Login Implementation with username password via Things Service for mobile application Thingworx

sushantpatekar — Sat, 25 Apr 2020 09:51:30 GMT

I am developing a mobile app that communicates with TWX via REST API. I have created MobileConnector_TH which having services that pull the data and revert it to mobile via HTTP Rest API.

Problem statement:-

I have one service written in MobileConnector_TH - validateUser(Username, Password)

Which contains the following code

var params = {

url: me.IPUrl+"/Thingworx/action-login?OrganizationName="+organization+"&thingworx-form-userid="+username+"&thingworx-form-password="+password+"&x-thingworx-session=true" /* STRING */,

contentType: "text/html" /* STRING */

};

// result: STRING

var result = Resources["ContentLoaderFunctions"].GetText(params);

This returns HTML webpage data into a string. I am unable to find any specific scenario to validate username&Password via Service. It showing the same result with the wrong password/username.

https://community.ptc.com/t5/ThingWorx-Developers/Authentication-with-User-Credentials-via-Rest-Api/td-p/585890

Re: Login Implementation with username password via Things Service for mobile application Thingworx

PEHOWE — Wed, 29 Apr 2020 18:32:17 GMT

@sushantpatekar , Not quite sure that I can address all of your questions. I have used a couple of different REST API calls to get information on the users in the system.

To get a list of the users defined in the system. For my testing I used POSTMAN. The first question I tried to answer was can I get a list of the users on the system. To do this requires that I have an AppKey, you only do not want to share information with just anyone.

Get Transaction
- URL: http://localhost/Thingworx/Users
- Header values
  - appkey : <key value with priv to see users>
  - Accept : text/xml
    - I used this because I thought something you can parse is better other values exist such as "text/csv", "text/html"...
- This returned a XML document which contained the list of user names.

Second question now that I know a user name can I get information about that user

Get Transaction
- url: http://localhost/Thingworx/Users/TestUserName
- Header values
  - appkey : <key value with priv to see users>
  - Accept : text/csv
This reply is a success (200). But not a lot of data. Take a look at the following URL to get an idea of what you can request. http://<youtThingWorx:<port>/Thingworx/Users/<known UserName>

In your post you are trying to make a REST API call and perform a login. Try the following.

POST transaction
- URL: localhost/Thingworx/action-login
- Header
  - Accept : text/csv
- Body x-www-form-urlencoded
  - thingworx-form-userid : <user name>
  - thingworx-form-password : <password>
In my testing with POSTMAN this returned a status of 200, and a session ID

Now an item to be considered this approach is sending a username and password as clear text between a device and a server. NOT good security

Let me know if this helps

Peter

topic Re: Login Implementation with username password via Things Service for mobile application Thingworx in ThingWorx Developers

Login Implementation with username password via Things Service for mobile application Thingworx

Re: Login Implementation with username password via Things Service for mobile application Thingworx