Main Page » Mailing List » August 2016

authentication with REST API

Thursday, 4 August 2016 · 3 messages
CC
Claudio Cacciari4 Aug 2016 15:47 #
Dear All, I'm working with a BaseX instance ver 8.5.1, deployed on a tomcat 7 as war package, on a centos 7.2. I'm trying to understand how to configure the REST API authentication. Apparently, using the REST API, the authentication is required for create/write operations, but not for reading. I mean that I can download an XML resource stored in the DB, just putting the path in the browser without performing any authentication. Would it be possible to configure it in order to put even the GET calls under authentication? Is my configuration wrong? I have added a username/password in the file web.xml:
<web-app>
[...]
   <context-param>
     <param-name>org.basex.user</param-name>
     <param-value>myuser</param-value>
   </context-param>
   <context-param>
     <param-name>org.basex.password</param-name>
     <param-value>mypassword</param-value>
   </context-param>
   <context-param>
<param-name>org.basex.authmethod</param-name>
     <param-value>Basic</param-value>
   </context-param>
[...]
   <servlet>
     <servlet-name>REST</servlet-name>
<servlet-class>org.basex.http.rest.RESTServlet</servlet-class>
     <!-- service-specific credentials -->
     <init-param>
       <param-name>org.basex.user</param-name>
       <param-value>myuser</param-value>
     </init-param>
     <init-param>
<param-name>org.basex.password</param-name>
       <param-value>mypassword</param-value>
     </init-param>
   </servlet>
[...]
which results in a user.xml file like this:
$cat /usr/share/tomcat/webapps/BaseX851/data/users.xml
<users>
   <user name="admin" permission="admin">
     <password algorithm="digest">
<hash>8c6f257a751d87d1eae5ab59710a818a</hash>
     </password>
     <password algorithm="salted-sha256">
       <salt>3631994636103909</salt>
<hash>9d25a8e3dc227e54f098c3cf3b8d1ca92b76a3bebb62e0f04299beaaf443908d</hash>
     </password>
   </user>
   <user name="myuser" permission="create">
     <password algorithm="digest">
<hash>d3adbad8e6540a70a8b958ab27eec9b8</hash>
     </password>
     <password algorithm="salted-sha256">
       <salt>3629615605296334</salt>
<hash>3b64152088b90a2944b07a3d63703cdb8bffd1ccc21e5a40fe2e1f2a19307647</hash>
     </password>
   </user>
</users>
Thanks, Claudio
CG
Christian Grün4 Aug 2016 16:14 #
Hi Claudio,
Quoted text · Claudio Cacciari · 6 lines
> Apparently, using the REST API, the authentication is required for > create/write operations, but not for reading. > I mean that I can download an XML resource stored in the DB, just putting > the path in the browser without performing any authentication. > Would it be possible to configure it in order to put even the GET calls > under authentication?
The credentials in the web.xml file are only optional. If you remove all user info, user will always need to authenticate when accessing resources. Does this help? Christian
Quoted text · Claudio Cacciari · 60 lines
> Is my configuration wrong? > > I have added a username/password in the file web.xml: > > <web-app> > [...] > <context-param> > <param-name>org.basex.user</param-name> > <param-value>myuser</param-value> > </context-param> > <context-param> > <param-name>org.basex.password</param-name> > <param-value>mypassword</param-value> > </context-param> > <context-param> > <param-name>org.basex.authmethod</param-name> > <param-value>Basic</param-value> > </context-param> > [...] > <servlet> > <servlet-name>REST</servlet-name> > <servlet-class>org.basex.http.rest.RESTServlet</servlet-class> > <!