Web Script Authentication

[tleblanc]

We are new at working with web scripts and just when we think we are making progress, we get confused. We are trying to integrate ALfresco into third party applications. We would like to either past the username / password or a ticket no with query parameters. We are not sure what is the best method or if this is the proper approach. We would like to call the existing doclist web script as an example and just display the associated doc based on our query definition. Can some one help us with the doclist updates that will allow us to authentication from any third party application. We know that the doclist web script has many options within it and we would change some of its functions, but we cannot get past the basic authentication requirements.

Thanks for any help.

Terry

[pmonks]

That sounds like a bug.  Which version are you using, and which authentication mechanism (HTTP Basic vs Web Client vs JSR168) are you using to access the Web Script?

Cheers,
Peter

[alrice]

Peter, Enterprise Network v2.1.3 and using Basic http auth. I tried it with user authentication as well as guest, and same problem.

[pmonks]

I've implemented what I believe is an identical test case here and tested it on Enterprise 2.1.3, and I'm unable to reproduce the behaviour you describe - I see identical behaviour for both the Java and JS versions of my test Web Script.  The behaviour I'm seeing: if I create the file "/Projects/Applications/sessions/1234.txt" as admin, I'm unable to see it via either the JS or Java versions of the Web Script if I authenticate as guest.  However as soon as I explicitly permission that file to the "guest" user (eg. by inviting the "guest" user to be a "Consumer" of the "/Projects" space) both the JS and Java versions of the Web Script are able to see the file.  I tested via both "/alfresco/wcservice" (Web Client authentication) and "/alfresco/service" (HTTP Basic Authentication) and the behaviour was the same in both cases.

One possible explanation for the behaviour you saw is if you're testing your Web Scripts via "/alfresco/wcservice" - in this case it's easy to use the wrong credentials (eg. "admin" when the intention is to use "guest") since the browser will reuse credentials from prior logins to the Web Client.  For this reason it may be better to test using "/alfresco/service" (which always authenticates via HTTP Basic Auth) and tell your browser to drop authenticated sessions in between each test run (thereby forcing the browser to prompt for credentials again, which makes it easier to keep track of which user you're testing with).  I ran into this problem myself.   ops:

Cheers,
Peter

[alrice]

Peter, thanks much for your reply & testing!
I can confirm it's working OK now too. Still haven't tracked down the cause of the exception, but I simplified my code and it's working now. In addition, Safari was doing some strange authentication when i was not expecting it. Instead I started using curl from the command line. It gives you exact control over the authentication, cookies, etc. and is good for testing basic scripts.