Log in to create and rate content, and to follow, bookmark, and share content with other members. Not a member? Join Now!

AnsweredAssumed Answered

[SOLVED] Logout using REST fails

Question asked by mwildam on Jun 12, 2009
Latest reply on Oct 3, 2017 by nileshyadav326

Like • Show 0 Likes0
Comment • 18

In my first attempts to program against Alfresco I managed to get the login working.

For the logout it takes xml instead of json by default - don't know why - anyway how exactly must the xml look like? I tried giving it just the ticket in post parameters.

I always get 403 Forbidden as the http result code.

How should this be done?

(And maybe somebody could answer why some functions want json and some xml - this is a strange mix of formats…)

No one else has this question

Outcomes

18 Replies

mrogers Jun 12, 2009 3:45 PM
Mark Correct
Correct Answer
The logout script does not take any input.

Just a DELETE to /api/login/ticket/{ticket}.
Like • Show 0 Likes0
Actions
mwildam Jun 15, 2009 8:41 AM
Mark Correct
Correct Answer
I did this:
```
DELETE http://localhost:8080/alfresco/service/api/login/ticket/TICKET_044c71c492fdc2199d76381718941a769eeea15f
```
first without posting any parameter. I got a 401 response code which means "Unauthorized"
Reading then ( :wink: ) in the documentation (http://wiki.alfresco.com/wiki/Repository_RESTful_API_Reference#Logout) it told me
Requirements:
- Default Format: xml
- Authentication: user
- Transaction: required
- Format Style: any
So it seems that it requires authentication first (although I cannot understand why because the ticket should be authentication enough).

After your post I tried again, but I get the same response code again - so that simply does not work that way.

The next thing is writing as format "xml" and then for style "any" seems like kidding…

I tried pasting the url
```
http://localhost:8080/alfresco/service/api/login/ticket/TICKET_f42700bb5490c9a05b02a15fc7d2fd026f0866ad
```
to the browser location and guess what happened: It asked me for a login ?!?

I tried again posting some parameters getting an error that the DELETE command does not support output parameters. So now I do not understand anything of what is going on here. And it is a simple shitty logout…
Like • Show 0 Likes0
Actions
mikeh Jun 15, 2009 8:59 AM
Mark Correct
Correct Answer
The API requires authentication, otherwise you could delete any other user's session by sniffing their ticket.

Mike
Like • Show 0 Likes0
Actions
mwildam Jun 15, 2009 9:14 AM
Mark Correct
Correct Answer
The API requires authentication, otherwise you could delete any other user's session by sniffing their ticket.

Shouldn't a https connection be way to avoid sniffing?

In the meantime I found out that you must do a normal http authentication for the logout - but not for the login.
So for login you do not need http authentification but for logout you need.

I cannot understand this logic. And http login without https does not really seem to be a sure-way to avoid sniffing…
Like • Show 0 Likes0
Actions
mikeh Jun 15, 2009 9:17 AM
Mark Correct
Correct Answer
Of course, https should be configured if your security policies require it - and there's nothing stopping you configuring that. Obviously you need to apply your own SSL certificate, so it's not something we can ship out-of-the-box.

The logic is sound: if you're trying to login, then you don't need to authenticate because you don't have a session (or ticket) yet. To logout, the server must be certain it's you making the request.

Thanks,
Mike
Like • Show 0 Likes0
Actions
t.broyer Jun 15, 2009 9:31 AM
Mark Correct
Correct Answer
I did this:
DELETE http://localhost:8080/alfresco/service/api/login/ticket/TICKET_044c71c492fdc2199d76381718941a769eeea15f
first without posting any parameter. I got a 401 response code which means "Unauthorized"
Reading then ( :wink: ) in the documentation (http://wiki.alfresco.com/wiki/Repository_RESTful_API_Reference#Logout) it told me
Requirements:
Default Format: xml

Authentication: user

Transaction: required

Format Style: any
So it seems that it requires authentication first (although I cannot understand why because the ticket should be authentication enough).
You probably don't want someone else to be able to log you out, do you?

After your post I tried again, but I get the same response code again - so that simply does not work that way.

