REST Adapter authentication

This page describes how to authenticate REST requests initiated by the REST Adapter to a REST API service.

Available from: Liberator 8.0.0

Requires: OpenJDK 17, Caplin StreamLink 8.0.0, Caplin Deployment Framework 8.0.0

The REST Adapter will use any valid Authorization header provided in the RTTP request to authorise the request with the REST service. If more than one Authorization header is provided in the RTTP request, the last of these is used. A StreamLink client can provide this header together with any other HTTP headers.

Authorization header provided in StreamLink method (token authentication)
streamLink.snapshot("/NEWS/123456", subscriptionListener, {
  headers:[
      {header:"Authorization",value:"Bearer <token>"},
      {header:"other-header-name",value:"other-header-value"}
  ]
});

Configured Authorization Header

When no valid Authorization header is provided in an RTTP request, the REST Adapter can fall back on an Authorization http-header in the REST endpoint’s configuration. If more than one Authorization http-header is configured, the last of these is used in the request.

Configured Authorization http-header
add-rest-mapping
   …
   http-header        Authorization  "http-auth-scheme api-credentials-or-token"
end-rest-mapping

Configured Basic HTTP Authorization

When no valid Authorization header is provided in an RTTP request or configured on the REST endpoint’s configuration, the REST Adapter can fall back on Basic Authorization using credentials in the REST endpoint’s configuration. The credentials provided in the auth-username and auth-password options will be used to attempt authorisation with the REST service using the "Basic" HTTP authentication scheme.

Configured Basic HTTP authentication
add-rest-mapping
   …
   auth-username      username
   auth-password      password
end-rest-mapping

No Authorization

Should the REST Adapter fail to locate a valid Authorization header in the request or configuration or configured credentials, it will attempt to make a request to the REST service with no authentication information.

See also: