Re: REST web service APIs

[Henrik Rützou <hr@xxxxxxxxxxxx>]

Nathan,

I have already this more or less designed and running in production!

That may sound like a contradiction but my RPGLE/EXTJS based framework
generates its grids and forms based on "designs" in a simple XML document
made for each function in the system where every field may be defined as
excluded or included as open for input or just as informational. The design
also
controls CRUD possibilities for each user.

The XML document is able to hold several sections/designs which different
users may point to based on the user-profile or their user group.

I'm in the process to move this XML documents into JSON based schemas
with more functionallity for my nodejs framework.

The goal is to be able to generate a generic rest service based on SYSCOLUMN
definitions and be able to configure it in JSON based schema's that either
is
made on a function specific JSON file or a JSON file where all functions are
defined in a collection.

This shift from XML to JSON is because it goes directly into a processable
javascript object and the schemas will then reside in the rest service
itself
untill the services is killed/restarted.


On Fri, Mar 23, 2018 at 7:35 PM, Nathan Andelin <nandelin@xxxxxxxxx> wrote:

> Henrik,
>
> I agree with your points. A user may be "authorized" to invoke the GET
> Employee API, but not authorized to view the employee's SSN. And in a world
> of cloud services, "users" may not have an IBM i user profile. We have a
> client who is authenticating users against an oAuth service, for example.
> We have thousands of parents and students who access our database, but who
> don't have IBM i credentials. I bet that most eCommerce sites have similar
> circumstances.
>
> I'm pleased that we're discussing access privileges. I think this is a
> sub-topic where we can compare and contrast the infrastructure that support
> web-service APIs, vs that which may be implemented via XMLSERVICE, ODBC,
> JDBC, and the like.
>
> For example, the procedure or procedures that check end-user authority
> should (and probably do) run on IBM i, as opposed to delegating that
> responsibility to web-service clients. The latter would be less secure, in
> my opinion. And the way that user privileges are defined, is more granular.
>
> Nathan.
> --
> This is the Web Enabling the IBM i (AS/400 and iSeries) (WEB400) mailing
> list
> To post a message email: WEB400@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: https://lists.midrange.com/mailman/listinfo/web400
> or email: WEB400-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at https://archive.midrange.com/web400.