API user authentication

[SergeiBakhaev]

Hello!

I have a simple JavaScript script, that users will use to update records in Archer. I'm planning to insert this script into custom iView.

How I can authenticate users if I have SSO enabled?

For testing purposes I use specially created user. But for production this is a no go because it's password is plaintext in script.

Do you have any ideas on this?

As far as I know, A2A data feeds use web services as well. How data feed authenticates itself?

[Anonymous]

Sergei,

If the script is being put in an iView, then the user who will interact with it is already authenticated to the platform. As such, you can just make the REST API calls and it will automatically use the session token of the logged in user.

[SergeiBakhaev]

Thanks for reply,

Yes, user already authenticated. But if I'm not wrong, token cookie should be HTTP only?

How I can get user's token?

[Anonymous]

Yes, the cookie is httpOnly so it's not accessible via JavaScript. As I said, if you are making REST API calls, you do not need a token to pass with the call. The system does this part for you.

If you are making SOAP calls, then you need to pass in a token, which can be scraped out of the DOM as part of the ArcherApp.globals variable.

[SergeiBakhaev]

Yes, unfortunately, I'm using web services.

I've looked into developer tools, and can't find ArcherApp variable.

Is it available in all versions? Currently, I'm using 5.5 version.

[Anonymous]

That variable was introduced in the 6.x product line, so would not be available to you in 5.x, sorry.

Let me think on a way you could get token via JS on 5.5 and I'll get back to you. GhgcdMq8HwHRCWZuqMwEETnAH3l0sBKt8utOGHAgtsY=‌, any thoughts?

[DavidPetty]

jHmVuAV1KNWv4sExZDTV0RYs6gnE44nt7BPSRVzixjo=‌ there is no way in 5.5 to get the users session token via client side JavaScript.