Invalid login with rest functionality user

Question

Hi all.
Following the "Web Services and Integration Framework Guide" for ATG 10.0.1 part III, I create an internal user "intRestUser" with BCC giving him the same roles of "admin".
After, io defined under my localconfig atg publishing server /atg/rest/security/restSecurityConfiguration.xml
<rest-security>
<default-acl value="Profile$login$intRestUser:read,write,execute"/>
</rest-security>After, I started JBoss server, switched the /atg/rest/processor/RestSecurityProcessor allowAccessForUnsecuredRepository to true and tried the following things
1) a snippet of JavaCode
public class TestRestCalls {
     public static void main(String[] args) {
          RestSession session = RestSession.createSession(myIpaddress, myPort, "intRestUser", "pwdRestUser");
          if (login(session)){
               try {
                    RestResult result = RestRepositoryHelper.getItem("/atg/commerce/catalog/ProductCatalog", "product","6137329", null, session);
               } catch (RestClientException e) {
                    e.printStackTrace();
     private static boolean login(RestSession session){
          boolean result = false;
          session.setUseHttpsForLogin(false);
          session.setUseInternalProfileForLogin(true);
          try {
               String loginStatus = session.login();
               if(loginStatus == null || "null".equals(loginStatus)) {
                    session = null;
                    System.err.println("Login Failed");
               }else {
                    result = true;
                    System.out.println("Login Successful");
          catch (Throwable t) {
               System.err.println("Exception: "+t.getMessage());
          return result;
}It goes into exception at session.login() with this message:
java.io.IOException: Forbidden Server returned HTTP response code: 403 for URL: http://myIpaddress:myPort/rest/bean/atg/userprofiling/InternalProfileFormHandler/login
2) Invoking url by browser
http://myIpaddress:myport/rest/bean/atg/userprofiling/InternalProfileFormHandler/login?value.login=intRestUser&value.password=pwdRestUser&atg-rest-return-form-handler-exceptions=true
In this case I've in Jboss console
ERROR [nucleusNamespace.atg.userprofiling.PreviewProfileRequestProcessor] (http-0.0.0.0-8280-5) An attempt was made to preview a project without logging in as
a user with access to publishing assets. The Preview feature does not support remote preview on servers running the BCC. If you received this error and did not try
to perform a remote preview, then you may need to disable preview in the current webapp by setting the atg.preview context parameter to false in the webapp's
web.xml file.3) I login with my intRestUser into BCC Home and after re-try step 2)
In this case in console I've an exception
ERROR [nucleusNamespace.atg.dynamo.servlet.dafpipeline.RestSecurityServlet] (http-0.0.0.0-8280-5) Error code: 401
Access to the requested resource is not allowed: /atg/userprofiling/InternalProfileFormHandler
atg.rest.RestException: Access to the requested resource is not allowed: /atg/userprofiling/InternalProfileFormHandler
        at atg.rest.processor.RestSecurityProcessor.checkAccess(RestSecurityProcessor.java:524)
        at atg.rest.processor.RestSecurityProcessor.handleGetRequest(RestSecurityProcessor.java:287)
        at atg.rest.processor.RestSecurityProcessor.doRESTGet(RestSecurityProcessor.java:175)
        at atg.rest.servlet.RestPipelineServlet.serviceRESTRequest(RestPipelineServlet.java:395)
        at atg.rest.servlet.RestPipelineServlet.service(RestPipelineServlet.java:238)
        at atg.servlet.pipeline.PipelineableServletImpl.passRequest(PipelineableServletImpl.java:135)
        at atg.servlet.pipeline.PipelineableServletImpl.service(PipelineableServletImpl.java:298)
        at atg.rest.servlet.RestPipelineServlet.service(RestPipelineServlet.java:242)
        at atg.rest.servlet.HeadRestServlet.service(HeadRestServlet.java:107)
        at atg.servlet.pipeline.PipelineableServletImpl.service(PipelineableServletImpl.java:245)
        at atg.rest.servlet.RestProxyServlet.service(RestProxyServlet.java:118)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:29
...4) Finally I login with my intRestUser into BCC Home and after I call a rest service url directly as for example
http://myIpAddress:myport/rest/repository/atg/commerce/catalog/ProductCatalog/product/6137329
In this case it works.
So, the BCC login bypass the direct authentication by InternalProfileFormHandler but only using the same browser session.
So, the question is: why the java code or url code authentication don't work?
Thanks in advance
Marco
Edited by: user10853406 on 27-ott-2011 12.42
Edited by: user10853406 on 28-ott-2011 5.49
simplified restSecurityConfiguration.xml

Answer 1

I'm also experiencing the same issue. Seems like the problem is related with the Preview functionality. If I remove preview, the error goes away.
Anyone knows a way to have this working with preview enabled?