API Security Problem

, ,
1

Hi,
I wrote a program with the Tamino API.
After them, I’ve activatetd the Web Server authetication. Then I protect a node in a TaminoXMLDocument.

If I make querys with the Interaktive Interface or the Tamino Explorer all work fine. The node I had protrected was not send from the tamino.

If I make the same query with my program (Tamino API), I get the full Document.

What’s wrong there?

Sven

2

Hi Sven,

it sound like in the case you query via the Interactive Interface or the Tamino Explorer, you don’t pass a user and password or the user you pass is not authenticated or authorized. If you work with your own application you pass a user and this user can be authenticated and he is authorized to query the data.

If you still don’t get it to work, add an HTTP sniffer between the Interactive Interface or Tamino Explorer and the Tamino Webserver and also between your application and the Tamino Webserver and compare if the same user is passed. (The user information can be found in the HTTP header under the Authorization parameter.

regards Eckehard

p.s. because of the Tamino Explorer uses the Tamino Java API for doing its queries as well, the Tamino Java API seem to work fine.

3

Hi Eckehard,

The username and the password are not the problem. If I make the same query with the HTTPClient-API every thing works fine.

Is it posible that the Java-API connect the ect-collection?
What restrictions are reqiured to close the DB?

thanks
Sven

4

Is it possible to sent us code snippets for both APIs (HTTPClient-API, TaminoAPI4J) showing the different behaviour?

Your questions:
>> Is it posible that the Java-API connect the ect-collection?
With the TaminoAPI4J you do not connect to a collection, you connect to a
database. For working on specific collections, you have to set the
TAccessLocation for the accessors, e.g.
TConnection connection = TConnectionFactory.getInstance().newConnection( “http://someHost/tamino/someDb” );
TXMLObjectAccessor xmlObjectAccessor = connection.newXMLObjectAccessor( TAccessLocation.newInstance( “myColl” ), TDOMObjectModel.getInstance() );

>> What restrictions are reqiured to close the DB?
You can not close a DB. You just can close a connection to a DB and there are
no restrictions for doeing that, e.g.
connection.close();