API Guide

S5. Security Token and Security Considerations

The XDOC UI Service provides a mechanism for the Calling Application to pass an additional Security Token that can be used to ensure that the Request is Trusted. The Security Token is similar in concept to the User Token from the previous section. The Security Token is passed via parameter XST.

The Security Token is an encrypted string that contains multiple embedded data fields in JSON, XML, or form-url-encoded format. The Data Fields consist of Application level credentials that can be used to ensure the Calling Application is Trusted. The values of the Data Fields embedded in the Security Token are configurable in XDOC at a Project Level, and must be kept in sync with the Integrated Application appropriately.

Note: The Security Token (XST) and the User Token (XUT) can be combined together. The XDOC User Interface Service will check for the existence of both tokens. If only 1 token is present, then both the User and Security attributes will be read from that token.

5.1. Security Token Data Fields

5.2. Token JSON String Example

{
    "Context": "axui", 
    "AppId": "MyApp",
    "AppKey": "MyPassKey",
    "GenDT": "2010-03-01T10:32:56Z",
    "Client": "127.0.0.1" 
}

5.3. Token XML String Example

<SecurityToken>
    <Context>axui</Context>
    <AppId>MyApp</AppId>
    <AppKey>MyPassKey</AppKey>
    <GenDT>2010-03-01T10:32:56Z</GenDT>
    <Client>127.0.0.1</Client>
</SecurityToken>

5.4. Token Form-Url Encoded String Example

Context=axui&AppId=MyApp&AppKey=MyPassKey&GenDT=2010-03-01T10:32:56Z&Client=127.0.0.1&

5.5. Token Encryption The Token string must be encrypted using industry standard AES encryption (Rijndael algorithm), and then base64 encoded. The value sent to the Service via the XST parameter is the final base64 encoded value. The AES encryption generation settings are configurable in the Axacore Server and must be kept in sync with the same values used by the Invoking Application. The set of AES encryption settings effectively define a Private Key.

5.6. Validating the Security Token XDOC allows configuration of the following options at the System Level and Project Level in order to check that the Security Token is valid.

Http Request Validation Settings

Security Token Validation Settings