HTTP Authentication

Submitted by danielaldana on Fri, 02/10/2012 - 18:36

Hi,

I've noticed a couple of posts on consuming .NET Web Services that are authenticated but I require accessing a Web Service behind Basic HTTP Authentication. How do I add the authentication header in WebMaker?

Thanks.

RE: HTTP Authentication

Hi danielaldana,

You would use a very similar approach to access a web service behind basic HTTP authentication.

You can read the documentation for more details, but the important steps are:

Deploy your service proxy using the 'HTTP Service' type, and tick the 'Allow Advanced Features' option.[/*]
Add a rule to your controller to insert the xgate HttpHeader fragment somewhere within your request message.[/*]
Ensure this fragment contains the security section with the username and password values specified.[/*]

I hope this helps. Let me know if you need any more details.

Regards,
Gerard

RE: HTTP Authentication

I tried various combinations in the username, password, host, realm, port, and client but I still couldn't get it working. I found a somewhat clunky solution by generating a request using soapUI and copying the appropriate header from the raw output and creating the appropriate attribute tag in the HttpHeader with this info. This is what I figured each field meant:

- username : user name (login id)
- password : login password
- host : Web Service host IP address or host name
- realm : Windows domain
- port : service application server port
- client : local IP address or host name

Still I tried filling all fields, leaving some blank, removing tags etc. When it did generate the header I always got a 401 Unauthorized error. What should I fill out in the fields? In soapUI I only had to fill in the user name and password.

RE: HTTP Authentication

Hi danielaldana,

You should be able to get this working without needing to pre generate the authorization header.

For a service using BASIC authentication, I think the important fields to populate in the security section are username, password, host, and port.
Eg use a fragment like:


<HttpHeader xmlns="http://www.hyfinity.com/xgate">
    <url action="" merge_option="append" request_method="GET" />
    <security preemptive="true">
        <realm />
        <host>hostname</host>
        <port>portnum</port>
        <username>user</username>
        <password>pwd</password>
        <client />
    </security>
</HttpHeader>

Depending on the service you are calling, you may need the preemptive flag to be true, so I would check what you have that set to.
Using the dashboard logs, make sure that the security fragment is being detected. When you get the 401 response, you should see an error log, which should say Header Allowed=true Header Exists=true Security Info=true in the message if the details from the HttpHeader fragment have been detected ok. Also make sure you have deployed your service proxy as an 'HTTP Service' as that provides the most options in this area.

If you are still having problems, it is often worth using a debugging proxy such as Fiddler to see the actual request/response messages being transmitted. To tell the Tomcat server to use Fiddler, you need to configure the proxy settings as detailed in http://www.hyfinity.com/node/79
The normal settings for Fiddler would be localhost and port 8888.

I hope this helps.

Regards,
Gerard