Re: REST web service APIs

Nathan,

and then you are not even half way through ;-)

On Fri, Mar 23, 2018 at 6:25 PM, Nathan Andelin <nandelin@xxxxxxxxx> wrote:

On Fri, Mar 23, 2018 at 10:44 AM, Allen, Todd <
Todd.Allen@xxxxxxxxxxxxxxxxx>
wrote:

To secure ReST service calls from a client you generally use something
like JWT or OAuth2.

You're talking about user authentication. That's just the first step.
Authentication gets you through the front door. It lets you talk to the web
service provider, but not necessarily to invoke APIs. For that, I was
suggesting that the service check the "authority" of the user to invoke
individual APIs. The web-service could look that up in a list (i.e. query a
table).

At any rate, do you see the difference between "authentication" and
"authority"?
--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
list
To post a message email: WEB400@xxxxxxxxxxxx
To subscribe, unsubscribe, or change list options,
visit: https://lists.midrange.com/mailman/listinfo/web400
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives
at https://archive.midrange.com/web400.