In some cases, it is necessary to allow an external application to influence which user it accesses the system as. This is what server-side authorization is used for. ABRA Flexi supports it in three variants.
Server Username and Password
This variant is configured using the server-auth.xml file and is not usable in the cloud. Create the /etc/flexibee/server-auth.xml file:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd">
<properties>
<comment>WinStrom server configuration</comment>
<entry key="username">winstrom-server-admin</entry>
<entry key="password">velmi-tajne-a-hodne-dlouhe-heslo</entry>
</properties>
After restarting the server, the specified username and password will start being accepted.
🚨 The password must be at least 15 characters long, otherwise it will not be accepted. This password allows access to all data on the given installation — store it securely.
The HTTP header X-FlexiBee-Authorization can then be used to specify which user the session should be logged in as.
Client Certificate
A more secure method is authorization via a client certificate, which grants administrator access. Communication must use the HTTPS protocol and connect on port 7000. Only the certificate fingerprint (SHA1 fingerprint) is stored on the server.
You can obtain the certificate fingerprint using the command:
openssl x509 -noout -in cert.pem -fingerprint
The fingerprint must be sent to support, who will set it up for the given instance, or possibly for the entire instance tree. This variant is currently available only in the cloud.
Logged-in Administrator
On the versioned paths /v2/admin/batch and /v3/admin/batch, the batch API can also be used by a regularly logged-in user with the manageAll and licenseMgmt permissions.
Unlike server-side authorization, however, this is limited to the license groups to which the user has access — an item pointing to a foreign license group will end with the FAILED status. The non-versioned path /admin/batch remains reserved for server-side authorization.
Importing an SSL certificate via the API without a user login is possible precisely by using server-side authorization. For details on the batch API for instance management, see the developer documentation.