SOAP Authentication

HCL Domino Domino Forum
1

How can I authenticate a user before sending a SOAP request to the Domino server.

For the purposes of the XML integration this is a requirement as I will not be giving anonymous access to the Lotus Script Web Agent that will be processing the SOAP request.

The SOAP requests will be ustilizing the HTTP protocal vs. SMTP etc.

In a nutshell we are developing an Outlook plug-in to sync data between our web application and the outlook client.

I was thinking of using the URL login method & redirect to my agent. There are some security concerns with that method and was hoping that soemone may know of a more elegant and secure method of authenticating before sending the http SOAP request(s).

2

Subject: SOAP Authentication

Here’s an idea…

  • Set your agent to “run as web user”

  • Add a role to the ACL called ‘runSOAP’

  • Assign that role to authorized users.

  • Create a document somewhere in the database with a Readers field set to ‘[runSOAP]’.

The first thing your agent should attempt to do is get a handle on that document.

If it can’t, exit out. If it can, continue with your SOAP request.

Ernest

3

Subject: RE: SOAP Authentication

While this is an interesting way to validate access it does not address the issue of actualy logging the user into Domino. Which is the problem at hand and I may not have been clear enough about.

The user can not access the database until they are logged into the system. Once logged in I have the rest under control.

I am trying to avoid using

  1. http://%domain%/%dbname%.nsf?Login=…

  2. I want to avoid presenting the user with the login form.

I already have the user’s name and pwd hashed in the windows registy. I want to be able to let them store this information once so that the user can simply click a “Get Info” button from within the Outlook client. So how do I login the user via http without using either of those two options.

~R

4

Subject: RE: SOAP Authentication

Assuming you are using session authentication:

You can programmatically create the http post with the users name and password in the correct fields. Its just a form like any other.

You might need to create your own session authentication form in domcfg.nsf.