Accessing geonetwork API by JSESSIONID cookie

Question

I am trying to execute this simple request on geonetwork, which should give me catalog statistics details (about private datasets for the corresponding user).

http://localhost:8080/geonetwork/srv/eng/q?_content_type=json&summaryOnly=true

It works, when I add basic authentication credentials, but it does not, when I add a JSESSIONID cookie.

I create a new Geonetwork session, getting this cookie back:

Set-Cookie: JSESSIONID=3038E369A5A499AF410F94ABF8A0B12D; Path=/geonetwork/

When I send this cookie with the above request, tomcat receives this request (from the catalina log):

"GET /geonetwork/srv/eng/q?_content_type=json&summaryOnly=true HTTP/1.1" 200 343 "serverTime=1489326597903; sessionExpiry=1489326597903; JSESSIONID=3038E369A5A499AF410F94ABF8A0B12D"

For me, this looks good. But geonetwork does answer the request just with the dataset statistics, that are public. Private datasets will be excluded from the response.

I examined the requests made in the Geonetwork UI and they look exactly like what I am sending. Is there anything that I miss out at this point?

EDIT:

I am using version 3.0.3 of GeoNetwork.

The good point is: If I test from the Firefox RESTClient with a JSESSIONID created by logging in via the user interface, the session is actually recognized for private access.

So the problem seems to be in my code, where I create a new GeoNetwork session.

• If I call with wrong username/ password, GeoNetwork gives me a 200 OK but no JSESSIONID.
• If I call with correct username/ password, GeoNetwork will give me a 200 OK and a JSESSIONID. But apparently, the JSESSIONID does not seem to be qualified to access private datasets.

What I am basically doing to get the session id, is

Map<String, String> headers = new HashMap<>();
headers.put("Content-Type", "application/x-www-form-urlencoded");

String url = "http://localhost:8080/geonetwork/j_spring_security_check";
String body = "username="+userLogin+"&password="+userPass;

URLResponse r = HttpURLClient.sendRequest(url, headers, body, HttpMethod.POST);

Is that call to j_spring_security_check probably wrong?

Answer 1

Thanks to the confirmation by Délawen that my approach is correct in general, I was fiddling about the security check a bit further.

GeoNetwork does two 302 redirects before returning the correct JSESSIONID with the response. Somehow, the Set-Cookie header from this response is not correctly transferred, if I use default follow redirect option of HttpURLConnection.

If I follow the redirects manually, I get a valid JSESSIONID after the last redirect.

Here my manual redirect output, in case it is relevant to somebody:

(Interestingly, the intermediate JSESSIONID is not valid for private access and there is a referring parameter failure=true, but the final operation is sucessful anyway.)

Sending 'POST' request to URL : http://localhost:8080/geonetwork/j_spring_security_check
Response Code : 302
Location: http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Set-Cookie response: [JSESSIONID=8BE9A26FDB257A666AD016DA055FAA54; Path=/geonetwork/; HttpOnly]

Sending 'POST' request to URL : http://localhost:8080/geonetwork/login.jsp;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Response Code : 302
Location: /geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Set-Cookie response: null

Sending 'POST' request to URL : http://localhost:8080/geonetwork/srv/eng/catalog.signin;jsessionid=8BE9A26FDB257A666AD016DA055FAA54?node=srv&failure=true
Response Code : 200
Set-Cookie response: [sessionExpiry=1489669687323; Path=/, serverTime=1489669687323; Path=/, JSESSIONID=F7296382C6CEEF3A41130B208597E5EC; Path=/geonetwork/; HttpOnly]

So what I now do is to request http://localhost:8080/geonetwork/srv/eng/catalog.signin directly and so far it works good. I hope, it's not a temporary endpoint that changes frequently.

EDIT: My current POST login request just uses the credentials in the Authorization header. I don't send anything in the body so I also don't need the Content-Type header.

After testing this again, somehow, querying the catalog.signin endpoint didn't work for me now, when I want to use the response JSESSIONID to login to GeoNetwork.

What I had to do is to query http://localhost:8080/geonetwork/j_spring_security_check and exactly follow all 302 redirects with my HTTPClient including issued cookies (intermediate sessionid's), as said above.

I use java.net.HttpURLConnection, which has a default follow redirect property, which I had to set to false: con.setInstanceFollowRedirects(false); This is due to the fact, that this does not seem to include cookies by default when doing redirects, so it does not work in this case and I had to do the redirects manually.