use X-UserToken instead of credentials in REST API Calls

[Hamza Berouil2]

Hi all,

I was thinking that X-UserToken can be used instead of using credentials in REST calls.

Let me elaborate, we need to implement an interface with 3rd party application (a portal where users can have access to their incidents).

Users log into the portal through SSO (the same is used for ServiceNow).

The issue they may not have an existing session in ServiceNow so they don't have existing cookies that could be reused for the REST calls an those users don't have password that can be use as credentials for

So we thought maybe we can retrieve a token trough the API GideSession (gs.getSessionToken()) and then reuse it in the X-UserToken header.

Before that, I wanted to make sure X-UserToken can replace credentials, but I still unable to succeed this test.

I am using SoapUI for my test, first I generate a X-UserToken value (through REST API Explorer).

copy/paste this value in Soap UI as follow and I put nothing in Username/password properties :

As you can see I get a failure status with the error "User Not Authenticated"

What's wrong with my test ? I tought that X-User

Thank's guy

[andrew_venables]

If you have SSO enabled on the SN instance then this step will be passed automatically for your users. All that needs to happen is the users authenticate to the instance doesn't matter whether is username/password or SSO.

[Hamza Berouil2]

Thanks a lot Andrew,

I will check with my customer and let you know if it suits him.

[Asbj_rn]

Hi, 

trying the same thing. 🙂 

so far i got it working in postman. currently figuring out how to do the same in a client side script. let me know if you nail it faster than i do 😉

in order for a successfull authentication you need to provide the x-user-token accompanied by a valid JSSESSIONID cookie that contains a unique identifier for your specific session. the cookie is generated upon a successfull login.

In your request add the header x-user-token and the JSSESSIONID cookie to your http request. You can add cookies specifically through the Cookie header. 

you can see the JSSESSIONID cookie through the dev tools in your browser.

[Asbj_rn]

Hi, got it working client side. 

the user have to be signed in in order for this to work. this is invoked through a button on a UI page. 

example on the request.

var userSessionToken = window.g_ck;
	
var p = axios.get(url,{
	headers:{
		'X-UserToken': userSessionToken
	}
});
	

HTTP response: 

No need to fiddle with the JSSESSIONID cookie. 

[Community Alums]

How to achieve the same in server side scripting?