Search code examples
c#restapialmunauthorized

HP ALM 12.21 REST API - 401 Unauthorized - C#

I am trying to use the API against our ALM 12.21 server, but always ends up with "401 Unauthorized". It seems that I get the auth cookie back correctly, but when I try to do something after that I am unauthorized.

I use this the get this to get auth cookie (seems to work):

HttpWebRequest myauthrequest = (HttpWebRequest)WebRequest.Create("https://server/qcbin/authentication-point/alm-authenticate");

            string AuthenticationXML = @"<alm-authentication>
                        <user>username</user>                
                        <password>password</password>       
                        </alm-authentication>";

            byte[] Requestbytes = Encoding.UTF8.GetBytes(AuthenticationXML);
            myauthrequest.Method = "POST";
            myauthrequest.ContentType = "application/xml";
            myauthrequest.ContentLength = Requestbytes.Length;
            myauthrequest.Accept = "application/xml";
            Stream RequestStr = myauthrequest.GetRequestStream();
            RequestStr.Write(Requestbytes, 0, Requestbytes.Length);
            RequestStr.Close();
            HttpWebResponse myauthres = (HttpWebResponse)myauthrequest.GetResponse();
            var AuthenticationCookie = myauthres.Headers.Get("Set-Cookie");
            AuthenticationCookie = AuthenticationCookie.Replace(";Path=/;HTTPOnly", "");

I am not sure if the .Replace is needed. Just read it somewhere. I get 401 both with or without it though, when trying to do subsequent requests.

Trying e.g. this after getting auth cookie:

 HttpWebRequest req = (HttpWebRequest)WebRequest.Create("https://server/qcbin/rest/domains/FS/projects/P3602_SLS_Project/defects/1");
            req.Method = "GET";
            req.ContentType = "application/xml";
            req.Accept = "application/octet-stream";
            req.Headers.Set(HttpRequestHeader.Cookie, AuthenticationCookie);
            HttpWebResponse res = (HttpWebResponse)req.GetResponse();
            Stream RStream2 = res.GetResponseStream();
            XDocument doc = XDocument.Load(RStream2);

Which fails with 401.

Anyone have complete working code for the ALM 12.21 REST API?

Solution

  • You need two main cookies to get the ALM REST API works perfectly.

    1. LWSSO_COOKIE_KEY

    2. QCSession

      almURL = "https://..com/qcbin/"

      authEndPoint = almURL + "authentication-point/authenticate"

      qcSessionEndPoint = almURL + "rest/site-session"

    After you get successful response for authEndPoint you will get the LWSSO_COOKIE_KEY

    Use that cookie in your next request to qcSessionEndPoint, it should give you QCSession cookie.

    Use both LWSSO_COOKIE_KEY and QCSession cookies in your subsequent requests to get data from ALM.

    I see that you are using octet-stream to get the defect response. When I checked the documentation, it can return one of the following types.

    "application/xml"
"application/atom+xml"
"application/json"

    Just in case, if you need to see some working implementation in python, here it is https://github.com/macroking/ALM-Integration/blob/master/ALM_Integration_Util.py It may give you some idea.