I have uploaded some of my projects to GitHub, including an alpha version of a stateless token servlet.
The servlet has it’s own authentication mechanism (the password is currently not validated), and for developing purposes it uses HTTP GET. In a future release, the token will be transfered as a HTTP header. Additionally, the HTTP method will be changed to POST. Last but not least must the code be optimized. For example there is no recycling implemented at this moment, and there is a dubious bug in the token validation (which was solved by encoding it to Base64 and back again).
- Generate a Token
To generate a new token, you have to open the servlet with the following URL format:
"/create?username=<CANONICAL USER>&password=<WHATEVER>"Example for „CN=Sven Hasselbach/OU=Hasselba/O=CH“
http://example.com/token/create/?username=CN%3DSven%20Hasselbach%2FOU%3DHasselba%2FO%3DDE&password=XXXThis will return a JSON string containg the newly generated token:
{token: 'MDkgRmViIDIwMTUgMjI6NDk6MTIuMzU2IUNOPVN2ZW4gSGFzc2VsYmFjaC9PVT1IYXNzZWxiYS9PPURF!9s7dSS7F67hSS/lLODZHVM0NsTR4IurkZtjiysGzoWA='}The Token is a Base64-encoded String containing a Timestamp, the Username and a Hmac Hash and only valid for one hour.
- Validate a Token
To validate the token, you can use the URL
/validate/?token=<token>Example:
http://example.com/token/validate/?token=MDkgRmViIDIwMTUgMjI6NDk6MTIuMzU2IUNOPVN2ZW4gSGFzc2VsYmFjaC9PVT1IYXNzZWxiYS9PPURF%219s7dSS7F67hSS%2FlLODZHVM0NsTR4IurkZtjiysGzoWA%3DIf the token is valid, a new „NotesSession“ is created for the given user. The server response contains a JSON String with the current „EffectiveUserName“:
{user: 'CN=Sven Hasselbach/OU=Hasselba/O=CH'}Because the servlet creates its own session, you can be logged in as a different user: The Domino authentication is not affected by the servlet.
