Forum Discussion

PerBonomi's avatar
PerBonomi
Boss
7 years ago

Send PM from different user - problem

Hi everyone.

I created a new non-sso user

Using these instructions I generated a session key for that user

Created a test endpoint with this code:

<#assign session_key = rest("/authentication/sessions/login?user.login=<new user login>&user.password=<new user password>").value/>
<#assign result_send = restadmin("/postoffice/notes/send?notes.recipient=/users/id/<my id>&notes.subject=test&notes.note=test&restapi.session_key=<freshly generated session key>")/>

I then opened that endpoint in an incognito window

The PM I received was from "anonymous", not from the new user.

 

What am I doing wrong?

  • VikasB's avatar
    VikasB
    Boss
    7 years ago

    PerBonomi 
    Nice feature. It should be there in lithium. 
    But as of now, you can not send a message to anyone by someone else user id until that user is logged in.

    API to send the notes does not support the session key parameter. So you will get PM from an anonymous user when no one is logged in manually(Not API authentication) when API hits to send a PM. 

  • TariqHussain's avatar
    TariqHussain
    Boss
    7 years ago

    PerBonomi -

    There is no bug in your endpoint code. This is a lithium bug if you will try this call via postman, it will work without any issue.  However inside an endpoint user from is always returned as Anonymous. 

    Below is the response I have got using postman.

     

     

     

     

    • luk's avatar
      luk
      Boss
      7 years ago
      interesting! thanks for the hint
      • PerBonomi's avatar
        PerBonomi
        Boss
        7 years ago

        Changed the code in my endpoint to test different scenarios:

        1:

        <#assign session_key = restadmin("/authentication/sessions/login?user.login=<user>&user.password=<pw>").value/>
<#assign result_send = rest("/boards/id/001/messages/post/?restapi.session_key=${session_key}&message.author=/users/login/sys-admin&message.subject=test&message.body=test")/>

        2:

        <#assign session_key = restadmin("/authentication/sessions/login?user.login=sys-admin&user.password=LittlePinkPig").value/>
<#assign result_send = rest("/boards/id/001/messages/post/?restapi.session_key=${session_key}&message.subject=test&message.body=test")/>

        Open the endpoint without logging in any user:

        1. Error 403

        2. Error 403

         

        Open the endpoint logged in on an admin account:

        1. gets posted as regular user

        2. gets posted as by the admin account

         

        Open the endpoint logged in as regular user, they both error out with a 500

  • PerBonomi's avatar
    PerBonomi
    Boss
    7 years ago

    I also tried with just rest, vs restadmin.

    That simply gives me a 403.

     

    Lithium Support says I'm doing it wrong. I should generate the session key, then use that to authenticate this other user, and then try to send the PM? So I'm missing a step between 1 and 2?