How to pass token in Authorization header and skip Integration server authentication and invoke the flow service. Currently facing Error: Integration Server rejected the request to access this resource

[vankayala_madhavi (Madhavi V)]

webMethods: I am working 10 x webMethods version. External application wants to pass the JWT token under Authorization header but webMethods Intergration server rejects the request before invoking the service. Is there any possibility ? How to pass token in Authorization header and skip Integration server authentication and invoke the flow service. Currently facing Error: Integration Server rejected the request to access this resource.

When it is passed through a custom header it works but external application wants to pass the token only in Authorization header.

Please help with any possibility and provide any steps to achieve this.

Thanks in Advance.

[engin_arlak (Engin SARLAK)]

Did you reconfigure ACL’s for the service you are invoking? From webMethods or any other backend server’s perspective, it doesn’t really matter where you pass the token or how you authorize. If you want to bypass IntegrationServer’s basic authentication, check the document below for details. You need to edit the Execute ACL so that it will allow unauthorized requests to that end point.

https://documentation.softwareag.com/webmethods/integration_server/pie10-15/webhelp/pie-webhelp/index.html#page/pie-webhelp%2Fto-authentication_and_authorization_3.html%23

[DINESH_J (Dinesh Janarthanam)]

if your requirement is to straight away to skip the IS authentication then follow the step recommended by @engin_arlak

if your question is to not to change your Integration server authentication strategies and make your request success follow the approach which you already did as below.

1. Authenticate your request 1st with Integration server authentication credentials.
2. Receive external service credentials in custom header from source and pass the same from IS to the external destination in the authorization header on behalf of the source.

[vankayala_madhavi (Madhavi V)]

ACL set to the service is Anonymous. But still Integration server authenticates and throwing below error before invoking the required service.

Integration Server rejected the request to access this resource

[engin_arlak (Engin SARLAK)]

What about the port you are using? Is it set to deny by default ?

[Nagendra_Prasad]

Hi @vankayala_madhavi

@vankayala_madhavi

But still Integration server authenticates and throwing below error before invoking the required service.

This makes sense since Authentication happens before Authorization. Please note that IS does have the ability to validate a JWT if that is a path you want to take. Refer Configuring Integration Server to Use JWT
If you have a service with anonymous execute ACL , you could also try not passing any credentials/header to invoke it.

Linking to similar discussion from a couple of years ago. You might find this interesting

Can Integration Server ignore 'bad' authentication?

When IS handles a request, it first checks authentication and rejects the request if authentication is invalid. This is true even if the IS service being invoked is set to use the Anonymous ACL. In the example below, SomeAnonymousService uses the Anonymous ACL. But incorrect HTTP Basic Authentication is presented (wrong/wrong). So IS kills the request and returns 401/Invalid Credentials. $ curl -X POST http://<IS>:5555/invoke/SomeAnonymousService -u wrong:wrong -d '<cXML><Request/></cXML>' --v…

-NP

[reamon]

@vankayala_madhavi

How to pass token in Authorization header and skip Integration server authentication and invoke the flow service.

Can’t be done.

As noted in the thread shared by @Nagendra_Prasad if the Authorization header is present, it must represent a valid user that IS knows about. Even if the service execute ACL is anonymous, IS will validate the Authorization data. If invalid/unknown, the call is rejected.

@vankayala_madhavi

When it is passed through a custom header it works

Naturally because there is no authentication being performed. The custom header is an meaningless/unused element for IS.

@vankayala_madhavi

but external application wants to pass the token only in Authorization header.

What is it that your IS component that they are calling needs them to send, if anything, for authentication? If your component does not need the caller to be authenticated/authorized for the service they are calling, then they need to NOT send the Authorization header. If the need is to pass the Authorization header through to another non-IS component, I’m not sure if that can be done without also defining in IS so that it can verify.

[vankayala_madhavi (Madhavi V)]

Yes we need to receive this token . The token is combination of Account details . so we need to extract few details from the JWT token. And the sender system is exchanging the data with many other systems so they cannot have a special code for sending in the custom Header.

[reamon]

In this case, refer to the URL shared by @Nagendra_Prasad to configure IS to use/validate JWT.

[abdulrehman_naeem (Abdul rehman)]

To skip Integration Server authentication and invoke a flow service with a token, set the Authorization header with the token and review security policies for access permission.