TSS API Authentication and Authorization

Authentication of a TSS API Administrator using the TSS API

The TSS API resource POST /administrators/{login}/sessions allows any TSS API Administrator (administrator associated to the role "TSSAdmin") to authenticate through the TSS API.

The request requires the following JSON body:

{
    "authenticationKey":"<authentication key>",
    "salt":"<salt>"
}

where the authenticationKey property is computed as follows (case insensitive): SHA256( UPPER( SHA256(<administrator password>) ) + salt )

and the salt property is a unique, randomly generated string. The salt should be:

•generated using a cryptographically secure function

•composed of at least 16 characters

•encoded into a safe character set such as hexadecimal or Base64

By default, TSS API administrators are allowed to access all of the TSS API resources. The following TSS setting is used to change this default behavior:

Location: TSS Settings
General	Authorize TSS API administrators to access TSS API resources truefalse Key: application.tss.api.authorize.administrators Description: Authorize (or not) authenticated TSS API administrators to access all TSS API resources. If they are authorized (true), TSS API administrators will have access to all TSS API resources after they authenticate. Otherwise (false) they will only have access to the opened API resources, even if they successfully authenticate. When a TSS API administrator successfully authenticates, the TSS API returns an authentication token. This token must then be returned to the TSS (in the HTTP Authorization header) for the TSS API administrator to be authorized to access API resources that require an authentication. Constraint: true|false

Authorization for TSS services

By default, no one is authorized to access some TSS services (API resources). They are like closed/disabled. Those TSS services require a specific authorization to be explicitly defined in order for them to be accessible. This specific authorization is defined using the TSS setting service.authorization which can take one of the following values (from the most restrictive to the most permissive):

•none (or close): no one is authorized to access the TSS services (default value)

•authenticated: only authenticated users, devices or administrators are authorized to access TSS services by providing a valid authentication token

•all (or open): everybody is authorized to access the TSS services without providing any authentication token

This setting is used to globally define an authorization for all TSS services that require an authorization to be explicitly defined.

Use the TSS setting service.{resource path}.authorization to explicitly define an authorization for the only TSS service whose path is the same as the one in the key. For instance:

•to authorize anybody to access the TSS service /telephony/places, use the TSS setting: service.telephony.places.authorization = all|open

•to authorize only authenticated users or devices to access the TSS service /telephony/places/{id}, use the TSS setting: service.telephony.places.id.authorization = authenticated

•to disable the TSS service /tpoclusters, use the TSS setting: service.tpoclusters.authorization = none|close

Location: TSS Settings
General	Global authorization for TSS services noneallauthenticated Key: service.authorization Description: By default, no one is authorized to access some TSS services (API resources). They are like closed/disabled. Those TSS services require a specific authorization to be explicitly defined in order for them to be accessible. This setting is used to globally define an authorization for all TSS services that require an authorization to be explicitly defined. Use the setting service.{resource path}.authorization to explicitly define an authorization for the only TSS service whose path is the same as the one in the key. Constraint: From the most restrictive to the most permissive: - none (or close): no one is authorized to access the TSS services (default value) - authenticated: only authenticated users, devices or administrators are authorized to access TSS services by providing a valid authentication token - all (or open): everybody is authorized to access the TSS services without providing any authentication token