I have spent the past few weeks playing with and learning webservices in 7.6.1.3 with websphere 9.0.5.27
We have appserverauth set to 1 and we authenticate users against LDAP.
In Maximo 7.5 we have a few webservices set up using maxrest/rest we use the following authorization header from a service account:
Authorization Basic <base 64 user:pass>
Example:
https://<maximo server>/maxrest/rest/os/...
Following the swagger documentation in 7.6.1.3 I attempted to use the following URL structure to get an APIKEY, I tried both maxauth and authorization headers to no avail.
https://<maximo server>/maximo/oslc/os/mxapiapikey?lean=1
Playing with settings in web.xml and various maxprop values I was able to either get the HTML of the login page, or this error:
{
"Error": {
"reasonCode": null,
"message": "system#invalidsecurityconfig",
"statusCode": "400"
}
}
From my research I've discovered we cant use the authorization header unless we switch from the /maximo path to the /maxrest due to our configuration, but that still uses the new OSLC engine which is faster that the old /maxrest/rest engine
https://<maximo server>/maxrest/oslc/os/mxapiapikey?lean=1
...this works with our LDAP authentication and the same authorization header we used in 7.5.
Another method we tried from the webservices developer guide also works:
-------
curl -c cookies.txt -X POST "https://<maximo server>/maximo/j_security_check" -H "Content-Type: application/x-www-form-urlencoded" -d "j_username=YOURUSERNAME&j_password=YOURPASSWORD"
this writes the results to cookies.txt then we do the following:
curl -b cookies.txt -X POST "https://<maximo server>/maximo/oslc/os/mxapiapikey?lean=1" -H "Content-Type: application/json" -d "{\"description\": \"test api key DELETE\"}"
-----------
we are writing an external webapp that will have a login page and authenticate against maximo/websphere/LDAP and we are going to call various webservices inside maximo such as changing asset statuses and locations.
The first hurdle is authentication and how to structure our webservice calls and we are unsure which is the best approach (that is also secure.)
Which option would you recommend?
1. maxrest/oslc path and get one apikey per user, with a 30 minute expiration and use each user's own apikey for every subsequent webservice call.
2. maxrest/oslc path and use Authorization: Basic for every single call, passing each unique users base 64 encoded user:pass
3. maximo/j_security_check store and pass the cookies to each subsequent webservice call (we would get a stateful session for each user)
4. Use the maxrest/oslc/login api, validate the user and then use a service account with an API key for all werbservice calls (passing in smuser on the header so the transactions get associated with the user that logged into our external webapp)
5. Finally - if its possible to use /maximo/oslc/os/ but still keep our appserver authentication enabled.. (as of now I cannot get that to work so I think this option might be out).
* For number 2, I read that using stateless basic authorization is bad and there is overhead since each call will reauthorize the user.
Thank you,
Geoffrey