade@5179f6a
DLH request authenticates
DLH authHeader null
DHL loggedInUser null
EA User After Authenticate Response: null
DLH onRequestStart
null
org.apache.catalina.session.StandardSessionFacade@1baeb1e9
EApp RequestStart Method
org.activiti.explorer.ExplorerApp@785f5cb8
EA User null
EA request: org.apache.catalina.connector.RequestFacade@5c6b48f7
EA response: org.apache.catalina.connector.ResponseFacade@5179f6a
DLH request authenticates
DLH authHeader null
DHL loggedInUser null
EA User After Authenticate Response: null
DLH onRequestStart
null
org.apache.catalina.session.StandardSessionFacade@1baeb1e9
</blockcode>

It looks to me like after logging in, the ExplorerApplicationServlet method getApplicationClass is called a second time, and this time after getting through the methods in the servlet the user is null, and the HTTP request and response are also both null.

[jbarrez]

"But it calls the get explorer application servlet twice (must be a bug in my code), and the second time its called the user is null."

Isn't that due to the way basic auth works? Doing a call first and then a second with the credentials.

So if you're running both on the same server, why not think in the direction of using something like a cookie with some token that you validate both in REST and Explorer? Anyhow you'd like to tackle this is going to require quite a bit of coding though :s

[zorro1212]

It seems I have some work to do then. I have filled the authenticate(request, response) method in the default login handler class of activiti explorer, but it seems that even though the username and password are verified using the authenticate(username, password) that the user is never actually set/logged in and the login page still shows. Is there some where else that I need to add/modify code in order to user http requests to pass credentials? Ive looked all over the forum and couldnt find any answers pertaining to this that were not REST or LDAP specific (I am looking for just activiti-explorer right now without LDAP and a login through http request call).

[jbarrez]

I don't see anything wrong with your LoginHandler above.

In the LoginPage, there is an ActivitiLoginListener class with an onLogin method. Did you already try to set a breakpoint there and debug what's going on? That's the logic that actually would show you the default page on login.

[zorro1212]

Well, the program never hits that method. It only goes to initUI() of that class. Ill keep looking though. But I suspect that since I am not using the login form and instead I am authenticating through http request, I would never actually trigger the event that would call onLogin. This is an assumption till I can prove it though.