It's working very well, for me at least.
I tried pasting the url
http://localhost:8080/alfresco/service/api/login/ticket/TICKET_f42700bb5490c9a05b02a15fc7d2fd026f0866ad
to the browser location and guess what happened: It asked me for a login ?!?
This webscript will tell you if the ticket is still valid, so obviously you have to be authenticated (moreover authenticated with the same user as the one "attached" to the ticket) or it would be quite easy to use brute force until you find a valid ticket and then use it to authenticate to other webscripts.

I tried again posting some parameters getting an error that the DELETE command does not support output parameters. So now I do not understand anything of what is going on here. And it is a simple shitty logout…

1. you login (using either login.get or login.post) and obtain a ticket
2. you make requests to webscripts using this ticket to authenticate
3. you make a DELETE on /api/login/ticket/<ticket> to logout

…obviously, you can also use HTTP Basic auth; it frees you from steps 1 and 3 but you have to send username/password pair on each request (which means keeping them around…)
Like • Show 0 Likes0
Actions
mwildam Jun 15, 2009 9:53 AM
Mark Correct
Correct Answer
1. you login (using either login.get or login.post) and obtain a ticket
2. you make requests to webscripts using this ticket to authenticate
3. you make a DELETE on /api/login/ticket/<ticket> to logout

…obviously, you can also use HTTP Basic auth; it frees you from steps 1 and 3 but you have to send username/password pair on each request (which means keeping them around…)
Thanks for your explanations.
I tried now using http authentication for login and that did not work.
I still do not find the API (although only looking at login and logout now) following some clear convention. For login I may not use http authentication but for logout I must. Why isn't it enough posting the security token which I should have only and no other person probably having the desire to log me out?

Then we have the login via url parameters that returns XML but using POST it wants and returns JSON. This is confusing (at least for me).

But anyway - I can login and logout now and this is a begin - topic solved.
Like • Show 0 Likes0
Actions
mikeh Jun 15, 2009 10:11 AM
Mark Correct
Correct Answer
Then we have the login via url parameters that returns XML but using POST it wants and returns JSON. This is confusing (at least for me).
They support both, but the default is json (have a look at the webscript description http://localhost:8080/alfresco/service/script/org/alfresco/repository/login.post - there are two response templates)

Thanks,
Mike
Like • Show 0 Likes0
Actions
bgl Jul 14, 2009 11:00 PM
Mark Correct
Correct Answer
Hello,

sorry to insist on this point but I don't understand how this is working.

The argument of brute force does not really convince me since size of ticket is pretty huge.

Sniffing sounds better but I would just say that if you get the ticket, you can do much more than just logout the user so this argument about authentication and supply your login/password does not seem very good for me. I must miss something. Any lights on this interest me :-)

My problem is the following : I use restlet library for communicating between my GWT Servlet and Alfresco. When making a call to the URL for logout, I get a 401 error as mwildam raised. And I don't understand what is happening. I need to authenticate according to what I understood in this thread. Do I need to make a new authentication ? then how to use it ?

Here is what I have done : I got a ticket from my server, made some calls in my application and then I want to logout. So I pass the ticket to my GWT servlet which makes this call :
```
http://localhost:8080/alfresco/service/api/login/ticket/TICKET_36fad5c9f03d97c7f319c0b04216d9bd77a9c3e7
```
and I get this in my logs:
```
14 juil. 2009 14:45:57 com.noelios.restlet.ext.httpclient.HttpClientHelper start
INFO: Starting the HTTP client
14 juil. 2009 14:45:57 org.apache.commons.httpclient.HttpMethodDirector isAuthenticationNeeded
INFO: Authentication requested but doAuthentication is disabled
[DEBUG] Déconnexion échouée. Code erreur : 401
```
Reading what you said, I would believe that I have to pass some extra parameters as for login and password (so u=login&pw=password).

I miss something but I cannot see what. Anyone can tell me ?

Thank you !
Like • Show 1 Like1
Actions
- nileshyadav326 @ bgl on Oct 3, 2017 10:06 AM
  Mark Correct
  Correct Answer
  Thanks for highlighting the issue.
  
  well did u find the solution for this issue?
  Like • Show 0 Likes0
  Actions
bgl Jul 14, 2009 11:27 PM
Mark Correct
Correct Answer
Ok I found the way to do it : simply by doing as usual when a script is authenticated…….. Using this call
```
"/api/login/ticket/"+p_TicketSession + "?alf_ticket="+p_TicketSession
```
is working. I have submitted another URL with my ticket and the ressource is not anymore accessible. So it is working :-)

So forget my questions in my previous post :-)
Like • Show 0 Likes0
Actions
johanpi Oct 6, 2010 9:33 AM
Mark Correct
Correct Answer
It may sound stupid but I have no idea how to do this.

