I don't see in your code the call to authenticate. I assume that you're previously calling /ServiceModel/AuthService.svc/Login somewhere to get the BPMCSRF value? See https://documenter.getpostman.com/view/10204500/SztHX5Qb#46f97170-d66d-…

Note, the BPMCSRF value doesn't last forever, so it does need to be a recently obtained value. 

This article shows the complete steps for executing requests via Postman which might help: https://academy.creatio.com/docs/8.x/dev/development-on-creatio-platfor…

Ryan

Ryan Farley,

Hi 

      Thanks for your reply . Below is my token generation code from where i have taken cookies value for my 2nd request .Before i have not attached that token generation part as these is working fine. In postman it's working fine using Cookies based authentication.In my Console application i am sending all the Cookies (BPMLOADER, .ASPXAUTH, BPMCSRF, and UserName) as a Header Key and value in further requests to Creatio services that use cookie-based authentication but it's showing Html Error ?

 static async Task<Dictionary<string, string>> TokenGenerateDictionary()

        {

            var headerCookies = new Dictionary<string, string>();                 

                using (var client = new HttpClient())

                {

                    client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));

                    using (var request = new HttpRequestMessage(HttpMethod.Post, @"https://steuler.creatio.com/ServiceModel/AuthService.svc/Login"))

                    {

                        request.Content = new StringContent($"{{\"UserName\":\"ram\",\"UserPassword\":\"abcd\"}}", Encoding.UTF8, "application/json");

                        var response = client.SendAsync(request).Result;

                        var responseString = await response.Content.ReadAsStringAsync();

                        JObject responseJson = JObject.Parse(responseString);

                        int code = (int)responseJson["Code"];

                        if (code == 0 && response.IsSuccessStatusCode)

                        {

                            foreach (string setCookieHeader in response.Headers.GetValues("set-cookie"))

                            {

                                 string[] cookies = setCookieHeader.Split(';');

                                if (cookies.Length > 0)

                                {

                                    string[] keyValue = cookies[0].Trim().Split('=');

                                    if (keyValue.Length == 2)

                                    {

                                        string key = keyValue[0];

                                        string value = keyValue[1];

                                        if (!headerCookies.Keys.Contains(key))

                                            headerCookies.Add(key, value);

                                    }

                                }

                            }

                         }

                    }

                }

            return headerCookies;

        }

Request Get Operation send cookies in Header Key :

         var tokenHeaderCookiesData = TokenGenerateDictionary().ConfigureAwait(false).GetAwaiter().GetResult(); 

         string requestUri = @"https://steuler.creatio.com/0/odata/Product?$top=1";

         using (HttpClient httpClient = new HttpClient())

                {

                    HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, requestUri);

                    foreach (string key in tokenHeaderCookiesData.Keys)

                    {

                        //BPMLOADER, .ASPXAUTH, BPMCSRF, and UserName

                        if (key== "BPMLOADER" || key == ".ASPXAUTH" || key == "BPMCSRF" || key == "UserName")

                           request.Headers.Add(key, tokenHeaderCookiesData[key]);

                    }

                    HttpResponseMessage response =  httpClient.SendAsync(request).ConfigureAwait(false).GetAwaiter().GetResult();

                    string responseData =  response.Content.ReadAsStringAsync().ConfigureAwait(false).GetAwaiter().GetResult();

                }

   

Html Error Response with status OK:

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" culture="en-US">

<head><meta http-equiv="X-UA-Compatible" content="IE=Edge" /><meta name="fontiran.com:license" content="LAXSN" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><title>

    Creatio

</title>

    <style>

        .font-preload {

            position: absolute;

            opacity: 0;

        }

        .font-preload-open-sans {

            font-family: "Bpmonline Open Sans";

        }

        .font-preload-open-sans-light {

            font-family: "Bpmonline Open Sans Light";

        }

        .font-preload-open-sans-bold {

            font-family: "Bpmonline Open Sans Bold";

        }

    </style>

<script type="text/javascript" src="https://steuler.creatio.com//core/8dc3ccad339641a4ecd1ecb0b57f017d/Terr…"></script>

<script type="text/javascript" src="https://steuler.creatio.com/api/ClientScript/GenerateLoginScripts"></script>

<script type="text/javascript" src="https://steuler.creatio.com//core/057665f97324038f6c7c326b6734de6b/requ…" data-main="https://steuler.creatio.com//core/0fbfa51b1de27f89696f0f8d31da5f16/Terr…" async></script>

<script type="text/javascript"></script>

</head>

<body>

    <div class="font-preload">

        <span class="font-preload-open-sans">_</span>

        <span class="font-preload-open-sans-light">_</span>

        <span class="font-preload-open-sans-bold">_</span>

    </div>

    <form name="IndexForm" method="post" action="./NuiLogin.aspx?ReturnUrl=%2f0%2fodata%2fProduct%3f%24top%3d1&amp;%24top=1" id="IndexForm">

<input type="hidden" name="__VIEWSTATE" id="__VIEWSTATE" value="+mvmSAOrSFVSNU1VvvnnAv5lt45aMHGRIkN033uMqlv/X2Fn2421RrzZayJqLBBTzwEnVTCtLeOrFnkbGP1c32c1p4dJwgJeute2MMWvNkRY1wHA" />

<input type="hidden" name="__VIEWSTATEGENERATOR" id="__VIEWSTATEGENERATOR" value="0BFA92C5" />

    </form>

</body>

</html>

Thanks 

Surajit Kundu

Hi Anusha, 

it's now allowed in HTTP/2 (https://datatracker.ietf.org/doc/html/rfc7540#section-8.1.2.5), which specifies: 

8.1.2.5.  Compressing the Cookie Header Field
 
   The Cookie header field [COOKIE] uses a semi-colon (";") to delimit
   cookie-pairs (or "crumbs").  This header field doesn't follow the
   list construction rules in HTTP (see [RFC7230], Section 3.2.2), which
   prevents cookie-pairs from being separated into different name-value
   pairs.  This can significantly reduce compression efficiency as
   individual cookie-pairs are updated.
 
   To allow for better compression efficiency, the Cookie header field
   MAY be split into separate header fields, each with one or more
   cookie-pairs.  If there are multiple Cookie header fields after
   decompression, these MUST be concatenated into a single octet string
   using the two-octet delimiter of 0x3B, 0x20 (the ASCII string "; ")
   before being passed into a non-HTTP/2 context, such as an HTTP/1.1
   connection, or a generic HTTP server application.
 
   Therefore, the following two lists of Cookie header fields are
   semantically equivalent.
 
     cookie: a=b; c=d; e=f
 
     cookie: a=b
     cookie: c=d
     cookie: e=f

Please also check out this article:

https://datatracker.ietf.org/doc/html/rfc6265#page-7

Best Regards, 

Bogdan L.

Bogdan Lesyk,

Thanks Bogdan. It was really helpfull, will check alternative way to process from the client API side.

Hello! 

Custom configuration service becomes available after user authentication via the AuthService.svc. If you don't have a possibility to call it directly from your integration you can create another layer of service from your side to send a response from external product and call auth service and after that configuration web service. 

https://academy.creatio.com/documents/technic-sdk/7-16/creating-configuration-service

Best regards, 

Dennis 

Dennis Hudson,

Hi Dennis. We are not in a position to do any customization on the external system side.



Is there anything we can do on Creatio's side to facilitate this?

M Shrikanth,

The only way to bypass the Auth service for configuration web services is to create an anonymous web service. As a workaround, you can path login and password to the method in this service and check the validity of credentials in this service using auth service.

Thank you Dennis!