0

I'm building a library type module for DNN that will house a Web API service that is meant to be called by a separate application. It has one controller that inherits from DnnApiController. I'd like the requests in this service to use basic auth, since the other app has no association with DNN and its users won't be interacting with the portal. All it can do is pass in a username and password (this will happen over SSL). We are running DNN 7.3 which is configured to use standard Forms authentication.

Is it possible to configure just this service to use basic auth? If so, what attributes/configuration would I need to make it work?

Chris Tybur
  • 1,612
  • 2
  • 23
  • 38

1 Answers1

3

I think you can do this with the DNNAuthorize attribute. First, I would add a role into DNN, example "ExternalApp". Then create a DNN user that has that role.

Make your web service code look like this: 

public class MyAPIController : DnnApiController
{
    [HttpGet]
    [DnnAuthorize(StaticRoles="ExternalApp")]
    public string Ping()
    {
        return "MyAPI Version 01.00.00";
    }
}

Then in your external application (let's assume it is written in C#), you can do something like this:

string scheme = "https://";
string domainAlias = "www.website.com";
string modulePath = "myapimodule";
string controllerName = "myapi";
string apimethod = "ping";

Uri serviceUri = new Uri(string.Format("{0}{1}/DesktopModules/{2}/API/{3}/{4}", scheme, domainAlias, modulePath, controllerName, apimethod));
HttpWebRequest httpReq = (HttpWebRequest)HttpWebRequest.Create(serviceUri);
httpReq.Credentials = new NetworkCredential("externalappUser", "password123");
httpReq.Method = "GET";
httpReq.Accept = "application/text";

httpReq.BeginGetResponse(HttpWebRequestCallBack, httpReq);
Fix It Scotty
  • 2,852
  • 11
  • 12
  • 1
    That worked. I think my initial problem was I kept trying to use a host-level account for the authentication, but they are fundamentally different enough that it was causing exceptions somewhere in the DNN core. Using a regular user with a given role worked fine. – Chris Tybur Dec 08 '15 at 01:00