I'm getting a request error message in Kentico Xperience REST service.
I followed the documentation
And I used Hash parameter.
This works using Hash Authentication => http://localhost:81/Admin_Site/rest
However when accessing custom tables using Hash Authentication like this one => http://localhost:81/Admin_Site/rest/customtableitem.sitenamespace.tablename
I'm getting a Request Error.
Request error
Error Log
I can only access it when entering the admin credentials.
Window to enter Kentico global admin credentials
Please help
Related
We have to develop a integration to a external login provided by Azure AD (SAML 2.0).
Our system uses react for the front-end and python for the backend. The login workflow should works like this:
Front-end Login Page --> Azure - Success Login --> Azure requests to our backend success URL with user info
Everything is working fine and after a success login the Azure request arrives to our backend server. The problem is the way to read that requests and how to extract the basic information (user, email....).
We don't see any info in body or headers, only some encoded params in the url. The requests received is like this:
https://<MY_DOMAIN>#code=<RARE_CODE>&state=<BASE64_ENCODE_JSON>&session_state=<UUID_CODE>
The information of the logged user (claims) is supposed to be there, in any of those params, probably encoded in the "code" parameter. I think there must be a way to decode that information but I can't find answers in any documentation.
Any in-house solution to be able to recover those claims and access the user's login data?
I created an Api in azure and recently tried to change to authentication method to access it via OAuth2.
I requested a token using https://login.microsoftonline.com/[TENANT]/oauth2/v2.0/token/ and tried to use it to access my api via postman.
Then I tried to use the received token to make a request to my api:
I used Postman's Authorization pane to specify OAuth2.0 as the authentication method and set the Grant Type configuration to "implicit" and sent a request.
Configured like this, the request goes through using the "http" version of my api but as soon as I try to use the "https" version, I get a 401 error "Unauthorized".
Have I configured my api wrong ? Or am I using the wrong url to authenticate ?
Thanks a lot for your time.
After a lot of research I found out what was wrong :
I had to add the application ID in the allowed token audiences of identity provider (in the azure app service, navigate to authentication > locate the identity provider > click on edit > at the bottom of the page add the your app registration's application ID. For good measure I also added api://[APPLICATION ID]/.default and api://[APPLICATION ID]
There was still some authentication code left in the source code of my api. When I was trying to connect I sometime had a response which consisted of HTML titled "Sign in to your account". It was caused by a segment of code in the startup.cs file of my api which verified the user who made the request against my Azure AAD. After removing it I no longer had the error
I have set up an instance of Azure FHIR with an Azure FHIR proxy using this tutorial:
https://github.com/microsoft/health-architectures/tree/master/FHIR/FHIRProxy##configuration
I am unable to call the proxy without getting the following error message:
You do not have permission to view this directory or page.
I have created a token successfully using the following tutorial:
https://learn.microsoft.com/en-us/azure/healthcare-apis/access-fhir-postman-tutorial
I have created an app service principal in Azure with the permissions to access the FHIR proxy:
https://func-fhir-proxy-2.azurewebsites.net
I am generating the token using the following in postman:
Auth URL: https://login.microsoftonline.com/e34c8e67-182a-4085-9dc0-39a38dddea12/oauth2/authorize/?resource=https://func-fhir-proxy-2.azurewebsites.net
Access Token URL: https://login.microsoftonline.com/e34c8e67-182a-4085-9dc0-39a38dddea12/oauth2/token
Client ID: 4d138742-44c0-42cb-9878-8647a1d2ef17
Client Secret: Well..that's a secret!
Scope: openid profile
State: 12345
Postman returns 3 tokens: Access_token, Refresh_token, Id_token.
I have tried each token and all return the same 401 error.
ID token JWT looks like this:
I have tried calling the FHIR proxy API's, due to the tutorial I am not 100% which are the correct URLs:
https://func-fhir-proxy-2.azurewebsites.net/api/fhirproxy/Patient
https://fhir-test-apis.azurehealthcareapis.com/Patient/
None of this works, I just keep getting the same error. Does anyone know what I am doing wrong? Should I be calling the FHIR proxy API using the token? If so, why is the API not letting me in?
I managed to fix the issue. I found that the resource ID was needed in the auth URL:
This can be obtained from Enterprise Applications:
Also, creating two separate app registrations:
The link ending with ".../api/fhirproxy/Patient" is correct for the proxy deployment.
I'd suggest that you do a quick test that you can access the FHIR API without the proxy. You can use the existing deployment and follow instructions at https://learn.microsoft.com/en-us/azure/healthcare-apis/access-fhir-postman-tutorial.
Once you get that working, test the FHIR API with the proxy. You can start with the proxy that has the its security disabled (The FHIR api still requires security and you cannot disable it). Once you get that working, you can enable the proxy's security.
Since the proxy is a web app acting as a proxy, you will need two sets of credentials, one set for the FHIR api itself, which you specify in the proxy app, and one set for the proxy web app, which you specify in your client app, e.g. Postman or curl.
The reason for the error is actually very simple, you are using the wrong scope.
Usually the 401 error means that the audience of your token does not match your api. When you use the token to call the api, you will receive a 401 unauthorized error. The access token is issued based on the audience, so you must Make sure to set the scope to your api when you request the token. Of course you can also parse the token, check the aud claim, and make sure it is the api you want to call.
Therefore, according to your requirements, try to change the scope to: https://func-fhir-proxy-2.azurewebsites.net/.default
By the way, if you want to call api, you should use access token instead of refresh token and id token.
I've been able to setup JHipster successfully using both Token and OAuth2 authentication. With both I can login using the default admin/admin account. However, in both cases, I get 401 errors when I want to access any API endpoint, i.e: http://127.0.0.1:8080/api/users
It renders a page with the following message:
Your request cannot be processed
Sorry, an error has occurred.
Status: Unauthorized (Unauthorized)
Message: Access Denied
Am I missing anything obvious?
Are you seeing any the spring security errors in the logs? Your angular session should be passing your recently acquired auth token for the admin user as part of the request to the api. If you want to access the api again outside of angular eg curl/Java client you'll need to request a new token for the user eg https://github.com/reddit/reddit/wiki/OAuth2-Quick-Start-Example
I am trying to implement SAML authentication through nodejs. We got issuer id and assertion url (assume abc.com) from the third party SAML maintenance team.
I have tried both the following two libraries.
https://github.com/lmarkus/passport-saml-encrypted
https://www.npmjs.com/package/saml2-js#note_options
I am facing following issue. Assume i am currently in the url
http://127.0.0.1:58374/index.html#/home. Now if click login button, it is going to the identity Url. After giving the user credentials, it validates and directly redirecting to different url abc.com which is given by third-party maintenance team. Whatever callback url, i am giving at backend it didn't use.
My problem is after providing the user credentials, control is not coming back to backend node server where i can fetch SAML response. Just identity portal directly redirects to the given url. So not able to get the SAML response data.
How do i can recieve the SAML response after login validation before re-directing. Kindly share your thoughts.
thanks
r karthik.