Angular 4 (2-5), Cache Authentication, Cache2017.1, REST

 

We have authentication, but we don't want CacheUsername and CachePassword to be in url (this works), but in header (we have not get this work, Problem 1).

We have REST services and they work with CacheUserName and CachePassword, but we want them work with cookie after authentication is done (we have not get this work, Problem 2).

How to code the client and what all we have to code and set on server?

 

We've tried last this (asked also WRC /Tomas, but not got the answer).

 

    private _loginUrl = _param.baseUrl + 'login';

    login(username: string, password: string) {

        let headers = new Headers();

       headers.append('Authorization', 'Basic ' + Base64.encode(username+':'+password)); 

        let options = new RequestOptions({ headers: headers, withCredentials: true });

        options.headers=headers;

        let tUrl=this._loginUrl

        return this.http.get(tUrl,options)

            .map((res: Response) => res.json())

            .catch((error: any) => Observable.throw(new Error(error.status))

            );

    }

GOT: 

Failed to load http://server:port/csp/xxx/login: Request header field Authorization is not allowed by Access-Control-Allow-Headers in preflight response.

After this tried

        let requestOptions={

            headers: new Headers(

                {'Accept':'application/json',

                'Content-Type':'application/json',

        'Authorization': 'Basic ' + Base64.encode(username+':'+password)}

        )};

        let tUrl=this._loginUrl

        return this.http.get(tUrl,requestOptions)

            .map((res: Response) => res.json())

            .catch((error: any) => Observable.throw(new Error(error.status))

            );

WebApplication is /csp/xxx and we've enabled Application, CSP/Zen and inbound Web Services. Use Cookie for Session: allways. Session cookie path is  Authentication: unauth, Password, Delegated. No login cookie, but do we need it after authentication? (Problem 2)  

On server we have Dispatch Class xxx.service:

Class xxx.service Extends %CSP.REST
{

Parameter UseSession As Integer = 1;

Parameter HandleCorsRequest = 1;

Parameter CONTENTTYPE = "application/json";

XData UrlMap [ XMLNamespace = "http://radu.lforce.fi/urlmap" ]
{
<Routes> <Route Url="/login" Method="GET" Call="xxxlogin" />
<Route Url="/logout" Method="GET" Call="xxxlogout" />
</Routes>
}

ClassMethod xxxlogin() As %Status
{
    set $ZT="ERROR"
    #dim array As %ArrayOfDataTypes
    set array=##class(Radu.DataAccess.User).GetUsersDataByCurrentUsername()

    set dynObj={}
    ...
    do dynObj.%Set("onOikeus",tOnOikeus,"boolean")
    do:'tOnOikeus dynObj.%Set("errorMessage","Sinulla ei ole vaadittavaa oikeutta "_tVaadittavaOikeus)
    do dynObj.%Set("username",array.GetAt("kayttajatunnus"))
    do dynObj.%Set("password",array.GetAt("salasana"))
    do dynObj.%Set("fullName",$ZCONVERT(array.GetAt("fullName"),"O","UTF8"))
    do dynObj.%Set("sessionId",%session.SessionId)

    set %session.AppTimeout=21600
    write dynObj.%ToJSON()

    quit $$$OK
ERROR do BACK^%ETN
    quit $$$ERROR($$$CacheError,"$ZE")
}

ClassMethod xxxlogout() As %Status
{
    set $ZT="ERROR"
    try {
      ...

    }
    catch {
      ...

      do BACK^%ETN
    }
    set dynObj={}
    write dynObj.%ToJSON()
    do %session.Logout()
    set %session.EndSession=1
    set %session.AppTimeout=1
    quit $$$OK
ERROR do BACK^%ETN
    quit $$$ERROR($$$CacheError,"$ZE")
}

ClassMethod OnHandleCorsRequest() As %Status
{
#; Get the origin
     Set tOrigin=$Get(%request.CgiEnvs("HTTP_ORIGIN"))

     #; Allow requested origin
    Do ..SetResponseHeaderIfEmpty("Access-Control-Allow-Origin",tOrigin) 
    #; Set allow credentials to be true
    Do ..SetResponseHeaderIfEmpty("Access-Control-Allow-Credentials","true")
    #; Allow requested method
    Set tMethod=$Get(%request.CgiEnvs("HTTP_ACCESS_CONTROL_REQUEST_METHOD"))
    Do ..SetResponseHeaderIfEmpty("Access-Control-Allow-Method",tMethod)
    quit $$$OK
}

ClassMethod OnHandleOptionsRequest() As %Status
{

    quit $$$OK
}

}

Some tests works in SoapUI, but not this way :(

PS. No AngularJS, but Angular 4 (2-5).