How do I get p_auth value in PHP to use Liferay REST Services?

[Klaus Bachmaier, geändert vor 7 Jahren.]

I prepared a PHP script some time ago which uses some Liferay webservice calls. It's basically used to retrieve roles of Liferay users to be used in an external PHP application. The service calls initially worked fine, but now I get Security Exceptions when I try to access the Liferay Services. Problem may be the p_auth parameter, which I hardcoded into my script. A typical call looks like that (should print out a list of a users roles):

$data2 = array("p_auth" => "OvhUUGQe", "userId" => $userId);

//Shows all roles a user is directly assigned to
$jsondata = CallAPI("GET","https://localhost:8443/api/jsonws/role/get-user-roles/", $data2);

	$json = json_decode($jsondata, true);
	foreach ($json as $item)
	{
		echo "- ";
		echo $item["titleCurrentValue"];
		echo "<br>";
	}

As you see the value of p_auth is hardcoded in the $data2 array variable, but as I understood this token is dependent on my current Liferay session. So how may I get the correct value for p_auth in my PHP script?

Whenever I try to use a Liferay Service as shown above I get this in $jsondata :

{"exception":"java.lang.SecurityException","message":"Authenticated access required"}

By the way: When my script call the api services, I'm already logged in to the portal from inside the script via CAS.

[Sushil Patidar, geändert vor 7 Jahren.]

Hi,

I think you will need to configure following properties in the portal-ext.properties.

json.service.auth.token.hosts.allowed=127.0.0.1,SERVER_IP
json.service.auth.token.enabled=false
jsonws.web.service.public.methods=*
 jsonws.servlet.hosts.allowed=127.0.0.1,SERVER_IP

[Klaus Bachmaier, geändert vor 7 Jahren.]

Thanks you Sushil for your reply. I'll give it a try.

As mentioned above, I'm already logged in to Liferay while using Liferay Services, at least I use a "technical" Account to authenticate the calling code while using a service. What I don't understand: Is there a way to remotely log in a user to liferay or at least check users credentials remotely with a service, i.e. from a mobile app, or another web application?

[Tomas Polesovsky, geändert vor 7 Jahren.]

Hi Klaus,

please don't disable p_auth token, the portal became vulnerable to CSRF attacks.

The best way is to create a new account in the portal and access the services using that account via HTTP Basic authentication from your PHP.

You can check user credentials remotely also using HTTP Basic authentication, just call some REST service and you get authentication error for invalid creds.

Best,

-- tom +