For some use cases, it's necessary to allow an external application to influence which user it accesses the system as. This is what so-called server authorization is for. ABRA Flexi supports it in three variants.
Server username and password
This variant is configured using the server-auth.xml file and is not usable in the cloud. Create the file /etc/flexibee/server-auth.xml:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>WinStrom server configuration</comment>
<entry key="username">winstrom-server-admin</entry>
<entry key="password">velmi-tajne-a-hodne-dlouhe-heslo</entry>
</properties>
After restarting the server, the specified username and password will start being accepted.
🚨 The password must be at least 15 characters long, otherwise it will not be accepted. This password grants access to all data on the given installation — store it securely.
The X-FlexiBee-Authorization HTTP header can then be used to determine which user the session should be logged in as.
Client certificate
A more secure method is authorization via a client certificate, which grants administrator access. Communication must use the HTTPS protocol, connecting on port 7000. Only the certificate fingerprint (SHA1 fingerprint) is stored on the server.
You can obtain the certificate fingerprint using the command:
openssl x509 -noout -in cert.pem -fingerprint
The fingerprint must be sent to support, who will set it up for the given instance, or for the entire tree of instances. This variant is currently only available in the cloud.
Logged-in administrator
On the versioned paths /v2/admin/batch and /v3/admin/batch, the batch API can also be used by a regularly logged-in user with the manageAll and licenseMgmt permissions.
Unlike server authorization, however, this is limited to the license groups the user has access to — an item targeting a foreign license group will end up with the FAILED status. The non-versioned path /admin/batch remains reserved for server authorization.
Importing an SSL certificate via the API without a logged-in user is possible precisely by using server authorization. For details on the batch API for instance management, see the developer documentation.
💡 If you have any questions about the application, contact us at podporaflexi@abra.eu or via the chat window in the bottom right corner.