I am talking about what happens *AFTER* user authentication. The successful authentication gets you the token. All requests after that check that token.
Of course there is a difference between authentication and authorization. You can do authorization the same way. Check the authority on each authenticated request and send back the proper HTTP response code.
Thanks,
Todd
-----Original Message-----
From: WEB400 [mailto:web400-bounces@xxxxxxxxxxxx] On Behalf Of Nathan Andelin
Sent: Friday, March 23, 2018 1:25 PM
To: Web Enabling the IBM i (AS/400 and iSeries) <web400@xxxxxxxxxxxx>
Subject: Re: [WEB400] REST web service APIs
On Fri, Mar 23, 2018 at 10:44 AM, Allen, Todd <Todd.Allen@xxxxxxxxxxxxxxxxx>
wrote:
To secure ReST service calls from a client you generally use something
like JWT or OAuth2.
You're talking about user authentication. That's just the first step.
Authentication gets you through the front door. It lets you talk to the web service provider, but not necessarily to invoke APIs. For that, I was suggesting that the service check the "authority" of the user to invoke individual APIs. The web-service could look that up in a list (i.e. query a table).
At any rate, do you see the difference between "authentication" and "authority"?
--
This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing list To post a message email: WEB400@xxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://urldefense.proofpoint.com/v2/url?u=https-3A__lists.midrange.com_mailman_listinfo_web400&d=DwICAg&c=3QPdAeI_27D-X5fMaNWjvHSofEG0N1gL0BDpYdYg7W4&r=Bu367CgFas-85fVvOuX4zDovctcZsBvjNKPdTZs6lMg&m=P3xc_vVnvCF--LrDBL_W_x8ly3aInyhSuUQL-W6suxU&s=_WpVdN15fdh9gFXFzhJd8uYL_4FEQRlrYiXTlQgTMQs&e=
or email: WEB400-request@xxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://urldefense.proofpoint.com/v2/url?u=https-3A__archive.midrange.com_web400&d=DwICAg&c=3QPdAeI_27D-X5fMaNWjvHSofEG0N1gL0BDpYdYg7W4&r=Bu367CgFas-85fVvOuX4zDovctcZsBvjNKPdTZs6lMg&m=P3xc_vVnvCF--LrDBL_W_x8ly3aInyhSuUQL-W6suxU&s=5Ck7QvN9zXy5QBHLetfsAFlOA5paCbZX9fagrVjjnjY&e=.
For More Than 85 Years—Delivering Solutions That Exceed Expectations.
This communication and any transmitted documents are intended to be confidential. If there is a problem with this transmission, please contact the sender. If the reader of this message is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.
midrange.com
