#Authentication

I am trying to use IRIS for Health as a Facade for an external FHIR Server, where IRIS provides the proper authentication. The client authenticates using a bearer token obtained from the IRIS OAuth2 server via a jwt client assertion. The IRIS endpoint, however, returns a 401 as soon as I remove the Unauthenticated access

Is there w way to make this work through configuration?

Recently I got into a situation where a user had some roles, which granted additional roles, and so on.

As I did not understand where a particular permission came from, I wrote this code which gets an initial set of roles and unwraps them recursively, accounting for any repeats.

Dear All,

I am currently part of a team that is developing an application using Microsoft PowerApps as the front end and IRIS as the backend.  Effectively that frontend screens, which are house and an Azure serve, call a series of REST interfaces exposed by IRIS from a physical Microsoft server.  During the development stage we have not had any security in place but now we need to secure the application using a single sign on.  PowerApps relies on Microsoft Entra for its security both LDAP and OAuth.  Has anyone in the community connected IRIS to Microsoft Entra? 

I have managed to register

As a part of the IRIS Python 2024 contest, my colleague Damir and I went with an idea to build a platform called ShelterShare for connecting victims and volunteers for shelter requests . To do so we chose django as a framework and proceeded to build the first version with 3 different docker containers, django, iris and nginx which would then utilize IRIS as a pure Database engine via the beautifly composed django_iris (cudos to Dimitry). As we were progressing fast, we decided to explore the option of running it within the same container as IRIS by utilizing WSGI added in 2024.1.

I have a question about using OnInit() within a Ens.BusinessOperation.

When you include OnInit(), does OnInit() only execute when you start a Business Operation? Or does it execute OnInit () every time you send a REST request to the operation. I am trying to pinpoint when the best time is to execute the POST command to get the Token

I am needing to get a Bearer Token from a REST POST call and return the Authorization key prior to making the rest of the REST calls to pull down data.

When not using OAuth, what have you done to get the Token prior to executing any Requests?

Thanks

Scott

Hi Team,

My SOAP functions were working perfectly before enabling basic authentication. To set up basic authentication, I created web applications for the SOAP service, checked the password option, and assigned a user to this web application. However, after enabling basic authentication, the SOAP service stopped working.

We recently moved from using the Private Web Server, to using an Apache/Web Gateway setup and moved towards using the built in LDAP functionality within IRIS. Since then, we have 1 user that uses VSCode (/api/atelier) heavily that continues to have issues signing into IRIS through VS Code and the /api/atelier extension.

I am trying to troubleshoot two issues..

• User having login failures with correct password. 

ERROR #798: LDAP login failed
ERROR #971: Invalid LDAP password, error 49, Invalid credentials:80090308: LdapErr: DSID-0C090449, comment: AcceptSecurityContext error, data 52e,

In this article we are going to see how we can use the WhatsApp instant messaging service from InterSystems IRIS to send messages to different recipients. To do this we must create and configure an account in Meta and configure a Business Operation to send the messages we want.

Let's look at each of these steps in more detail.

Setting up an account on Meta

This is possibly the most complicated point of the entire configuration, since we will have to configure a series of accounts until we can have the messaging functionality.

Here you can read the official Meta documentation.

First we will create

Is there an api for 'Is this user log-in?' and 'log-in this user with this id and password'?

Thank you

I am attempting to configure an inbound service that utilizes the EnsLib.SOAP.GenericService class. This service receives HL7-v3 content wrapped in SOAP requests. Despite reading the documentation on configuring SOAP services, I am still confused.

In my current configuration item "Fr_Centrak_RTLS", I have ‘Enable Standard Requests’ checked, ‘Pool Size’ set to 0, and the port is unspecified.

I have also configured a web application with the following details:

My challenge is determining the correct URL address for sending SOAP traffic to this service.

Introduction

In the modern digital age, securing applications, particularly those handling sensitive health data, is paramount. The confidentiality, integrity, and availability of such data are crucial, necessitating robust security measures. Two-factor authentication (2FA) stands out as a critical enhancement in safeguarding access, adding an extra layer of security beyond just passwords. Recognizing the significance of this feature, InterSystems provides built-in support for 2FA in its database solutions. This tutorial aims to guide you through the process of configuring two-factor authentication in your InterSystems environment, ensuring that your data remains secure and accessible only to authorized users.

