9

How to use Services Basic Authentication module?

I want to add http basic auth for my service. I have installed it and enabled it on my end point configuration. I got this "HTTP basic authentication Services_basic_auth has no settings available" in my end point configuration. where is the setting page?

10
+50

The module authenticates a web service call against drupal accounts.

  1. Enable the module
  2. Setup a drupal user
  3. Make the web service call with the credentials of the user.

Note that with basic auth, the credential can be intercepted if SSL isn't used.

The module uses the standard PHP authentication headers and submits the standard drupal login form, without checking for any specific roles or permissions. So any drupal user will work.

Make a test web-service call with curl or wget to test it. There are also instructions in how to call with PHP in the call with curl stackoverflow answer.

  • Is this completely different from using this structure in a single URL call? myusername:mypassword@example.com/callback – Citricguy Apr 28 '14 at 2:39
  • @Citricguy not different. This syntax is provided by the URI scheme en.wikipedia.org/wiki/URI_scheme. I wouldn't do it that way. Some REST services can be tested in a browser and I'd be worried the credentials went into browser history. With https credentials are encrypted. It would also depend on the http library, php http might be OK see the comment on php.net/manual/en/features.http-auth.php#44686. Microsoft browsers don't support the syntax anymore so if you use javascript to make the call it may not work. Some APIs do use this method goo.gl/eS9mqv – Interlated Apr 28 '14 at 22:44
  • Sorry, the way you implement the call has no impact on the call. So testing with u:p@host.com if it works is fine. I am saying that there may be issues implementing like that. I would think headers, not URL as early as possible to streamline testing. – Interlated Apr 28 '14 at 23:06
4

Above module is used to authenticate services calls using Basic access authentication technique.. You will use your Drupal Username and password to authenticate services calls by adding Authorization header to service call as follows

When the user agent wants to send the server authentication credentials it may use the Authorization header.

The Authorization header is constructed as follows:

Username and password are combined into a string "username:password"

The resulting string literal is then encoded using the RFC2045-MIME variant of Base64, except not limited to 76 char/line The authorization method and a space i.e. "Basic " is then put before the encoded string.

For example, if the user agent uses 'Aladdin' as the username and 'open sesame' as the password then the header is formed as follows:.

Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==

For Example below is the call using curl..

curl -H "Authorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==" http://www.example.com/endpoint/yourservice
  • 2
    yes, I've already read it, but still don't know how to implement it ? what to do after installing module?. any help would be great. thanks – Rijalul fikri Apr 10 '14 at 7:31
2
  1. Once the module is enabled go to Structure > Services
  2. Select your Endpoint and click Edit enter image description here

  3. Use a tool such as https://addons.mozilla.org/fr/firefox/addon/restclient/ to test your client:

enter image description here

Note: I've been having problems with it as even though the option HTTP basic authentication was marked calling a resource of this endpoint was returning 200 instead of 401. Is to say, the module failed to secure my endpoint.

The problem appears in:

https://www.drupal.org/project/services_basic_auth
version: 7.x-1.4

I solved it doing a patch for the module:

https://www.drupal.org/node/2734207

1

What's can be wrong: After set all settings:

  1. enable services-basic-authentication module
  2. create services api end-point, for example: get all nodes by
  3. set "HTTP basic authentication" checkbox on the edit page
  4. create a user

And noticed, that if you won't disable the "View published content" permission any user can has an access to service api end-point with returned result.

0

After installing the Services Basic Authentication module go to REST settings of Your server:

/admin/structure/services

Enter Edit option and at the bottom there is an an checkbox:

HTTP basic authentication

Enable it and hit Save button.

  • What user:password I will use for HTTP basic authentication? – AshwinP Nov 4 '15 at 10:21
-1

Don't forget to use content access module.

Adding additional details per MPD's request.

If you are not using the content access module then the user will see all the content including created by others which they were not supposed to see. For example, user A has stored personal data that user B is not supposed to see or wise versa. The Services Basic Authentication module enables the auth but doesn't enforce the content access. Content Access module enforces that. If you are not using the content access control then there is no point in authenticating a user.

  • Can you expand on how this module can solve the user's needs? – mpdonadio Sep 30 '15 at 12:45
  • Please see my update in the original answer. – techwestcoastsfosea Oct 1 '15 at 4:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.