Consume REST API for authentication

Consume REST API for authentication

  

Maybe I'm asking the wrong question, but I need to do the following:


Use an external REST API for authentication.  I have successfully setup the api call, but now I'm not sure what I need to do to substitute that login method for the 'normal' OutSystems login.


Anyone point me in the right direction?


Thanks!

@James

Can you tell us which API is that?

You have some tips about integrating external authentication providers here.

Let us know if you need more help with this subject.


Regards,

João

João Heleno wrote:

@James

Can you tell us which API is that?

You have some tips about integrating external authentication providers here.

Let us know if you need more help with this subject.


Regards,

João


It's a simple REST API: /api/user/login accepts a post containing a (JSON formatted) user id and password, and upon successful login returns an authentication token. I'd like to substitute this for the default OutSystems mobile login. The end goal (probably a couple of iterations in the future) is to use the end-user's work authentication system, so this is just a stepping stone to that.

OK, we have a new variable. You're talking about login in an OutSystems mobile app. Is that it? 

Yeah, mobile app, needs to login using a non-OutSystems REST api.

I've yet to implement such a system.

There are some downsides though:

  • You'll loose the built in platform login features;
  • You'll have the build all the validation logic;
  • Role validation will have to be client side only (most likely);
  • You'll probably have to think about encrypting data in your local storage;

&Etc


@João Heleno, not really... you just have to change how the authentication happens, no need to worry (yet!) about authorisation.

@James, my suggestion is:

  • Open the Users module (it will clone it).
  • Open the User_Login server action and inspect how it is implemented (that's the default action used to login either via OutSystems local database, AD or LDAP authentication).
  • Use that action as guide to implement your DoLogin server action, following a similar implementation to the AD or LDAP implementation but instead calling your REST API authentication.

OK, so after looking at the User_Login server action, 1 question:


Where do I find the 'Site' (property?)? I'd like to set a property under site (eg - UseAPILogin) and have the User_Login action test for that BEFORE all of the other tests. Then store the token returned (on a successful login) for other actions.


That brings up another question: what's the 'best practice' way to store the returned token?