API Authentication

The API of the ERP Core is a standardized set of API commands and endpoints present in all of its plug-ins.

Swagger

In order to test the API, Swagger can be used and found at this link:

http://<PlugInIP>:<PlugInPort>/swagger/index.html

In order to use Swagger, you need to provide a valid token. Request one as shown below, click on Authorize (top-right of Swagger page) and enter the token (without the “Bearer “) in the text box, then click Authorize.

After this process, you can make API calls to protected resources from Swagger.

Authentication

The system provides a separate Authentication server that is actually a plug-in that only handles authorization related requests, such as log-in and log-out. This server also has access to some other system resources but it is better to use it only for this purpose.

The server is identified by an IP and a PORT. The API endpoint format is as follows:

http://<AuthServerIP>:5010/api/Authentication/...

Most of the API endpoints require authentication. In order to call a protected API endpoint, you need to include the token in the HEADER of your call as follows:

HTTP Header Key	Content
Authentication	Bearer eyJhb … 4ZWc (truncated, please see below the full token)

The key is “Authentication”.

The content is the text “Bearer” plus a space then followed by the token provided by the server.

Log-In

http://<AuthServerIP>:5010/api/Authentication/LogIn

In order to obtain a valid JWT token, you need to make a POST request to the Authentication server.

{
"tenantName":"LaNuciGrup",
"password":"hash(Admin@LaNuciGrup.com)",
"userName":"Admin@LaNuciGrup",
"email":"Admin@LaNuciGrup.com"
}

This version of kernel doesn’t use any encryption for the password. Future releases will use encryption. Keep that in mind when implementing the authentication functionality.

If the credentials are valid, the server will respond with a JWT token that can be used for subsequent requests.

You only need to send either the userName or email in order to identify a user.

{
"tokenData":
{
"accessToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjU5MjI5OWU3LTQ1YzctNDhkZC05ZGRkLTZhZGFjYWJkYmZmOSIsImVtYWlsIjoiQWRtaW5ATGFOdWNpR3J1cC5jb20iLCJuYW1laWQiOiJBZG1pbkBMYU51Y2lHcnVwIiwicm9sZXMiOiJbXCJBZG1pbkBMYU51Y2lHcnVwXCJdIiwibmJmIjoxNjU1OTc0NTE2LCJleHAiOjE2NTY1NzkzMTYsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6NTA1MCIsImF1ZCI6IioifQ.x_TcVN7IEXUGgtMPPOMg3g7MwIxYQz5QeEHmTt54ZWc",
"expiresAt":"2022-06-30T11:55:16+03:00",
"refreshToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjU5MjI5OWU3LTQ1YzctNDhkZC05ZGRkLTZhZGFjYWJkYmZmOSIsImVtYWlsIjoiQWRtaW5ATGFOdWNpR3J1cC5jb20iLCJuYW1laWQiOiJBZG1pbkBMYU51Y2lHcnVwIiwibmJmIjoxNjU1OTc0NTE2LCJleHAiOjE2NTYwMDMzMTYsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6NTA1MCIsImF1ZCI6IioifQ.KcZMIonKSKsRrcrnXr_-HzeBAVEWXUSzyXh6MDffOzk",
"userId":"592299e7-45c7-48dd-9ddd-6adacabdbff9",
"twoFactor":false
},
"requestStartedAt":"2022-06-23T11:55:16.8584842+03:00",
"requestFinishedAt":"2022-06-23T11:55:16.8584842+03:00",
"requestTimespan":"00:00:00.2651406",
"messages":[],
"httpStatusCode":200
}

The authentication response will contain two tokens. An access token and a refresh token. The access token is used to access resources (API calls). The refresh token is used to acquire a new access token before its expiration in order to allow an uninterrupted user experience.

Please note that this communication is not encrypted, so the tokens can be stolen by an attacker. Implement your own SSL between the ERP infrastructure and the final user if the network is vulnerable to attacks.

Log-Out

http://<AuthServerIP>:5010/api/Authentication/LogOut

The access token can be invalidated if a log-out request is made to the authentication server. In order to log-out a user, the refresh token must be transmitted. This is required in order to avoid accidental or fraudulent log-outs.

{
"refreshToken":"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6IjU5MjI5OWU3LTQ1YzctNDhkZC05ZGRkLTZhZGFjYWJkYmZmOSIsImVtYWlsIjoiQWRtaW5ATGFOdWNpR3J1cC5jb20iLCJuYW1laWQiOiJBZG1pbkBMYU51Y2lHcnVwIiwibmJmIjoxNjU1OTc0NTE2LCJleHAiOjE2NTYwMDMzMTYsImlzcyI6Imh0dHA6Ly9sb2NhbGhvc3Q6NTA1MCIsImF1ZCI6IioifQ.KcZMIonKSKsRrcrnXr_-HzeBAVEWXUSzyXh6MDffOzk"
}

The server will respond with success or failure and a message:

{
"requestStartedAt":"2022-06-23T12:11:28.8669649+03:00",
"requestFinishedAt":"2022-06-23T12:11:28.8669649+03:00",
"requestTimespan":"00:00:00.1351662",
"messages":
[
{"messageText":"User Admin@LaNuciGrup logged out.",
"messageSeverityDescription":"Info",
"messageSeverityCode":0,
"logType":0,
"couldNotLog":false}
],
"httpStatusCode":200
}