I did:
In the .ftl it redirected to this url… Where ticket = TICKET_ce0049993f48b9996c48dd1e855c22dd8b24f97d
location = "http://seraecmdev001.sita.co.za:8080/alfresco/service/api/login/ticket/${ticket}?alf_ticket=${ticket}"

It returns:
<ticket>TICKET_862b5e324cbd5f7bfc4d84ea5fa74be70aebca3d</ticket>

But the ticket is still valid.
Could you please supply an example.

Thanks
Johan
Like • Show 0 Likes0
Actions

bgl Oct 6, 2010 10:25 AM

Hi Johan,

Don't worry it does not seem stupid at all ! I had the same question !!

Here is a method (from a servlet) to require disconnection (code does not compile since it requires some other classes but it should be quite easy to clean it up). I use the library restlet - http://www.restlet.org/ - here (most classes in this code are coming from it )


public void disconnect(String p_TicketSession,
      String p_Login,
      String p_Password) {
    // Alfresco is over HTTP
    Client client = new Client(Protocol.HTTP);

    // URL for Alfresco (I'm using an external servlet so I have to get the URL to reach Alfresco)
    String urlRequete = getBaseUrlServicesAlfresco() +
      "/api/login/ticket/"+p_TicketSession +
      "?"+PARAM_TICKET+"="+p_TicketSession;

    // NOTE HERE THE METHOD USED FOR REST CALL : DELETE and not POST or GET
    Request request = new Request(Method.DELETE, urlRequete);

    // Calling
    Response reponse = client.handle(requete);
    Status status = reponse.getStatus();
    int returnCode = status.getCode();

    // Checking return code
    if ( returnCode == SUCCESS ) {
      logDebug("Disconnection succeeded");
    } else {
      logDebug("Disconnection failed. Error code is : " + status.getCode());
      throw new RuntimeException("Disconnection failed with http error code "+ status.getCode());
    }

  }

Should make the work !

Boris

Actions

johanpi Oct 6, 2010 1:11 PM
Mark Correct
Correct Answer
We are primarily working in webscripts so java is not the way now.

I did:
location = "${url.context}/service/api/login/ticket/${ticket}?alf_method=DELETE"

Result:
<response>
−<status>
```
200
```
<name>OK</name>
<description>The request succeeded normally.</description>
</status>
−<message>
Deleted Ticket TICKET_9d42ac57c421c13c23af75c533bafdc3649d8003
</message>
<exception/>
<callstack>
</callstack>
<server>Enterprise v3.3.1 (96) schema 4,013</server>
<time>06 Oct 2010 1:50:37 PM</time>
</response>

which seems to work. But as soon as I press back button, it assigns a new Ticket without asking to log in, which I can delete again without asking for a login.
The user is not logged out as the user van still do queries…

Any ideas?
Thanks
Like • Show 0 Likes0
Actions
bgl Oct 6, 2010 2:07 PM
Mark Correct
Correct Answer
Did you try to use the ticket you had without using back button ? For instance use the ticket to list contents in a folder.

I ask this because your case seems to be : you delete the ticket and when pressing back, you automagically get connected with a new ticket (may be there are somewhere login/pwd and they are passed when you are not connected ?)

What you do to check this assertion (or discard it :-) ) is : get disconnected. Write the content of the ticket. Then Press back button and again disconnect. Another ticket is displayed. Compare the 2 tickets : they must be different.

What is the result of this test ?
Like • Show 0 Likes0
Actions
johanpi Oct 6, 2010 2:10 PM
Mark Correct
Correct Answer
The ticket is deleted.

And I agree a new tickets is created. The 2 tickets differ.
Like • Show 0 Likes0
Actions
bgl Oct 6, 2010 2:19 PM
Mark Correct
Correct Answer
So you have now to find out why a new ticket is created ;-)

Boris
Like • Show 0 Likes0
Actions
soriaedu79 Jan 19, 2011 9:29 PM
Mark Correct
Correct Answer
Any clue about this second ticket?

I have the same problem.

Thank you
Like • Show 0 Likes0
Actions

[SOLVED] Logout using REST fails

Outcomes

Related Content

Recommended Content