I am trying to use postman to start the restapi classes from a json openapi2.0.0 file.

POST: https://myserver.com/api/mgmnt/v2/requestAPI. The body contains the openapi2.0.0. The application api/mgmnt has in security settings: password. JWT is not selected. I set postman authentication to basis authentication and gave username and password. I also set in headers IRISUsername and IRISPassword. I have 401 Unauthorized.

Is the only way to go through is to build an oauth token? or do I miss something?

Thank you very much.

When trying to save ZAUTHENTICATE.mac the following error occurs 

If it is wrongly named as like ZATHIENTICATE.mac in the %SYS namespace it saves ok so it is something blocking saving a new fresh ZAUTH code of the correct name- we have no other delegated auth that I am aware of. 

Your may not realize it, but your InterSystems Login Account can be used to access a very wide array of InterSystems services to help you learn and use InterSystems IRIS and other InterSystems technologies more effectively.  Continue reading to learn more about how to unlock new technical knowledge and tools using your InterSystems Login account.  Also - after reading, please participate in the Poll at the bottom, so we can see how this article was useful to you!

What is an InterSystems Login Account? 

An InterSystems Login account is used to access various online services which serve

The objective of the article is to provide the reader with the following informations:

• Configure and use the FHIR server
• Create an OAuth2 Authorization Server
• Bind the FHIR server to the OAuth2 Authorization Server for support of SMART on FHIR
• Use the interoperability capabilities of IRIS for Health to filter FHIR resources
• Create a custom operation on the FHIR server

Schema of the article:

The %CSP.Login class is the utility class provided by InterSystems IRIS to do custom login pages.If you want to control your IRIS application authentication UI, you must extend %CSP.Login and override some methods according to your needs.This article is going to detail those methods and what you can do with them.In addition to that, you will get an explanation of the delegated authentication mechanism provided by ZAUTHENTICATE.mac routine.

“I have been waiting for thirty seconds for service. This is outrageous! I am leaving!”

“I am very sorry to hear that, sir. Perhaps, next time, you should make a reservation.”

If you heard that comment at your favorite restaurant, you would think the person saying it was being ridiculous. However, in the context of your API, it makes perfect sense. Just like your favorite eatery, your API has some regular patrons who, as you know, will be visiting one day or another. It would be great to be able to make a standing reservation for them as well.

It will involve a couple of IRIS fundamentals.

Hi, I need to make a prompt for a password and to not display what the user is typing in a CMD. I want to use the read command but i'm not sure if it is possible with it.

Is it possible to authenticate an xDBC (ODBC/JDBC) connection to InterSystems IRIS via (a 3rd party) OAuth server?

For REST APIs this is possible, but could this be achieved with OAuth? 

Out-of-the-box the ODBC/JDBC Drivers don't seem to have this option, but maybe some custom code could enable this? perhaps via Delegated Authentication and some OAuth classes customization, or some other way?

Has anyone done this already and can share how it was implemented, or someone with some guideline suggestions?

Hi,

I use Caché COS and I'm having trouble doing a POP3 on the Microsoft email server using OAuth 2.0 authentication.

I'm using the following program to accomplish this task:

QGPOP ; Recebe e-mail da Microsoft Office 365
  Set server=##class(%Net.POP3).%New()
  Set server.port=995
  Set server.StoreAttachToFile=1
  Set server.AttachDir="D:\HOME\CNTIRET"
  Set servername="outlook.office365.com"
  Set user="importacao@ferrolene.com.br",pass="xxxxxx"
  Set AccessToken="exxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
  set server.SSLConfiguration="Transnovag"
  Set

Here in %SYS, we have already examined users, resources, and roles. Now that we know how to set all of that up, we should give it a purpose. Next we will talk about applications! As you may expect, we will see various identical class methods defined here that we have seen in the previous classes. However, some of them will have some tiny yet significant differences.

