Admin User Authentication

Content

• Overview
• Admin Session Cookie
• APIs
• Revision History

Overview

ULM includes a dedicated Admin API to authenticate users who perform administrative actions on ULM.

Similar to Standard User Authentication, the Admin scenario follows a straightforward flow:

1. The user supplies their username and password to the ULM Admin UI.
2. The UI supplies this information to the POST /admin/session API call.
3. The API validates the user's credentials and creates (or opens) an Admin User session.
4. The system places a JESSIONID token into the Admin user's browser where it is stored as a cookie.

Although Admin Users provide a username and password just like normal user authentication, Admin Users are not regular ULM users. A valid ULM User ID and password will fail authentication to the administrative endpoint, and vice versa.

Admin Session Cookie

JSESSIONIDs are generally short-lived (between minutes and hours) and do not persist between browser windows, devices, or other session demarcation points. If an administrative user's session expires, that user is required to authenticate again. Access to any protected REST API requires, at a bare minimum, a valid JSESSIONID token.

Unlike standard ULM User authentication, no remember-me tokens are issued for an Admin session.

APIs

Request

POST http://~your.url/rest/{version}/admin/session

{
   "username":"MY_USERNAME",
   "credential":"MY_PASSWORD"
}

Details for the currently authenticated administrative user can be obtained via the GET /admin/session API. If an administrative user wishes to end their session, the POST /session/end API (with no payload) must be called. This invalidates the current session and logs the admin user out.

The end user can close their session with the POST /session/end API (with no payload). This invalidates both the current session (identified by the JSESSIONID cookie) and any issued remember-me tokens. will not invalidate any other sessions the end user may have.

Note: If you have the proper authorization, you can call ULM Admin APIs directly. Alternatively, you should leverage the MarketONE ULM Admin web application to perform administrative functions with regards to your ULM Cloud service.

See the MarketONE User Admin UI User Guide for more information on the ULM Admin web application.

See the ULM Admin APIs in the MarketONE Developer Portal for the full spec of ULM Admin APIs.

Revision History