Forum Discussion
NimbostratusMagento log into API by calling the Login Resource using APM version 12
Where to start is the question. What type of access policy do I create?
Looking to set up a secure REST API from Magento to a web server in our trusted network.
So basically pushing data from Magento to an internal web server securely using a REST API and using APM as a security gateway.
The post would look something like the following.
API Login
Magento will log into the API by calling the Login Resource. Afterwards the Session Resource must be called as well.
Logging In
Generate Token
API Resource
POST /login
Login must be done over HTTPS
Request Header
Authorization
The value conforms to the Basic authentication value: "Basic " . HASH
HASH: base-64 encoded USER . ":" . PASSWORD
USER: Username
PASSWORD: Password
Example Request
Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l
Example
Response
{ "token": "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzUxMiJ9.eyJVc2VyTmFtZSI6ImRkY1xcY3JhaW5leSIsIkV4cGlyZXMiOiJcL0RhdGUoMTQxNTQwMDkxODI3NSlcLOElZYFp5ZSkyNmIkQzVtPzog1BTUF9FKFx1MDAzZTVARkN"expirationPeriod": "01:00:00" }
1 Reply
Sure, you can do this no problem. Look at "Clientless Mode" posts here in DevCentral to get an idea about how it works. Normally APM does this 302 redirect to /my.policy for web clients, but you can short-circuit that for API robots by inserting (or having big-ip insert) a special HTTP header "Clientless-Mode", either in the original request or in an irule.
