Maximo

Maximo

Come for answers, stay for best practices. All we're missing is you.

 View Only

  • 1.  Maximo JSON Services Authentication

    Posted 05/26/20 06:03 AM

    Our team is working on POC for custom mobile application for Maximo using Kony platform. Maximo is LDAP enabled and using MS Active Directory IdP.  I have question regarding authentication.

     

    To authenticate the user, we can call OSLC login API with user credentials and Maximo will authentication against AD. But the ask is App should authenticate directly against AD rather Maximo doing it. If app gets authenticated against AD then what is the option to call Maximo JSON API services to perform further actions(Create WO etc) without passing the actual credentials? 

     

    I have read about API keys option which is available in version 7611, but we are currently using 7608.



    ------------------------------
    Manoj Sawant

    ------------------------------



    #Maximo
    #AssetandFacilitiesManagement
    #MaximoAnywhere


  • 2.  RE: Maximo JSON Services Authentication

    Posted 05/27/20 07:27 AM

    If you configured SAML in WebSphere & Maximo you could have your user authenticate into ADFS and then WebSphere & Maximo would trust the assertion that user X from ADFS is actually user X. This way the password would never be passed to Maximo/WebSphere. Aside from that you're looking at API keys or continuing to have WebSphere handle the authentication back to AD. 

    I'm not a fan of using API keys for mobile apps. The intent for API keys is around supporting integrations that don't have a way to be interactive, especially when that environment is configured for authentication technologies like SAML that only work interactively. When you start setting up API keys for users who are using a system interactively, your credential has been reduced to that API key which often is setup to not expire and isn't something the user would typically change. And you'd still have to develop a process to create/update the API keys as you need them for your users.

    Until 7.6.1.2 (targeted for July), I wouldn't suggest using API keys unless it has very narrow focused permissions (such as creating SRs for a support form). The API key is stored in plaintext today, meaning if someone has access to the database or the new Administration work center, that API key is visible and the API key is a replacement for the user's password. You wouldn't want to enable users to impersonate other users easily (even if it's restricted to the integration endpoints). 



    ------------------------------
    Steven Shull
    Director of Development
    Projetech Inc
    Cincinnati OH
    ------------------------------



  • 3.  RE: Maximo JSON Services Authentication

    Posted 05/27/20 05:31 PM
    Hi Steven,

    Extending this discussion: 
    Now, with SAML authentication browser-less connections are not possible, so IBM's REST API documentation is suggesting the use of API keys to enable REST calls.
    What do you think about this?

    2nd point, Without the use of API keys, REST API connections create Maximo session. What if, external system calling Maximo REST API to integrate with Maximo does not have the capability to add log out api call at the end of each transaction or even if it is there it requires customization. What would be a safer way to integrate then? Can we have REST Api calls which does not create Maximo sessions without using API Key?

    3rd points, will Maximo anywhere adapter connections work with SAML authenticated Maximo server? or do we need to connect Anywhere with a non-saml server? I am am unable to test this right now. 

    Thanks,
    Biplab

    ------------------------------
    Biplab Choudhury
    Maximo Consultant
    Tata Consultancy Services
    Melbourne
    ------------------------------

    Original Message


  • 4.  RE: Maximo JSON Services Authentication

    Posted 05/27/20 05:52 PM
    For true integrations (IE a financial system into core Maximo) API keys make sense because there isn't a programmatic way when there is no user interface to authenticate that request. We still typically do these via LDAP today due to my concerns above, but especially when those are addressed, API keys would be our recommended approach. But when you have a UI (such as a mobile app or a web form), you can support SAML and still use the REST API. This is how Work Centers function today for example. You either launch from the IdP into Maximo (or configure WebSphere to redirect to the IdP) and once WebSphere validates the assertion, your cookies will show that you're authenticated and thus the REST API works without any special reauthentication at that point. 

    The session point is an advantage here as there is overhead in creating a session that gets to be avoided but isn't any different if the integration is SOAP or legacy REST API. On all integrations, if possible, the system should authenticate and provide the JSESSIONID cookie (and LTPA cookie if relevant) on all subsequent requests to minimize the number of sessions generated. This would be a requirement if using SAML and trying to handle authentication that way (though again, wouldn't work in true integration scenarios). If the other side of the integration can't handle it, then you have to come up with a process of cleaning up those old session records or ignoring them until Maximo does it automatically. Not logging the session is a good thing and a bad thing as you don't have the history to show whether that API key was being used from an IP address that you wouldn't expect. 

    For Anywhere, once the SAML authentication has been established and provided to WebSphere and validated, you should be able to provide the cookies WebSphere returns on subsequent requests and it should just work. We haven't tried this yet on Anywhere but there shouldn't be a reason why it wouldn't work.

    ------------------------------
    Steven Shull
    Director of Development
    Projetech Inc
    Cincinnati OH
    ------------------------------

    Original Message


  • 5.  RE: Maximo JSON Services Authentication

    Posted 05/27/20 07:49 PM
    Hi Steven,

    Thanks for the inputs. That was really good insight.

    Regards,
    Biplab

    ------------------------------
    Biplab Choudhury
    Maximo Consultant
    Tata Consultancy Services
    Melbourne
    ------------------------------

    Original Message


Related Content