Project

General

Profile

Wiki » Documentation » Installation Configuration and Administration Guide » Administration REST API »

Legacy Security Authentication Administration API

The Legacy Security Authentication Administration API is a sub-module of Administration REST API which allows to communicate with FWD server using REST from an application for administering the 4GL security tables. These are the _sec-authentication-system and _sec-authentication-domain meta tables. For each table, a set of APIs are exposed, the paths reflecting the CRUD operations.

Note: The work on this feature was implemented in #8976.

Configuration

Enable the Legacy Security Authentication Administration API

To enable the Legacy Security Authentication Administration API, the Administration REST API must be enabled. See the Administration REST API for instruction how this is achieved and how the admin user is created. If needed, specialized administrators can be created for the security tables.
The REST API is enabled immediately after adding the ACLs in directory and restarting the FWD server. The ACLs can be configured for each combination of HTTP method and context path.

Add Permissions for the Legacy Security Authentication Administration API

In order to have access to the administration API, you need to add permissions. This is done via ACLs, in the directory, under the acl/webservice node.

To authorize the admin-rest to access _sec-authentication-domain, add the following nodes:

          <node class="container" name="002100">
            <node class="resource" name="resource-instance">
              <node-attribute name="reference" value="ADMIN:GET:/admin/security/domains/.*"/>
              <node-attribute name="reftype" value="FALSE"/>
            </node>
            <node class="webServiceRights" name="rights">
              <node-attribute name="allow" value="true"/>
            </node>
            <node class="strings" name="subjects">
              <node-attribute name="values" value="admin-rest"/>
            </node>
          </node>
          <node class="container" name="002400">
            <node class="resource" name="resource-instance">
              <node-attribute name="reference" value="ADMIN:POST:/admin/security/domains/.*"/>
              <node-attribute name="reftype" value="FALSE"/>
            </node>
            <node class="webServiceRights" name="rights">
              <node-attribute name="allow" value="true"/>
            </node>
            <node class="strings" name="subjects">
              <node-attribute name="values" value="admin-rest"/>
            </node>
          </node>
          <node class="container" name="002600">
            <node class="resource" name="resource-instance">
              <node-attribute name="reference" value="ADMIN:PUT:/admin/security/domains/.*"/>
              <node-attribute name="reftype" value="FALSE"/>
            </node>
            <node class="webServiceRights" name="rights">
              <node-attribute name="allow" value="true"/>
            </node>
            <node class="strings" name="subjects">
              <node-attribute name="values" value="admin-rest"/>
            </node>
          </node>
          <node class="container" name="002800">
            <node class="resource" name="resource-instance">
              <node-attribute name="reference" value="ADMIN:DELETE:/admin/security/domains/.*"/>
              <node-attribute name="reftype" value="FALSE"/>
            </node>
            <node class="webServiceRights" name="rights">
              <node-attribute name="allow" value="true"/>
            </node>
            <node class="strings" name="subjects">
              <node-attribute name="values" value="admin-rest"/>
            </node>
          </node>

To authorize the admin-rest to access _sec-authentication-system, add the following nodes:

          <node class="container" name="001100">
            <node class="resource" name="resource-instance">
              <node-attribute name="reference" value="ADMIN:GET:/admin/security/domain-types/.*"/>
              <node-attribute name="reftype" value="FALSE"/>
            </node>
            <node class="webServiceRights" name="rights">
              <node-attribute name="allow" value="true"/>
            </node>
            <node class="strings" name="subjects">
              <node-attribute name="values" value="admin-rest"/>
            </node>
          </node>
          <node class="container" name="001400">
            <node class="resource" name="resource-instance">
              <node-attribute name="reference" value="ADMIN:POST:/admin/security/domain-types/.*"/>
              <node-attribute name="reftype" value="FALSE"/>
            </node>
            <node class="webServiceRights" name="rights">
              <node-attribute name="allow" value="true"/>
            </node>
            <node class="strings" name="subjects">
              <node-attribute name="values" value="admin-rest"/>
            </node>
          </node>
          <node class="container" name="001600">
            <node class="resource" name="resource-instance">
              <node-attribute name="reference" value="ADMIN:PUT:/admin/security/domain-types/.*"/>
              <node-attribute name="reftype" value="FALSE"/>
            </node>
            <node class="webServiceRights" name="rights">
              <node-attribute name="allow" value="true"/>
            </node>
            <node class="strings" name="subjects">
              <node-attribute name="values" value="admin-rest"/>
            </node>
          </node>
          <node class="container" name="001800">
            <node class="resource" name="resource-instance">
              <node-attribute name="reference" value="ADMIN:DELETE:/admin/security/domain-types/.*"/>
              <node-attribute name="reftype" value="FALSE"/>
            </node>
            <node class="webServiceRights" name="rights">
              <node-attribute name="allow" value="true"/>
            </node>
            <node class="strings" name="subjects">
              <node-attribute name="values" value="admin-rest"/>
            </node>
          </node>

API Routes

Related to _sec-authentication tables, there are ten exposed APIs which provide basic CRUD operations for the two meta tables. The first five APIs handle the management of domain types, stored in _sec-authentication-system meta table.

List the Current Set of Domain Types

API GET https://localhost:7443/admin/security/domain-types/<database>
Header Must include authorization: the FwdSessionId from a previous login call.
Body No body required.
Response The response contains the list of domain types defined for the requested database. For example, the default 4GL setup will return:
{
    "domains": [
        "_extsso",
        "_oeusertable",
        "_oslocal" 
    ]
}

Request the Details of a Specific Domain Type

API GET https://localhost:7443/admin/security/domain-types/<database>/<domain-type>
Header Must include authorization: the FwdSessionId from a previous login call.
Body No body required.
Response The response contains the list of domain types defined for the requested database. For example, the details on same database of a default 4GL setup for _oeusertable domain may return:
{
    "_oeusertable": {
        "_Domain-type-description": "Built-in authentication module",
        "_Custom-detail": "",
        "_PAM-module-name": "",
        "_Key-store-id": "",
        "_Domain-type": "_oeusertable",
        "_PAM-callback-procedure": "",
        "_PAM-library-checksum": "020007AAIAAAAAAA==",
        "_PAM-plug-in": true
    }
}
Note the JSON attributes are the 4GL legacy field names.

