When setting or getting data with the API, the call must be authenticated with user name and password.
The only exception on this are the information flows from the framework, and the flows that are anonymously accessible.
User name and password
To check if the right user name and password are provided, the Authenticate flow must be provided.
TOnAuthenticationEvent = reference to function(const UserName, Password: string; const UserRoles: TList<string>; const SessionData: TDictionary<string, string>): Boolean; |
Inlcude in uses: System.Generics.Collections
This is a property that can be set on the API.
var APIServer := TCodolexAPIProjectApiServer.create; APIServer.OnAuthentication(AuthenticateUser); |
assuming the AuthenticateUser flow is a function of the given type.
In this function, the given user name and password are given as parameters, In the flow, you can check against a specific value or database if the data is valid.
Set the result value to True when the data is valid. otherwise the response will always be 403 - Unauthorized
Roles
In addition to username and password, you can also limit access to flows trough roles.
These roles must be configured in the project
In the flow properties, you can set 1 or more of these project roles.
When using the Authenticate flow, add roles to the UserRoles list to specify the roles that belong the user with the given user name and password.
If one Role is present in this list and in the defined roles for a flow. the user is able to call te flow through the api.
Example
The following code is an example of how the authentication function can be defined.
function TForm1.AuthenticateUser(const UserName, Password: string; const UserRoles: TList<string>; const SessionData: TDictionary<string, string>): Boolean; begin Result := False;
if (username = 'test') and (password = 'test') then begin UserRoles.Add('Test'); Result := True; end;
if (username = 'admin') and (password = 'admin') then begin UserRoles.Add('Test'); UserRoles.Add('Admin'); Result := True; end; end; |
Note that harcoded users are used for example purposes. This is not our recommendation for a exposed API.
