API Authentication via User Login

First things first: API keys are preferred over this type of authentication using a username and password.

This method cannot be used if an OIDC-based identity provider is in use. In this case, you must use API keys.

Nevertheless, an example is provided to demonstrate how the process works.

Logging in as user 'bpcadmin'

Call via CURL

curl -X POST \
     -c cookies.txt \
     -H 'Content-Type: application/x-www-form-urlencoded; charset=utf-8' \
     "http://localhost:8181/cxf/bpc-core/authentication" \
     --data-urlencode "tenantname=DEFAULT" \
     --data-urlencode "username=bpcadmin" \
     --data-urlencode "password=bpcadmin"

Response

{
  "loginName": "bpcadmin",
  "email": "",
  "firstName": "",
  "lastName": "",
  "organisations": [ "DEFAULT" ],
  "inactiveOrganisations": [],
  "roles": [ "bpcadmin", "bpcuser" ],
  "rights": [ "loadModule_dashboard", "loadModule_account", "loadModule_blank" ],
  "principals": {
    "X-Csrf-Token": [ "_4rpjBU5_dEFBVVAVkF6LUKV1AjvdRWJSC0QLrOoZtagdFfILQoOgtGhu4X8ppd2X2kbowjl8UEp1j_tKEPaIw1c2FbcQNJfaAX-AgoiI8Cse9_FHPO9omcm8z-UE3F-_ScFZfqIL9ZRPAWWpfkM48G20OU3nu8_E5sPdIqF8EY" ],
    "org.apache.karaf.jaas.boot.principal.UserPrincipal": [ "bpcadmin" ]
  },
  "customData": {},
  "expirationDate": 1648067566204
}

You must save the cookies and retain the X-Csrf-Token from the JSON response. It will be used in the next step.

Check if the session is valid

Call via CURL

curl -X GET \
     -b cookies.txt \
     "http://localhost:8181/cxf/bpc-core/authentication"

Response if successful

{
  "loginName": "bpcadmin",
  "email": "",
  "firstName": "",
  "lastName": "",
  "organisations": [ "DEFAULT" ],
  "inactiveOrganisations": [],
  "roles": [ "bpcadmin", "bpcuser" ],
  "rights": [ "loadModule_dashboard", "loadModule_account", "loadModule_blank" ],
  "principals": {
      "X-Csrf-Token": [ "_4rpjBU5_dEFBVVAVkF6LUKV1AjvdRWJSC0QLrOoZtagdFfILQoOgtGhu4X8ppd2X2kbowjl8UEp1j_tKEPaIw1c2FbcQNJfaAX-AgoiI8Cse9_FHPO9omcm8z-UE3F-_ScFZfqIL9ZRPAWWpfkM48G20OU3nu8_E5sPdIqF8EY" ],
      "org.apache.karaf.jaas.boot.principal.UserPrincipal": [ "bpcadmin" ]
  },
  "customData": {},
  "expirationDate": 1648067566204
}

Response if an error occurred

{
  "error": {
    "messageKey": "CORE_ERROR_IDENTITY_PROVIDER_AUTHENTICATION_FAILED",
    "code": 540,
    "name": "AUTHENTICATION_UNAUTHORIZED",
    "message": "Authentication failed",
    "properties": {}
  }
}

Call the API endpoint

Set the cookies and the X-Csrf-Token when doing so.

curl -X GET \
    -b cookies.txt \
    -H 'X-Csrf-Token: _4rpjBU5_dEFBVVAVkF6LUKV1AjvdRWJSC0QLrOoZtagdFfILQoOgtGhu4X8ppd2X2kbowjl8UEp1j_tKEPaIw1c2FbcQNJfaAX-AgoiI8Cse9_FHPO9omcm8z-UE3F-_ScFZfqIL9ZRPAWWpfkM48G20OU3nu8_E5sPdIqF8EY' \
    -H 'Content-Type: application/json' \
    "http://localhost:8181/cxf/bpc-core/opensearch/indices"

The X-Csrf-Token is not required for HTTP GET requests and was only set in the example to show how it would be set for HTTP POST/PUT/DELETE requests.

Keywords: