I have created one separate module and implemented some services and controller. Those endpoints are not secure, yet everyone can call them, I just want to make them secure so only authorized users can call them. Is there any way already existed in OpenMRS that helps me to make my endpoint secure. Please help me to figure out this.
@dkayiwa thank you for your response. I am already using the Authorized annotation but it’s not working. Is there any document so I could get to know more about it. I have applied @Authorized on one of my service layer, but still I can access my controller, without passing jsessionId in cookies or Basic Auth in header.
Looking forward to hear from you. Thank you
Is the controller able to access the service layer without authentication?
@dkayiwa Yes, controller able to access the service layer without authentication.
Can you publish your module’s source on github?
Hey @gcliff Thank you for your reply.
Your suggestion is regarding about AOP, not API’s security.
@narukumar AOP allows the programmer to express cross-cutting concerns in stand-alone modules called aspects . Aspects can contain advice (code joined to specified points in the program) and inter-type declarations (structural members added to other classes).eg a module can include advice that performs a security check before accessing API data through authorization and authentication
A few comments:
- For the
@Authorizedannotation to work, you need to provide some privilege to actually check for, e.g.,
- In your REST controller, you are injecting
UnassignedPrescriptionServiceImpldirectly instead of injecting the interface, but the
@Authorizedannotations are only on the interface. You should be autowiring
- You probably want your controller to extend
hello @ibacher I have done all the changes but still endpoint is not secure, I am able to call it without passing authentication. Just to let you know that I have inserted one table in openmrs database and do I need to make a new privilege constant?
Are all your changes committed?
@dkayiwa yes, but I am not sure about the “PrivilegeConstants”. How they works for authorization and should I make a new constant?
After adding the authorised annotation to your service interface method, the OpenMRS platform will automatically take care of the rest. As for the privilege constant, it is all up to you. For instance, you can use something like this:
@Authorized("Create Prescriptions") for the
hello @dkayiwa Yes I did in this way, but It’s not working out for me. I have used PrivilegeConstants from openmrs-core and that didn’t worked out for me so I have created one class for privilege constant for my module and annotated this class with “@HasAddOnStartupPrivileges” and “@AddOnStartup” for constant.