Question

REST DEEPLINK Authentication

0

Hi, I am using REST Deeplink for integrations of apps. I have to ask authentication to the user. There are custom and username/password authentication options at the service. When I use username/password, browser/pop-up login form comes, and it caches the data. So, sign-out at the host app does not work well. At the documentation it says we can change the LoginRedirectLocation. When I use the custom Auth with my custom LoginRedirectLocation/Login page; after sign-in REST service not continues operations. The user is redirected to the User Home page. So, I need to show custom login page and continue REST. How can I do that?

asked 2021-11-22

Mustafa Aydar

2 answers

Kshitij Karandikar · Answer 1 · 2021-12-10

Hi Mustafa,

What you're suggesting is similar to how OpenID works. In case of OpenID, the webapp requests user authentication from the identity provider (IDP). The user then signs in on the IDP (if not signed in already). The IDP returns the signed in user details (usually as a JWT) to the web app based on a "callback url” which is a POST REST endpoint. The web app then decodes the JWT, verifies the user and completes the sign in process.

If you want a custom implementation, you'd have to do the same thing. Publish a rest endpoint which access user information as a JWT (preferably) / json in the login request made to the POST endpoint. In that POST endpoint, you'd have to call a microflow which decrypts and validates the JWT received. Once you have the user's validated details, you can create logic to find / create the user account and/or perform any other tasks. In the end, you need to create the user session with a java action and change the HTTPResponse object to status code 302 and create a new HTTPHeader with association to HTTPResponse and key as "Location” and value as the app root url.

You can find the implementation in OIDC module available in marketplace. (https://marketplace.mendix.com/link/component/117529)
Check out the microflow – > OIDC module > Implementation > Login flow > 2b. Callback > Web > webcallback

This should be your reference to set up a custom login over REST.

Mustafa Aydar · Answer 2 · 2021-11-22

This is the flow