Hello,

When I create a client application in Webmethods.io API Gateway I can define only OAuth2, JWT or OpenID as an authentication strategy, is there a way to use basic Auth?

Regards
Anass

Yes,

Please use other identifiers → username.

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/acaf15ea8ee7d416ec1921e45e615c3e32ea5ec1_2_1035x201.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/acaf15ea8ee7d416ec1921e45e615c3e32ea5ec1_2_1380x268.png 2x" data-dominant-color="F3F3F3">

image1412×275 36.8 KB

The solution I found is adding an Authorization Basic string in Http headers manually, the string is username:password encoded in base64. And also activating HTTP Headers Identification type in API scope.

Capture788×114 4.27 KB

Hi @anass.tahiri

I am really sorry but this should not be done for basic authentication. But instead it should be done using Identification type as Basic Authentication and application identifier as Username.

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files/f81630b066f6e44342162cc93c025036c783f482.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files/f81630b066f6e44342162cc93c025036c783f482.png 2x" data-dominant-color="F7F8ED">

image444×679 25 KB

Hi @srikanth.prathipati1803
But how can I define my password ?

Hi @anass.tahiri
you should define the user and password here under User Management.

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/e1db604eec5b1e5889126d4ee11bcd8675427bca_2_334x750.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files/e1db604eec5b1e5889126d4ee11bcd8675427bca.png 2x" data-dominant-color="EAF0EE">

image390×874 28.7 KB

@srikanth.prathipati1803 Sorry, but here we are talking about platform users not applications, I will not make a client as a platform user just to invoke the API. I think the application authentication strategy is clear as we do for OAuth2 for example, the client has his identifiers, but he doesn’t need to be a user in the platform but he’s just related to the application.
I agree with your aproch but in case the client is a platform user, I see that it’s not something secure that’s why we use applications.

For that OAuth2 Token should be used but header should not be configured as below.