Digest Http Authentication

0
Is there a way to use digest authentication on webservices within mendix? i am on the consuming side of a webservice that is using Digest on authentication. Kind regards, Rob vd Berg
asked
3 answers
1

Is this about consuming a rest service? If so you maybe can try the "addHeaderToNextRequest" java action, and manually add the digest authentication to your call.

If not (or if that doesn't work) you could look at the Java code of some of these REST service Java actions on how they implement custom headers and authentication.

Edit: just checking how Digest really works. I'm guessing you need to take several steps to make the authentication work, first doing a request to get the response code (probably can be used in Mendix with "getRequestHeader"?) and then use "addHeaderToNextRequest" to not only send the username/pw to the service but also the response code.

answered
0

The addHeaderToNextRequest concept does not seem very secure. What guarantees do you have that the next request in the same thread will be the one you think it will be? Does the Mendix runtime provide any guarantees as to what is handled in what thread? What happens when your routine that does the actual call fails before calling the rest module? It all seems complex and therefore dangerous to me. I would stay away from it when I want to add sensitive information in headers.

Ofcourse I am interested in why my view might be wrong :).

answered
0

The consumed Webservice in Mendix only support basic authentication. What we do during Runtime is to combine the username+password and convert it to base64 string, then add it to the header.

With Digest, you need to combine username+password and get the MD5 string from it, then add it to the header. I would suggest to use Java Action to achieve this since Mendix does not have utility yet to convert string to MD5 string (maybe CommunityCommons?)

The other solution I can think of is if your hashing set to MD5. Then you can use 'HashString' attribute to assign the username+password value and when you retrieve it, it will be in MD5 string.

answered