mORMot Open Source

DavidRM

Member

Registered: 2016-12-19

Posts: 29

Registering New User via REST

Is there an example of how this would be implemented?

From reading the SAD (that's the long AF web page of documentation, right?) and searching the forums, I'm not seeing a way to register a new user via REST. Or, for that matter, any of the other connection methods. Did I just miss it? For web-based products, this would seem a common requirement.

The idea is that a new user would register (created by the server with "user" privileges). For all other REST access, normal user+password authentication would be used. So the REST API has only one gaping security hole in it. (Which gaping hole is a good argument for only allowing the server to create new users...)

I've ordered Erick Engelke's new book, but it won't get here until next week, and I have no idea if it covers this. And I'm impatient. So I'm asking here.

Thanks!

-David

Last edited by DavidRM (2016-12-22 21:01:14)

erick

Member

Registered: 2015-09-09

Posts: 155

Re: Registering New User via REST

Is there an example of how this would be implemented?

>I've ordered Erick Engelke's new book, but it won't get here until next week, and I have no idea if it covers >this. And I'm impatient. So I'm asking here.

Hi David,

Since you've ordered the book, you'll be happy to know it comes with source code that auto-adds people.  In my implementation I first check that they pass an active directory or NT-styled password challenge, but you can change the code to support whatever addition requirements you desire.  I wrote it to support EWB clients in a company, but it works just fine for Delphi clients too.

If I remember correctly, you authenticate with a pseudo-guest account to gain access, then you send whatever credentials to the server using the guest account.  It processes the request and auto-adds a userid. Then you log in with that userid and you are all set to do anything. 

Merry Christmas,

Erick

DavidRM

Member

Registered: 2016-12-19

Posts: 29

Re: Registering New User via REST

Thanks, erick! I'll look for that in the book post-Xmas.

-David