4

I am using alfresco default web script to get a ticket for a user but i am not sure till when this obtained ticket is valid.

Also i am extracting ticket is from obtained XML response of alfresco default login web script.

Does a ticket has any expiry date or once a ticket is obtained, it will not expire till session expiry?

j08691
  • 204,283
  • 31
  • 260
  • 272
Finn
  • 912
  • 1
  • 16
  • 53

2 Answers2

13

The following property set on the Alfresco repository, along with its default value, configures the ticket life span to be one hour:

authentication.ticket.validDuration=P1H

You can override such property in the usual way. Meaningful values are described in the Duration class:

 * The lexical representation of duration is
 * PnYnMnDTnHnMnS.
 * 
 * P is a literal value that starts the expression
 * nY is an integer number of years followed by the literal Y
 * nM is an integer number of months followed by the literal M
 * nD is an integer number of days followed by the literal D
 * T is the literal that separates the date and time
 * nH is an integer number of hours followed by a literal H
 * nM is an integer number of minutes followed by a literal M
 * nS is a decimal number of seconds followed by a literal S

Please note that by default successful usages of a ticket will renew its validity, meaning that given a ticket validity of one hour, if you authenticate, say, a web script call using the ticket after 59m from its generation, its validity will be extended to another hour.

As the ticket lifecycle is completely configurable, have a look at the ticketComponent Spring bean defined in authentication-services-context.xml to see the available options (e.g. setting oneOff to true to only allow one single use of a given ticket).

Dark Star1
  • 6,986
  • 16
  • 73
  • 121
skuro
  • 13,414
  • 1
  • 48
  • 67
  • Thanks but i extracted a ticket from xml got using login web script, used it for web scripts & then server remains idle for more than 8 hours.When i came back & used the same ticket id,appended to web script url and it worked fine. This is my doubt that who controls this behavior as default is 1 hour?There must be some validation mechanism here. – Finn Sep 20 '11 at 03:39
5

The best way to handle alfresco authentication tickets is to handle it manually. E.g. for getting a ticket, use OOTB web script.

http://localhost:8080/alfresco/service/api/login?u=admin&pw=admin

which return ticket such as TICKET_29ced6613a114294fa4bb9e67bf663112076f3d9 (needs to be extracted).

Now when using this ticket for any kind of operation, try to verify ticket validity using OOTB alfresco web script.Note that this is a HTTP GET method based web script

GET /alfresco/service/api/login/ticket/{ticket}

http://localhost:8080/alfresco/service/api/login/ticket/TICKET_29ced6613a114294fa4bb9e67bf663112076f3d9?alf_ticket=TICKET_29ced6613a114294fa4bb9e67b663112076f3d9

Thing to note here is that you need to authenticate this web script also by appending ?alf_ticket={ALFRESCO_TICKET} without which it will not work.

Finally when you are done with your things, always log out using OOTB alfresco logout web script. Note that this is a HTTP DELETE method based web script

DELETE /alfresco/service/api/login/ticket/{ticket}).

http://localhost:8080/alfresco/service/api/login/ticket/TICKET_29ced6613a114294fa4bb9e67bf663112076f3d9?alf_ticket=TICKET_29ced6613a114294fa4bb9e67bf663112076f3d9

Again you need to authenticate this web script also by appending ?alf_ticket={ALFRESCO_TICKET} without which it will not work.

This way you can ensure proper authentication as well as system will not be overburdened with stale tickets.

P.S. http://wiki.alfresco.com/wiki/Repository_RESTful_API_Reference#Logout

Finn
  • 912
  • 1
  • 16
  • 53
  • Is there a way to force new tickets for each user's request? We want to invoke a queue mechanism but in our testing, we find that multiple ticket requests return the same ticket. – TheNorthWes May 11 '15 at 21:50
  • add following setting to alfresco-global.properties file authentication.ticket.useSingleTicketPerUser=false – tarn May 27 '21 at 05:32