1

currently developing web application that utilizes magento's customer / admin tokens (magento 2).

I am trying to access my custom webapi with resource assigned as "self" using an admin user with a specific user role (customized);

Here is the senario that i am running into:

Scenario #1: Accessing the custom webapi with self resource using a customer token yields a proper response.

Scenario #2: Accessing the custom webapi with self resource using an admin token with the default Administrator role (with all resources enabled) yields a proper response.

Scenario #3: Accessing the custom webapi with self resource using an admin token with a customized admin role (all resources enabled except for custom resources defined by my ACL file) yields a response of :

{
    "message": "Consumer is not authorized to access %resources",
    "parameters": {
        "resources": "self"
    }
}

If i understood magento's Authentication system for webapi correctly, regardless of what resources admin users have, they should all have access to the self, resource, webapi.

It is necessary that i use magento's role to identify the administrative levels of each admin users, however, this prevents me from calling webapis with the resource self.

Any idea whether this is a bug or maybe i'm doing something wrong? I did do a web search for similar cases, and found no solution. Thus, any help would be appreciated, thanks.

My config files are formatted as follows:

webapi.xml:

<?xml version="1.0"?>
<routes xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Webapi:etc/webapi.xsd">
    <route url="/V1/foo/bar/:entity_id" method="GET">
        <service class="Foo\Bar\Api\BarManagementInterface" method="get"/>
        <resources>
            <resource ref="self"/>
        </resources>
    </route>

    <route url="/V1/foo/bar/" method="GET">
        <service class="Foo\Bar\Api\BarManagementInterface" method="getList"/>
        <resources>
            <resource ref="self"/>
        </resources>
    </route>

    <route url="/V1/foo/bar/" method="POST">
        <service class="Foo\Bar\Api\BarManagementInterface" method="save"/>
        <resources>
            <resource ref="self"/>
        </resources>
    </route>

    <route url="/V1/foo/bar/:entity_id" method="DELETE">
        <service class="Foo\Bar\Api\BarManagementInterface" method="delete"/>
        <resources>
            <resource ref="Custom_Permission::permission_management"/>
        </resources>
    </route>

</routes>

acl.xml:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:Acl/etc/acl.xsd">
  <acl>
    <resources>
      <resource id="Magento_Backend::admin">
        <resource id="Custom_Permission::permission" title="Custom Permission" sortOrder="100">
          <resource id="Custom_Permission::permission_management" title="Management" sortOrder="101"/>
        </resource>
      </resource>
    </resources>
  </acl>
</config>

di.xml:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <preference for="Foo\Bar\Api\BarManagementInterface" type="Foo\Bar\Model\BarManagement" />
</config>
  • Are you in M1 or M2? – PY Yick Feb 27 '18 at 3:56
  • I am currently using magento 2. – teddelicious Feb 27 '18 at 16:39
  • Just to clarify, in #3, you have granted access to resource self for that role? – Alvin Nguyen Feb 27 '18 at 19:34
  • i dont see a resource called "self" in the role assignment page in the magento backend. I've assigned the role with all assignable resources. P.S. when assigning roles, there are 2 options, 1 is "Administrator" and the other is "Custom". If i check the database for the assigned rule of "Administrator", it has a single entry of "Magento_Backend::all" with permission of "allowed". while any custom role that i create will have multiple entries of resource being "allow"/"deny". I guess because "Magento_Backend::all" is set as "deny" for all of these roles, the "self" resource is inaccessible? – teddelicious Feb 27 '18 at 23:56
  • I want to get your webapi.xml codes. I suspect you miss some settings on this file. – PY Yick Mar 2 '18 at 2:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.