Answers to: Is it possible to access Ivy's RESTful API from an HtmlDialog or within the same session?

Comment by Stelt0 on Andreas Rusch's answer

Stelt0 — Fri, 29 Mar 2019 05:49:26 -0400

I`m waiting for this feature quite a while :)

I`m connecting the pieces now: https://answers.axonivy.com/questions/1858/rest-service-security https://answers.axonivy.com/questions/1837/ajax-call-from-html-dialog-to-consume-web-service-and-rest-service https://answers.axonivy.com/questions/1828/using-modern-javascript-frameworks

Thanks a lot for addressing it !

Answer by Andreas Rusch

Andreas Rusch — Thu, 14 Mar 2019 10:29:19 -0400

LE Version 7.1+:

Since version 7.1 the Ivy Engine is able to reuse the authenticated session for the REST service call. This was implemented with XIVY-1183.

Note that the Engine will check for the CSRF (X-Requested-By) mitigation in the header. See chapter Engine REST Integration in our documentation.

LTS Version 7.0.11+:

We applied these changes to the LTS version 7.0.11 (story XIVY-3119).

Note that by default this feature is switched off and the Engine is also not checking for the CSRF header token. In order to enable the session reuse you need to set the following Java system properties to true:

IVY_REST_SERVLET_SESSION_REUSE
IVY_REST_SERVLET_CSRF_PROTECTION

For security reasons it is highly recommended to enable the CSRF mitigation when enabling the REST session reuse.

Comment by Alex Suter on Genzer Hawker's question

Alex Suter — Thu, 02 Mar 2017 11:40:25 -0500

You asked also "I'm aware of the javax.annotation.security.PermitAll/DenyAll (-- which seems to be the only annotations supported?":

We support next to @DenyAll and @PermitAll also @RolesAllowed. Look at the com.axonivy.connectivity.rest.provider.SecureService class in the Axon.ivy sample project "ConnectivityDemos".

Comment by Genzer Hawker on Genzer Hawker's question

Genzer Hawker — Thu, 23 Feb 2017 05:39:52 -0500

Hi @Reguel Wermelinger, via an internal resource, I know that the JIRA issue XIVY-1183 will address the problem I asked. Looking forward to version 6.6. Please add the answer once the feature is implemented.

Comment by Genzer Hawker on Genzer Hawker's question

Genzer Hawker — Wed, 22 Feb 2017 10:27:41 -0500

The user is authenticated (Developer on designer). Even if the header Cookie:JSESSIONID=XXXX; oam.Flash.RENDERMAP.TOKEN=-yyyyyy is transfered but it still require to input username and password. It seems the header Basic XXXX is not present so it (Jersey) will automatically assume the UserPrinciple is not initialized. The filter does not check the Cookie though.

Comment by Reguel Wermelinger on Genzer Hawker's question

Reguel Wermelinger — Wed, 22 Feb 2017 10:15:55 -0500

How did the user authenticate to access the HtmlDialog? I guess that if Basic AUTH was used to access the dialog, then the authentication headers will also be sent to follow up requests and therefore work for the REST api.

Comment by Genzer Hawker on Genzer Hawker's question

Genzer Hawker — Wed, 22 Feb 2017 09:50:53 -0500

Hi @Reguel Wermelinger, I want to expose and then let the user consumes the RESTful API from the browser. In my setup, the RESTful classes and the JSF page are in the same project.

Comment by Reguel Wermelinger on Genzer Hawker's question

Reguel Wermelinger — Wed, 22 Feb 2017 09:47:23 -0500

Did you try to use the plain JAX-RS api javax.ws.rs.client.ClientBuilder.newClient() and re-use the returned instance of the client?