Getting started with Sphinx and XData

BIZ TMS Sphinx
1

Hi,

I started working with XData, Aurelius and Sphinx. I managed to set up an XData with some entities and to set up Sphinx, as well as authenticating in Web Core using the TTMSSphinxWebLogin

What I am missing somehow is the next step: how to validate the JWT, make sure entities and service methods are only available when authenticated, check authorization based on scopes in the JWT, …

Is there any link/documentation specifically for XData with Sphinx that I missed ?

Thanks

2

Yes, please refer to:

3

Thank you Wagner,

Unfortunately I am missing something (seems like JWT InsufficientPermissions error - #4 by wlandgraf):slight_smile:

(For now) I narrowed it down to:

The API Server has JWT as middleware installed with the correct (symmetrical) key

The API has set all DefaultEntitySetPermissions

My Entity ahs the attribute [EntityAuthorize(EntitySetPermissionAll)]

When I access the entity without a key (also in swagger): I can access the all methods for the entity

I clearly am missing something trivial…

Thank you

4

Can you maybe share a sample project reproducing the issue, so we can easily find out the culprit?

5

Hi Wagner,

The API and sphinx server code (as well as the webcore client code) is at: https://filedn.eu/lI3x2OqgUFRzx1fXob3iLy4/bizdemo.7z

Meanwhile I found out that, when I put uses XData.Security.Attributes in the entities pas file

  • it makes accessing the entitiy in swagger (without JWT) returning a 403: that seems good

(though which seems strange to me, because the code with the [EntityAuthorize] attribute built fine without the uses clause)

However:

  • in Web Core, while getting a valid token from the Sphinx server (using TSphinxWebLogin) and then opening an XDataWebConnection1, I still got a 403.

(the token was valid: I checked on jwt.io with the correct symmetrical key and the token was valid for another hour: I even tried to accept expired tokes, and this did not make a diffference)

Or in the Webcore application: should I explicitly set the JWT token somewhere in the XDataWebConnection1 ? As far as I can tell there is no link in WebCore between the TSphinxWebLogin and the XDatawebConnection or XDataWebDataset ?

In the request to the server to fetch the data in the requestheaders I can’t see the token being passed

Edit: I added this:

procedure TForm1.XDataWebConnection1Request(Args: TXDataWebConnectionRequest);
begin
Args.Request.Headers.SetValue('Authorization', 'Bearer ' + SphinxWebLogin1.AuthResult.AccessToken);
end;

this seems to work. Is this the way to do this ? Will it handle refreshtokens as well ?

Thank you

6

You should pay attention to the compiler warnings. Delphi warns you that the attribute is unknown. That's Delphi behavior, it doesn't give you a compile error, but a warning, and simply ignores the attribute.

Yes, TWebSphinxLogin gives you the access token, it's up to you to use it in your APIs. Note that Sphinx and XData works independently. You can perform requests to XData passing an access token that was obtained by different ways. And you can use Sphinx to retrieve access tokens to perform requests to API that are not necessarily XData.

Yes. Before using AuthResult.AccessToken just check if it's valid, if not, call Login again and it should handle everything automatically.

7

Thank you Wagner !