Hi Deva,
taking inspiration from your quote I found a way to do what i need! The problem in fact is:
The user is authenticated on SASReportViewer, which uses a session-based authentication
The user wants to access the CAS APIs, which use a token-based authentication
So basically knowing this I would say that there is no way to recycle the session auth to get a token. And this problem happens the same on restaf of course, the user must insert his credentials twice.
I found out a "dirty" way
I created a new oauth client on /SASLogon/oauth/clients with this config:
{
"scope": [
"openid",
"*"
],
"client_id": "xxx",
"client_secret": "yyy",
"resource_ids": [
"none"
],
"authorized_grant_types": [
"authorization_code",
"password",
"refresh_token"
],
"redirect_uri": [
"/fake"
],
"autoapprove": [
"true"
],
"authorities": [
"uaa.resource",
"sasapp"
],
"use-sessions": "true"
}
(note the "/fake" redirect uri)
So:
The user authenticates himself on SASReportViewer, and gets a session auth cookie
After that, my js sends a request to /SASLogon/oauth/authorize asking for a 'code' response_type, and sends together the session auth cookie the user has already got
My js gets a response with a redirect to /fake which in turns gets 404 not found (of course, it's fake!)
But, in the /fake redirect url there is the valid response code!
My js grabs this response code, and sends a request to /SASLogon/oauth/token with the oauth client_id and client_secret, and the response code, without sending the session auth cookie (it would not work, that's the main problem of this topic)
My js gets a response with a valid auth token!
My js can now use this token to post /cas/sessions and so on
So in this way the user authenticates himself only once on the standard SASLogon form to get to SASReportViewer, and with the "/fake" trick I recycle its session auth cookie to get a valid auth token. (Just to point out, XSRF is not needed in any of these steps, while is needed on the standard SASLogon form of course but this is handled directly by the form).
If someone has a better way to accomplish this without the "/fake" trick please share!
References I used to study this topic:
https://docs.cloudfoundry.org/api/uaa/version/4.30.0/index.html#overview
https://www.sas.com/content/dam/SAS/support/en/sas-global-forum-proceedings/2018/1737-2018.pdf
https://blogs.sas.com/content/sgf/2019/01/25/authentication-to-sas-viya/
Thank you
Regards
... View more
