Making a REST webservice call. Error code: 401 Access to the requested resource is not allowed

Question

Hi All,
I’m having a hard time figuring out how to make Rest WebService calls.
I tried executing this directly through browser and I get an error.
http:localhost:8080/rest/bean/atg/userprofiling/ProfileServices/loginUser?arg1=[email protected]&arg2=Password
13:18:20,613 ERROR [RestSecurityServlet] Error code: 401
Access to the requested resource is not allowed: /atg/userprofiling/ProfileServices
atg.rest.RestException: Access to the requested resource is not allowed: /atg/userprofiling/ProfileServices
at atg.rest.processor.RestSecurityProcessor.checkAccess(RestSecurityProcessor.java:546)
at atg.rest.processor.RestSecurityProcessor.handleGetRequest(RestSecurityProcessor.java:313)
at atg.rest.processor.RestSecurityProcessor.doRESTGet(RestSecurityProcessor.java:199)
at atg.rest.servlet.RestPipelineServlet.serviceRESTRequest(RestPipelineServlet.java:417)
at atg.rest.servlet.RestPipelineServlet.service(RestPipelineServlet.java:260)
at atg.servlet.pipeline.PipelineableServletImpl.passRequest(PipelineableServletImpl.java:157)
at atg.servlet.pipeline.PipelineableServletImpl.service(PipelineableServletImpl.java:320)
at atg.rest.servlet.RestPipelineServlet.service(RestPipelineServlet.java:264)
at atg.rest.servlet.HeadRestServlet.service(HeadRestServlet.java:130)
at atg.servlet.pipeline.PipelineableServletImpl.service(PipelineableServletImpl.java:267)
From the documentation I understand that I need to create a session, is the session only necessary to access secured components since this
particular method “ProfileServices.loginUser “ has been declared as not secure in restSecurityConfiguration.xml
Also, are there two different ways in which I can log in
1.       Using RestSession.createSession providing the username and password.
2.       Or using ProfileServices.loginUser or ProfileFormHandler
  Can someone please clarify

Answer 1

If you are invoking the REST web-service from a Java client then you can create a RestSession object using the createSession method. But in your case you seem to be invoking it with a HTTP request which by default would be treated as a GET request by ATG's REST implementation. Therefore being a GET, it would try to fetch a property "loginUser" from /atg/userprofiling/ProfileServices component (based on your URL) which would always fail.
To invoke loginUser() method of ProfileServices with your passed argument you need to tell ATG's REST system to treat your incoming request not as GET but as a POST request which you can do using  atg-rest-http-method control parameter in your request like this
http:localhost:8080/rest/bean/atg/userprofiling/ProfileServices/loginUser?arg1=[email protected]&arg2=Password&atg-rest-http-method=POST
It should work this way provided your restSecurityConfiguration.xml is proper.