MobileFirst OAuth and Logout -


i have test application accesses 2 adapters:

  1. a javascript adapter protected securitytest referencing realm
  2. a java adapter method protected oauth scope corresponding same realm.

if follow sequence works expected:

  1. attempt access js adapter, challenged, authenticate, data.
  2. wl.client.isuserauthenticated() , wl.client.getuserinfo() behave expected
  3. logout using wl.client.logout()
  4. wl.client.isuserauthenticated() shows i'm not authenticated
  5. a second attempt access js adapter causes challenge, expeccted.

however, java adapter logout() seems not behave expected.

  1. starting no session, attempt access java adapter, challenge happens expected , data
  2. i can access js adapter without further challenge , wl.client.getuserinfo() calls gives expected results.
  3. wl.client.logout() appears work, in wl.client.isuserauthenticated() shows i'm not authenticated
  4. but call java adapter still works without further challenge
  5. a call js adapter result in challenge

if i'm running in browser simulator environment can destroy oauth session using command:

 localstorage.removeitem("com.worklight.oauth.idtoken")

the question is:

should wl.client.logout() method have destroyed oauth session? if not api should using?

with oauth, logout 'works' differently. see following user documentation topic (search "logout"): http://www-01.ibm.com/support/knowledgecenter/sshs8r_7.0.0/com.ibm.worklight.dev.doc/dev/c_oauth_security_model.html?lang=en

the login/logout api:
wlclient login/logout api enables user log in , log out of specific realm, updating server side security state. however, in new oauth-based security model, security credentials kept in access token on client side. result using api cause inconsistent state, example, in client logged out of realm on server side still holds valid token realm on client side. solve inconsistency, recommended re-obtain access token, using obtainauthorizationheaderforscope method, after successful login or logout.

for example, consider client passed security checks realm1 , realm2, , later calls logout(realm2). in case, access token on client still contain security credentials both realm1 , realm2, , client use token access protected resources. refresh token, is, obtain token realm1 only, client calls obtainauthorizationheaderforscope without logged out realm realm2.

in javascript equivalent call is:

 wlauthorizationmanager.obtainauthorizationheader("somerealm")

Comments

Post a Comment

Popular posts from this blog

c++ - Difference between pre and post decrement in recursive function argument -

i have following sample code used pre-decrement void function(int c) { if(c == 0) { return; } else { cout << "dp" << c << endl; function(--c); cout << c << endl; return; } } this function give output input 4 : dp3 dp2 dp1 dp0 0 1 2 3 but when use post decrement void function(int c) { if(c == 0) { return; } else { cout << "dp" << c << endl; function(c--); cout << c << endl; return; } } output goes in infinite loop dp4 can explain me in detail why happens ? this happens because function(c--) called same value of c , when finishes c decremented. recursively called, hence called same value no chance of return , hit stack overflow error. assume this, int x = 1, y = 0; y = x++ result y == 1 , x == 2. if y = ++x , bot x , y 2.
Read more

php - Nothing but 'run(); ' when browsing to my local project, how do I fix this? -

i added new project. made mistake in projectname.conf file in sites-available apache2, led me reinstalling apache2. after reinstalling , re-enabling projects on every page of every project .. <body> run(); </body> .. i've run composer update, restarted service, restarted pc, checked config files, tried disabling new project. there nothing in error log, , access.log: 127.0.0.1 - - [15/may/2015:01:40:47 +0200] "get / http/1.1" 304 181 "-" "mozilla/5.0 (x11; ubuntu; linux x86_64; rv:38.0) gecko/20100101 firefox/38.0" maybe i'm forgetting apache2 reinstall? don't think did different last time installed it. looks haven't setup php correctly. take @ this great guide , maybe you're forgetting link php config apache2.
Read more

php - How can I echo out this array? -

i don't know how go grabbing data in variable , put foreach loop. class tree{ private $info = array( array('name'=>'jim','state'=>'nu','company'=>'nu','phone'=>array('cell'=>'5615111111','office'=>'5611111111'),'email'=>array('primary'=>'exs@example.com','ex@there.com')), array('name'=>'joe smith','city'=>'phoenix','phone'=>'4805551111','email'=>'jsmith@some_email.com'), array('name'=>'john doe','city'=>'chandler','company'=>'doe co.','email'=>array('jdoe@gmail.com','personal'=>'email@email.com'),'phone'=>'6025550002') ); } if you're inside of class, can access private variable using $this->variablename . example, i...
Read more