Uploaded image for project: 'OpenAM'
  1. OpenAM
  2. OPENAM-9998

Cache-control response header not set for failed authentication by json/authenticate

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 14.0.0
    • Fix Version/s: 14.0.0
    • Component/s: rest
    • Environment:
      Mac OS X

      java version "1.7.0_76"
      Java(TM) SE Runtime Environment (build 1.7.0_76-b13)
      Java HotSpot(TM) 64-Bit Server VM (build 24.76-b04, mixed mode)

      Apache Tomcat 7.0.72

      OpenAM 11.0.3
    • Target Version/s:
    • Rank:
      1|hzshs7:

      Description

      Use OpenDJ for auth and configure LDAP auth-module to be used as the required module of the realm's auth chain

      Perform json/authenticate Zero page login https://backstage.forgerock.com/docs/openam/11.0.0/dev-guide/chap-rest#rest-api-auth-json

      curl --request POST
       --header "X-OpenAM-Username: demo" --header "X-OpenAM-Password: wrongpwd"
       --header "Content-Type: application/json" --data "{}"
       https://openam.example.com:8443/openam/json/authenticate
      

      OpenAM responds with

      headers
      HTTP/1.1 401 Unauthorised
      ...
      Content-Type: application/json
      Transfer-Encoding: chunked
      
      body
      { "errorMessage": "Invalid Password!!" }
      

      whereas for successful authentication json/authenticate responds with

      headers
      HTTP/1.1 200 OK
      ...
      Cache-Control: no-cache
      Content-Type: application/json;charset=UTF-8
      Transfer-Encoding: chunked
      
      body
      { "tokenId": "AQIC5...", "successUrl": "/customerSSO/console" }
      

        Attachments

          Activity

            People

            Assignee:
            jonathan Jonathan Scudder
            Reporter:
            bthalmayr Bernhard Thalmayr
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Dates

              Created:
              Updated:
              Resolved: