Discover M-Files Workspaces: All work available in the right business context, automatically!
➡️ Learn How it Works

Options
  • State Suggested Answer
  • Replies 2 replies
  • Answers 2 answers
  • Subscribers 12 subscribers
  • Views 193 views
  • Users 0 members are here
Related

Rest API Authentication

Jannik Hanser

Hello everyone,

I received a request from our client regarding authentication options. Unfortunately, I'm not very familiar with this topic. Perhaps someone has some experience with this or has a recommendation?

Thanks in advance.

Here's the client's request:

Specifically, we want to connect our in-house developed systems (Java backends, OAuth via Keycloak Cloud-IAM) to our locally hosted M-Files. We want to use the existing OAuth context for each system, not technical users. Typically, mechanisms like a token exchange are used to convert the respective backend token into an M-Files token. We can't retrieve a token via the REST API because we don't know the password within the application itself (so POST /REST/server/authenticationtokens is not an option).

The option we looked at (Federated Authentication in the Vault configuration) is, in my opinion, not relevant for using the REST API.

Parents
  • 0

    I assume that you already have M-Files configured to do authentication against whatever IDP you are using.  That obviously has to be the first step.  Once users can authenticate using that IDP to M-Files then it becomes a matter of ensuring that you get a valid token to use the REST API.

    When it comes to OAuth tokens, the REST API simply passes them across to the server which checks their validity.  If the IDP you are using supports token exchange, and you can exchange the user's current OAuth token ("token 1") for one which is valid for the M-Files client configuration ("token 2"), then providing that new token ("token 2") to the REST API via the authentication header (bearer token) should work.

    I haven't personally done this, but as long as the token you have is valid then the REST API should accept it.  The question then becomes how to exchange token 1 for token 2, but that's more to do with your IDP and OAuth provider than M-Files.

    I don't have a huge amount more I can say here (as I said: I have not personally done it), but provided you can exchange token 1 for a token that is valid according to the M-Files authentication configuration (token 2) then I can't see why M-Files would reject it.

Reply
  • 0

    I assume that you already have M-Files configured to do authentication against whatever IDP you are using.  That obviously has to be the first step.  Once users can authenticate using that IDP to M-Files then it becomes a matter of ensuring that you get a valid token to use the REST API.

    When it comes to OAuth tokens, the REST API simply passes them across to the server which checks their validity.  If the IDP you are using supports token exchange, and you can exchange the user's current OAuth token ("token 1") for one which is valid for the M-Files client configuration ("token 2"), then providing that new token ("token 2") to the REST API via the authentication header (bearer token) should work.

    I haven't personally done this, but as long as the token you have is valid then the REST API should accept it.  The question then becomes how to exchange token 1 for token 2, but that's more to do with your IDP and OAuth provider than M-Files.

    I don't have a huge amount more I can say here (as I said: I have not personally done it), but provided you can exchange token 1 for a token that is valid according to the M-Files authentication configuration (token 2) then I can't see why M-Files would reject it.

Children
No Data
M-Files
M-Files Support


© 2025 M-Files, All Rights Reserved.