-- service-specific credentials --> > <init-param> > <param-name>org.basex.user</param-name> > <param-value>myuser</param-value> > </init-param> > <init-param> > <param-name>org.basex.password</param-name> > <param-value>mypassword</param-value> > </init-param> > </servlet> > [...] > > which results in a user.xml file like this: > > $cat /usr/share/tomcat/webapps/BaseX851/data/users.xml > <users> > <user name="admin" permission="admin"> > <password algorithm="digest"> > <hash>8c6f257a751d87d1eae5ab59710a818a</hash> > </password> > <password algorithm="salted-sha256"> > <salt>3631994636103909</salt> > <hash>9d25a8e3dc227e54f098c3cf3b8d1ca92b76a3bebb62e0f04299beaaf443908d</hash> > </password> > </user> > <user name="myuser" permission="create"> > <password algorithm="digest"> > <hash>d3adbad8e6540a70a8b958ab27eec9b8</hash> > </password> > <password algorithm="salted-sha256"> > <salt>3629615605296334</salt> > <hash>3b64152088b90a2944b07a3d63703cdb8bffd1ccc21e5a40fe2e1f2a19307647</hash> > </password> > </user> > </users> > > Thanks, > Claudio
CC
Claudio Cacciari4 Aug 2016 16:27 #
Hi Christian, thanks, it works. Regards, Claudio
Quoted text · Christian Grün · 77 lines
On 08/04/2016 04:14 PM, Christian Grün wrote: > Hi Claudio, > >> Apparently, using the REST API, the authentication is required for >> create/write operations, but not for reading. >> I mean that I can download an XML resource stored in the DB, just putting >> the path in the browser without performing any authentication. >> Would it be possible to configure it in order to put even the GET calls >> under authentication? > The credentials in the web.xml file are only optional. If you remove > all user info, user will always need to authenticate when accessing > resources. > > Does this help? > Christian > > >> Is my configuration wrong? >> >> I have added a username/password in the file web.xml: >> >> <web-app> >> [...] >> <context-param> >> <param-name>org.basex.user</param-name> >> <param-value>myuser</param-value> >> </context-param> >> <context-param> >> <param-name>org.basex.password</param-name> >> <param-value>mypassword</param-value> >> </context-param> >> <context-param> >> <param-name>org.basex.authmethod</param-name> >> <param-value>Basic</param-value> >> </context-param> >> [...] >> <servlet> >> <servlet-name>REST</servlet-name> >> <servlet-class>org.basex.http.rest.RESTServlet</servlet-class> >> <!-- service-specific credentials --> >> <init-param> >> <param-name>org.basex.user</param-name> >> <param-value>myuser</param-value> >> </init-param> >> <init-param> >> <param-name>org.basex.password</param-name> >> <param-value>mypassword</param-value> >> </init-param> >> </servlet> >> [...] >> >> which results in a user.xml file like this: >> >> $cat /usr/share/tomcat/webapps/BaseX851/data/users.xml >> <users> >> <user name="admin" permission="admin"> >> <password algorithm="digest"> >> <hash>8c6f257a751d87d1eae5ab59710a818a</hash> >> </password> >> <password algorithm="salted-sha256"> >> <salt>3631994636103909</salt> >> <hash>9d25a8e3dc227e54f098c3cf3b8d1ca92b76a3bebb62e0f04299beaaf443908d</hash> >> </password> >> </user> >> <user name="myuser" permission="create"> >> <password algorithm="digest"> >> <hash>d3adbad8e6540a70a8b958ab27eec9b8</hash> >> </password> >> <password algorithm="salted-sha256"> >> <salt>3629615605296334</salt> >> <hash>3b64152088b90a2944b07a3d63703cdb8bffd1ccc21e5a40fe2e1f2a19307647</hash> >> </password> >> </user> >> </users> >> >> Thanks, >> Claudio
-- -------------------------------------- Claudio Cacciari SuperComputing Applications and Innovation Department CINECA - via Magnanelli, 6/3, 40033 Casalecchio di Reno (Bologna)-ITALY Tel: +39 051 6171655 Fax: +39 051 6132198 www.cineca.it

Written for BaseX 8.5. BaseX may have changed since: please check the current documentation.

« Error report in baseX-devTroubles moving queries from client side to .xq files on the server side using REST. »
⚡Generated with XQuery