I noticed that by default the back-end fulcrum prompts for a user-name password. Is this using HTTP Basic Authentication?

And can this be done on the front-end?

Or should we use a URI Gateway? And if we used a URI Gateway would the user/name password be passed as an encoded paramter or would it have been decoded already and passed along as username & password paramters?

Note I would like to keep the requests stateless. So the user-name and password will be passed everytime.

In the standard NetKernel installation authentication is not set up for either the frontend or backend fulcrums.

Is this something that you want to set up for your installation?

Randy

I am trying to come up the most efficient and maintainable way of implementing authentication for our web services. HTTP supports Basic Authentication by allowing a client to submit a user/name password. I believe these are encoded into one value. I wanted to know whether the encoded value would be passed onto a URI Gateway or would the Jetty or HTTP Bridge code have already decoded and attached them as parameters.

You need to add the Jetty HTTP authentication handler.

This topic: http://www.1060.org/forum/topic/265/1 should cover the details.

Randy

If basic authentication enabled on the backend fulcrum, a username/password is required. We tested this using a browser and a JMeter test. But we have run into issues:

1. Why is a GET restricted but a POST passes through without credentials?

2. Once the request passes through the http bridge, how can one access the username from within a Java Accessor?

Regarding question (1):
Each of the HTTP verbs must be locked down.  If you lock the admin
interface using a configuration handler given in:
http://www.1060.org/forum/topic/265/2
only the GET verb is included (so any "typical URL-only request from the
browser to NK is covered).  Including the other
verb names in this same type of setup will secure these other
verbs as well. 

1. Modify the HTTPBridgeConfig to pass authorization header

<passHeaders>Authorization</passHeaders>

2. Within Java Accessor, source Authorization Header

String authorizationHeader = ((IAspectString)context.sourceAspect     ("this:param:Authorization",IAspectString.class)).getString();

3. Parse Authorization String

Basic ZXNiOm715Gs1cm41bA==

a. Remove Basic

b. Decode ZXNiOm715Gs1cm41bA==

c. Extract userid from userid:password