Create a New Domain Type

API POST https://localhost:7443/admin/security/domain-types/<database>
Header Must include authorization: the FwdSessionId from a previous login call.
Body The body is a JSON with all fields required. If a field is not present, the default 4GL value (as defined with INITIAL option) will be used. The order is irrelevant.
Here is an example of body for creating a new domain type named my-domain-type.
{
    "_Domain-type": "my-domain-type",
    "_Domain-type-description": "I have just created a new domain type!",
    "_Custom-detail": "custom details",
    "_PAM-module-name": "pam-pam",
    "_Key-store-id": "221",
    "_PAM-callback-procedure": "pam-callback",
    "_PAM-library-checksum": "020007AAIAAAAAAA==",
    "_PAM-plug-in": false
}
Response The response contains a single flag with the success of the operation. If all goes well, we have:
{
    "success": true
}

Update an Existing Domain Type

API PUT https://localhost:7443/admin/security/domain-types/<database>/<domain-type-name>
Header Must include authorization: the FwdSessionId from a previous login call.
Body The body is a JSON with all fields to be altered. If a field is not present, it will NOT be updated. The order is irrelevant.
Here is an example of body for changing only the description and the name of an existing domain type named my-domain-type. 
{
    "_Domain-type": "my-changed-domain-type",
    "_Domain-type-description": "I have just modified a this domain type!",
}
Response The response contains a single flag with the success of the operation. If something is not fine (for example, the domain type was not found in database), we have:
{
    "success": false
}

Delete an Existing Domain Type

API DELETE https://localhost:7443/admin/security/domain-types/<database>/<domain-type>
Header Must include authorization: the FwdSessionId from a previous login call.
Body No body required.
Response The response contains a single flag with the success of the operation. If something is not fine (for example, the domain type was not found in database), we have:
{
    "success": false
}

Next five APIs handle the management of actual domain, stored in _sec-authentication-domain meta table.

List the Current Set of Domains

API GET https://localhost:7443/admin/security/domains/<database>
Header Must include authorization: the FwdSessionId from a previous login call.
Body No body required.
Response The response contains the list of domains defined for the requested database. For example, the default 4GL setup will return:
{
    "domains": [
        "",
        "default",
        "UNIX",
        "UNIXID",
        "WINDOWS",
        "WINDOWSID" 
    ]
}

Request the Details of a Specific Domain

API GET https://localhost:7443/admin/security/domains/<database>/<domain-name>
Header Must include authorization: the FwdSessionId from a previous login call.
Body No body required.
Response The response contains the list of domains defined for the requested database. For example, the details on same database of a default 4GL setup for default domain may return:
{
    "default": {
        "_Domain-access-code": "31312c6a312a3736",
        "_Auditing-context": "",
        "_Domain-custom-detail": "",
        "_Domain-runtime-options": "",
        "_Domain-description": "",
        "_PAM-control": "",
        "_Tenant-Name": "Default",
        "_Domain-type": "_oeusertable",
        "_Domain-enabled": true,
        "_PAM-library-path": "",
        "_PAM-options": "",
        "_PAM-actions": "",
        "_Domain-category": "0",
        "_Domain-Id": 2,
        "_Domain-name": "default" 
    }
}
Note the JSON attributes are the 4GL legacy field names.

Create a New Domain Type

API POST https://localhost:7443/admin/security/domains/<database>
Header Must include authorization: the FwdSessionId from a previous login call.
Body The body is a JSON with all fields required. If a field is not present, the default 4GL value (as defined with INITIAL option) will be used. The order is irrelevant.
Here is an example of body for creating a new domain named dom0.
{
    "_Domain-name": "dom0",
    "_Domain-type": "_oeusertable",
    "_Domain-description": "My New Domain",
    "_Domain-access-code": "31312c6a312a3736",
    "_Auditing-context": "My Auditing Context",
    "_Domain-runtime-options": "Some Options for Runtime",
    "_Domain-enabled": false,
    "_Domain-custom-detail": "No details here",
    "_Tenant-Name": "fwd_tenant_1",
    "_Domain-Id": 102,
    "_Domain-category": 77
}
Response The response contains a single flag with the success of the operation. If all goes well, we have:
{
    "success": true
}

Update an Existing Domain

API PUT https://localhost:7443/admin/security/domains/<database>/<domain-name>
Header Must include authorization: the FwdSessionId from a previous login call.
Body The body is a JSON with all fields to be altered. If a field is not present, it will NOT be updated. The order is irrelevant.
Here is an example of body for changing only the description and the name of and domain type for dom0. 
{
    "_Domain-type": "_oslocal",
    "_Domain-description": "Regular domain",
}
Response The response contains a single flag with the success of the operation. If something is not fine (for example, the domain was not found in database), we have:
{
    "success": false
}

Delete an Existing Domain

API DELETE https://localhost:7443/admin/security/domains/<database>/<domain-name>
Header Must include authorization: the FwdSessionId from a previous login call.
Body No body required.
Response The response contains a single flag with the success of the operation. If something is not fine (for example, the domain was not found in database), we have:
{
    "success": false
}

© 2025 Golden Code Development Corporation. ALL RIGHTS RESERVED.