search

eclipse-sw360 / sw360

SW360 project
https://www.eclipse.org/sw360/
Other
123 stars 99 forks source link

Rest API: Authenticate should support Auth by Screen Name #759

Open tienlee opened 4 years ago

tienlee commented 4 years ago

When Liferay's Auth type is 'By Email Address", the API can work normally. But Liferay's Auth type is changed to 'By Screen Name", the following API returns nothing

curl -i --user "admin:admin" -H "Content-Type: application/json" -H "Accept: application/json" -X POST http://localhost:8080/authorization/client-management -d '{"description":"","authorities":["BASIC"],"scope":["READ","WRITE"],"access_token_validity":3600,"refresh_token_validity":3600}' HTTP/1.1 200 WWW-Authenticate: Basic realm="Realm" Content-Length: 0 Date: Fri, 17 Jan 2020 10:37:52 GMT

I don't know this is an error or this feature has not implemented yet. Please check it.

tienlee commented 4 years ago

Assume that we have a the following account: Screen name: admin Email address: admin@test.com Password: admin

Now, I can use the REST API to get the "client_id" and "client_secret" by the following command:(configured SW360 to use the email as login):

$ curl -i --user "admin@test.com:admin" -H "Content-Type: application/json" -H "Accept: application/json" -X POST http://localhost:8080/authorization/client-management -d '{"description":"","authorities":["BASIC"],"scope":["READ","WRITE"],"access_token_validity":3600,"refresh_token_validity":3600}' HTTP/1.1 200 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: 0 X-Frame-Options: DENY Set-Cookie: JSESSIONID=B42A77700E40DC8A62DD4066AD08A2C0; Path=/authorization; HttpOnly Content-Type: application/json;charset=UTF-8 Transfer-Encoding: chunked Date: Fri, 17 Jan 2020 10:37:43 GMT { "description" : "", "client_id" : "4a7beace388c6024e8e51f71870002ff", "client_secret" : "37fb08ae-06c5-4a80-8bef-6b2c3fb5c2d4", "authorities" : [ "BASIC" ], "scope" : [ "READ", "WRITE" ], "access_token_validity" : 3600, "refresh_token_validity" : 3600 }

If I configured SW360 to use the screen name as login, the following API returns nothing although the request has succeeded (Status Code: 200)

curl -i --user "admin:admin" -H "Content-Type: application/json" -H "Accept: application/json" -X POST http://localhost:8080/authorization/client-management -d '{"description":"","authorities":["BASIC"],"scope":["READ","WRITE"],"access_token_validity":3600,"refresh_token_validity":3600}' HTTP/1.1 200 WWW-Authenticate: Basic realm="Realm" Content-Length: 0 Date: Fri, 17 Jan 2020 10:37:52 GMT

I don't know this is an error or this feature has not implemented yet. I also check the PR (https://github.com/eclipse/sw360/pull/440) from your recommendation, but this PR only supports getting user_id by email address or screen name.

$ curl -u admin@sw360.org:12345 'http://127.0.0.1:8080/api/jsonws/user/get-user-id-by-email-address?companyId=20155&emailAddress=admin@sw360.org' 20821

$ curl -u admin@sw360.org:12345 'http://127.0.0.1:8080/api/jsonws/user/get-user-id-by-screen-name?companyId=20155&screenName=sw3607' 20821

How to get the "client_id" and "client_secret" by REST API when SW360 use the screen name as login? Could you please check it?

mcjaeger commented 4 years ago

yes, will check it, it is a Request as well.. will update the docs accordingly.

mcjaeger commented 4 years ago

ugh, too long, I am sorry @tienlee

If you look in the PR conversation: https://github.com/eclipse/sw360/pull/440

There is a comment by Maximilian: "The user ScreenName in the Liferay is case insensitive, but in SW360 we use the externalId of a user as the corresponding field and our search on this is case sensitive. So using the correct screen name with correct cases works."

Is that maybe also your issue?

realasgard commented 4 years ago

@mcjaeger @tienlee PR in #440 is good fix but it's not enough in my environment. For using auth type "By Screen Name", HTTP error from Liferay's API need to be handled by SW360 REST module. Like this commit

KoukiHama commented 3 years ago

I rechecked this issue. and I think, now, SW360 api don't support to providing "client_id" and "client_secret" if user use screen name. But if #1140 is merged, User will use api, even he/she login by username. Is my understanding is right?

mcjaeger commented 3 years ago

yes, user could use two ways of authentication without user name / screenname of liferay