Hello everyone,

I am attempting to enable two-factor authentication for a user account through the System Administration > Security > Users > Edit User (Security Settings) section. However, I am encountering an error with the Qrcode class.

ERROR #5002: ObjectScript error: <NOTOPEN>zGenerate+27^%SYS.QRCode.1

Update:
I tried to create a QR code image using the command from the %SYS.Qrcode class, and I encountered the same error. I believe it may be related to folder permissions, but I have already granted all the permissions that I am aware of to the InterSystems database.

Has anyone encountered

Hello,

I'm making rest API service with Authentication.

How I can return HTTP Status 403 if user enter invalid login or password?

Now returning Http status 200.

Class RestAPI Extends %CSP.REST
{

XData UrlMap [ XMLNamespace = "http://www.intersystems.com/urlmap" ]
{
<Routes>

<Map Prefix="/restforms" Forward="Form.REST.Main"/>
<Route Url="/auth/:login/:pass" Method="GET" Call="CheckUser" Cors="true"/>
</Routes>
}

ClassMethod CheckUser(userAw, pwdAw) As %String
{

set %response.ContentType = "application/json"

// my code to check auth

Set object = {}
Set object.status = -1
Set object.message = "HTTP/1.1 401

Hello Community,

I've enabled the JWT Authentication in my web application. I invoked the /login page to get the JWT and it creates an entry in %SYS.TokenAuth table. Is there any time span for the entries will rid out from the table automatically or It's  a manual process? Where can I find the JWT signature private/public key 

settings screenshot

web application

Taking advantage of the Quiniela ML application and as we indicated in the previous article, we are going to explain how we can perform a JWT authentication between our frontend developed in Angular and our backend developed in InterSystems IRIS.

I remind you of the architecture of our QuinielaML project:

Usually it is a cumbersome process in web applications to develop the administration and management of user access, but in our case InterSystems IRIS simplifies the process by providing us with all the infrastructure we need.

JSON Web Token Authentication

IRIS provides web applications that

In this article I will explain how to Authenticate, Authorize and Audit by code by using CSP Web Application along with Enabling /Disabling and Authenticate/Unauthenticate any Web Application.

• Online Demo is available on cloud https://dappsecurity.demo.community.intersystems.com/csp/user/index.csp (SuperUser | SYS)
• I recommend to watch the video before continue https://www.youtube.com/watch?v=qFRa3njqDcA

Application Layout
 

When I attempt to start my local IRIS instance (named LATEST) I am getting the below error

"(111) Error starting service: LATEST
Reason: (1069) The service did not start due to a logon failure."

Does anyone have experience with this or know how to resolve the logon credentials associated  with this start? 

Have you ever thought of creating your own systems for editing users or, perhaps, even an API that you can call? Today, you’re going to join me in the %SYS namespace and get to know Security.Users! 

This class has forty properties, many of which you’ve seen before in the System Management Portal.There are class methods for manipulating most of those properties.Every method in this class is a class method, and in most of them, the username is passed as an argument.These methods can be used when you do not want to open and directly manipulate the user’s objects, which is a bad idea anyway!

Hello Everyone,

We currently have CSP application that runs under 2 servers(usually primary), and every month the server reboots for patching SERVER1(primary) in the morning and SERVER2(backup) at night.

Whenever the SERVER1 reboots SERVER2 behaves as primary and when SERVER1 comes back up it will act as backup server.

First Patching:

So, when SERVER1 is down, I need to start httpd service for SERVER2 and stop httpd service for SERVER1 (which is now backup server).

I tried using the code below in terminal to start httpd service for SERVER2 with no success.

// Need to provide password for current

This scenario showed up yesterday at a client site when I was delivering bespoke consultation on migration from Studio to VS Code.

The site's servers had been configured to use delegated authentication, but the "Delegated" checkbox hadn't been set against the /api/atelier web application, which is what the members of the InterSystems ObjectScript Extension Pack use to make their connections.

As soon as the we application got its checkbox set and the Server Manager refresh button was clicked, namespaces could be enumerated on the server.