Support //blp/apiauth about blpapi-http HOT 4 CLOSED

@yupinghu, please update with your findings and status. Just a reminder :).

from blpapi-http.

Whoops, forgot this was here. :)

The core part of authorization is the Identity object. It contains the authorization info and is passed into every BLPAPI request; the request will take into account what the Identity is entitled to and the response will reflect that (possibly will result in an error response if the Identity is not authorized properly for that request).

To correctly populate the Identity, you use Session::sendAuthorizationRequest. When this request completes successfully, the Identity object will have been altered to reflect this (and when used in future requests, will do the right thing). The Request object passed to sendAuthorizationRequest needs to specify enough info to be able to authorize the user. This consists of either a UUID & IP address (e.g. for SAPI, this is where the user is logged in to the Terminal), or a token (e.g. for BPIPE).

The UUID/IP address mechanism assumes you're logged into the Terminal and know how to get that info, which is not the use case for the http server. So we'll want to use tokens. I'll get to token generation below, but the high level point is that authorization basically boils down to getting a valid token. I'm working on changes that, given a token, will take care of the rest.

(Currently the developer's guide (2.54) has conflicting info. The BPIPE examples use tokens to authorize the user, but the schema section suggests that this is deprecated. Given that we plan on using this token mechanism, we should investigate what the replacement for this is, if it's deprecated, or update the dev guide to not call it deprecated.)

Right now, the only ways I can see of getting a token are using Windows login info, or by generating a MSG to the user containing the token string. The first one obviously doesn't work for us, and the latter is not a good user experience. In the short run, it's good enough for developing the authorization code in the http server, but we'll need to think about how the user will actually input the token.

from blpapi-http.

Anyway that's the overview of how it works. My changes that implement this will have docs/examples that should make it more clear what's going on, and I'll close this issue at that time.

from blpapi-http.

bloomberg/blpapi-node#37 adds support for authorization requests.

from blpapi-http.