Authenticate

Description

Logs the user on to the server and returns the LW-SSO, Light Weight Single Sign On cookie (and QCSession cookie in versions earlier than 2020) for use with all subsequent requests.

For external applications, it logs the user on to the server using the ClientIdKey or ClientSecretKey pair and returns the LW-SSO, Light Weight Single Sign On cookie for use with all subsequent requests.

URL

Authenticate (GET)

When logging on to OpenText Enterprise Performance Engineering Admin using basic authentication, the URL should be in the format:

Copy code
/Admin/rest/authentication-point/authenticate

If you are using a multi-tenancy system (versions 2020 SP2 and later), the tenant Unique ID should be added to the URL in the format:

Copy code
/Admin/rest/authentication-point/authenticate?tenant=tenant_UID
Copy code
Example:
GET /Admin/rest/authentication-point/authenticate?tenant=fa128c06-5436-413d-9cfa-9f04bb738df3

AuthenticateClient (POST)

Available in versions: OpenText Enterprise Performance Engineering 2021 R1 and later

When logging on to OpenText Enterprise Performance Engineering Admin from an external application, the URL should be in the format:

Copy code
/Admin/rest/authentication-point/AuthenticateClient

If you are using a multi-tenancy system, the tenant Unique ID should be added to the URL in the format:

Copy code
/Admin/rest/authentication-point/AuthenticateClient?tenant=tenant_UID
Copy code
Example:
POST /Admin/rest/authentication-point/AuthenticateClient?tenant=fa128c06-5436-413d-9cfa-9f04bb738df3

Remarks

Authenticate (GET)

This is used for OpenText Enterprise Performance Engineering's internal (Application) authentication.

To create the request header, encode the string "<user name>:<password>" using Base64. The request header text is "Authorization: Basic <encoded user:password>".

In the header of each request after authentication, your application passes the cookies returned by the authenticate resource.

When your application has completed its work, call logout to release the log-on and session.

For versions earlier than 2020: The tokens time out according to the System Administration settings from OpenText Application Quality Management, by default after one hour of inactivity. The LW-SSO token is self-contained.

AuthenticateClient (POST)

This request extends the OpenText Enterprise Performance Engineering REST API by providing a secure authentication mechanism to run automation tests for users with LDAP and SSO authentication types, and for external applications to access OpenText Enterprise Performance Engineering's API.

The OpenText Enterprise Performance Engineering site administrator configures a unique pair of ClientIdKey and ClientSecretKey keys for a specific user, which enables that user to login using a REST API. For details, see Set up API access in the Help Center.

In the header of each request after authentication, your application passes the cookies returned by the AuthenticateClient resource.

HTTP method

  • GET: Returns the LW-SSO cookie (and QCSession cookie in versions earlier than 2020) when logging on using OpenText Enterprise Performance Engineering's internal (Application) authentication.

  • POST: Returns the LW-SSO cookie when logging on from an external application (available in versions 2021 R1 and later).

Request

Headers:

  • GET: Authorization: Basic <encoded user:password>

  • POST: For external applications, one of:

    • Content-Type: application/xml

    • Content-Type: application/json

Cookies:

None

Request body:

  • GET: None

  • POST: An XML or JSON describing the API access key pair (ClientIdKey, ClientSecretKey) generated by the OpenText Enterprise Performance Engineering site administrator.

The request contains the following fields.

Element Description
ClientIdKey The client ID string for communicating with OpenText Enterprise Performance Engineering.
ClientSecretKeyThe secret key for communicating with OpenText Enterprise Performance Engineering.

Request examples:

Copy code
XML example - GET:
GET /Admin/rest/authentication-point/authenticate
Authorization: Basic c2E6
Copy code

XML example - POST:

POST http://my-server:8080/Admin/rest/authentication-point/AuthenticateClient?tenant=fa128c06-5436-413d-9cfa-9f04bb738df3
Content-Type: application/xml

<AuthenticationClient>
  <ClientIdKey>   
      I_KEY_da6cf229-cd61-46b8-9937-78bcac567155
  </ClientIdKey>
  <ClientSecretKey>
      S_KEY_e6b64fd9-29d0-4641-8ceb-36c154e5cd19
  </ClientSecretKey>
</AuthenticationClient>
Copy code
JSON example - POST:
POST http://my-server:8080/Admin/rest/authentication-point/AuthenticateClient?tenant=fa128c06-5436-413d-9cfa-9f04bb738df3Content-Type: application/json
{    "ClientIdKey": " I_KEY_da6cf229-cd61-46b8-9937-78bcac567155",    "ClientSecretKey": " S_KEY_e6b64fd9-29d0-4641-8ceb-36c154e5cd19"}

Response

Headers:

None

Cookies:

VersionCookie
2023, 24.1, and later

ADM_LWSSO={ADM_LWSSO_COOKIE_VALUE};

2022 - 2022 R2

ADM_LWSSO={ADM_LWSSO_COOKIE_VALUE};

ASP.NET_SessionId_Adm={ASP.NET_SessionId_Adm_COOKIE_VALUE};

LWSSO_COOKIE_KEY={LWSSO_COOKIE_KEY_COOKIE_VALUE};

2021 - 2021 R2

ADM_LWSSO={ADM_LWSSO_COOKIE_VALUE};

ASP.NET_SessionId_Adm={ASP.NET_SessionId_Adm_COOKIE_VALUE};

2020 - 2020 SP3

ADM_LWSSO={ADM_LWSSO_COOKIE_VALUE};

Earlier than 2020

LWSSO_COOKIE_KEY={LWSSO_COOKIE_KEY_COOKIE_VALUE};

QCSession={QC_SESSION_COOKIE_VALUE};

HTML return code:

One of the HTTP return codes

Upon successful authentication, returns HTTP status 200 (OK).

If a user is required to change their password, the system returns HTTP status code 202 along with the message: "You must change your password before accessing the application". When this response is returned during login, the user is only allowed to access the UpdatePassword API to complete the password change process. For details, see Change a user's password.

HTML body:

None

See also: