Question

我正在尝试在MarkLogic中开发一些自定义rest api，并希望使用postman（chrome plugin）REST Client进行一些测试。

我已设置邮递员对MarkLogic的现有REST端点进行GET调用。似乎从Postman运行时我无法让digest auth工作......？

以卷曲形式导出的邮差：

curl -X GET -H "Authorization: Digest username="admin", realm="", nonce="", uri="/users", response="71ecc7a954d031fa5eb02a45f258f37d", opaque=""" -H "Cache-Control: no-cache" -H "Postman-Token: 745c4f5f-34d5-075c-6011-ef54e88588fd" 'http://cluey-app-ml1:8050/users'

如果我直接从终端执行相同的curl命令，但没有邮递员特定的东西，那就有效：

curl -v --digest --user admin:admin -X GET -H 'Content-Type: application/json' 'http://cluey-app-ml1:8050/users'
* Hostname was NOT found in DNS cache
*   Trying 192.168.178.113...
* Connected to cluey-app-ml1 (192.168.178.113) port 8050 (#0)
* Server auth using Digest with user 'admin'
> GET /users HTTP/1.1
> User-Agent: curl/7.35.0
> Host: cluey-app-ml1:8050
> Accept: */*
> Content-Type: application/json
> 
< HTTP/1.1 401 Unauthorized
* Server MarkLogic is not blacklisted
< Server: MarkLogic
< WWW-Authenticate: Digest realm="public", qop="auth", nonce="c2e2f63fa5f8674884388a22f6dc6bec", opaque="8ed963a93f01cd6d"
< Content-Type: text/html; charset=utf-8
< Content-Length: 209
< Connection: Keep-Alive
< Keep-Alive: timeout=5
< 
* Ignoring the response-body
* Connection #0 to host cluey-app-ml1 left intact
* Issue another request to this URL: 'http://cluey-app-ml1:8050/users'
* Found bundle for host cluey-app-ml1: 0x1ee5990
* Re-using existing connection! (#0) with host cluey-app-ml1
* Connected to cluey-app-ml1 (192.168.178.113) port 8050 (#0)
* Server auth using Digest with user 'admin'
> GET /users HTTP/1.1
> Authorization: Digest username="admin", realm="public", nonce="c2e2f63fa5f8674884388a22f6dc6bec", uri="/users", cnonce="OWZkYzE5OTI2OWJmYmVjZDAwMGI5ZWUzMDAwMTcxNTg=", nc=00000001, qop=auth, response="d88c8094402c2b2225eb11ba0d0ece88", opaque="8ed963a93f01cd6d"
> User-Agent: curl/7.35.0
> Host: cluey-app-ml1:8050
> Accept: */*
> Content-Type: application/json
> 
< HTTP/1.1 200 OK
* Server MarkLogic is not blacklisted
< Server: MarkLogic
< Content-Type: application/json; charset=UTF-8
< Content-Length: 512
< Connection: Keep-Alive
< Keep-Alive: timeout=5
< 
* Connection #0 to host cluey-app-ml1 left intact
[{"user":{"id":"952187958352252312", "name":"hugo5", "description":"sccss generated user"}}, {"user":{"id":"1585487239190988150", "name":"jimmy", "description":""}}, {"user":{"id":"7026453114226409808", "name":"joe", "description":""}}, {"user":{"id":"952187958274822997", "name":"hugo4", "description":"sccss generated user"}}, {"user":{"id":"952187958197393682", "name":"hugo3", "description":"sccss generated user"}}, {"user":{"id":"952187958119964367", "name":"hugo2", "description":"sccss generated user"}}]

更新[2] 从终端看起来很奇怪，似乎卷曲首先也失败了401但是再次尝试然后成功???

所以摘要在终端上有效，现在我需要找到邮递员的确切设置以便匹配......当邮递员选择digest auth时，我会得到很多选择......

Connection       Keep-Alive
Content-Length   209
Content-Type     text/html; charset=utf-8
Keep-Alive       timeout=5
Server           MarkLogic
WWW-Authenticate Digest realm="public", qop="auth", nonce="c33989a614d57699abb0d0bf6d6ca56d", opaque="8b7438e3f6432e3e"

问题： 1）任何人都可以确认他们已成功使用Postman对抗Marklogic 8 app服务器运行摘要认证并成功吗？ 2）有人能指出我在Postman中设置正确的参数，以便成功调用MarkLogic吗？

雨果

Answer 1

默认情况下，MarkLogic HTTP应用服务器上未启用基本身份验证。将其从digest切换为digestbasic或basic。

HTH！

Answer 2

除了Geert的回复，您可能会发现此article来自Gary Russo。第7节甚至展示了如果你想要应用程序级别的安全性，如何使用标题值。

digest auth使用运行digestbasic应用服务器的marklogic上的邮递员失败

2 个答案: