CODEWITHSUNDEEP
javascriptajaxrestauthenticationmoqui
Suneet Jain
Suneet Jain

Reputation: 256

Moqui AJAX call issue

There is an issue with the Rest call to Moqui running locally... Below is the sample html code and the error is "REST Access Forbidden (no authz): User null is not authorized for View on REST Path /moqui/users". And on the web console the error is 403 (Forbidden).

<!DOCTYPE html>
<html>
<head>
<meta charset="UTF-8">
<title>AJAX Test</title>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.1.0/jquery.min.js"></script>
</head>

<body>

<script>

$(document).ready(function() {
$.ajax({
type: "GET",
url: "http://localhost:8080/rest/s1/moqui/users",
headers: {  

            Accept: "application/json",
            Authorization : "Basic am9obi5kb2U6bW9xdWk="
        },

    contentType: "application/json"
    }).then(function(data) {
    console.log(data);
});
});

</script>
</body>
</html>

Api call works fine when tried with a Chrome Rest Client, but not with AJAX call

Upvotes: 0

Views: 197

Answers (1)

David E. Jones
David E. Jones

Reputation: 1776

All artifact operations (for entities, services, screens, REST API, etc) require authorization in Moqui. There are ways to configure this in bulk (ie inherited authz) but authorization is always checked for every operation.

Here is some example XML for authorization to the entire mantle REST API for all users in the ADMIN group. This can also be done in the System application which has screens for users, user groups, authz, etc.

<!-- Artifact group for all of the Mantle REST API via the mantle resource (the root resource) -->
<artifactGroups artifactGroupId="MANTLE_API" description="Mantle REST API (via root resource)">
    <artifacts artifactTypeEnumId="AT_REST_PATH" artifactName="/mantle" inheritAuthz="Y"/>
    <authz artifactAuthzId="MANTLE_API_ADMIN" userGroupId="ADMIN" authzTypeEnumId="AUTHZT_ALWAYS" authzActionEnumId="AUTHZA_ALL"/>
</artifactGroups>

There is more general documentation on the Artifact Authorization functionality in the Making Apps with Moqui book (you can download the PDF on moqui.org). Even though the REST API functionality is more recent than the book and so not yet covered in it, the same pattern as for screen authorization applies to the REST API.

Upvotes: 1

Related Questions