HP ALM 12.21 REST API - 401 Unauthorized - C#

Question

I am trying to use the API against our ALM 12.21 server, but always ends up with "401 Unauthorized". It seems that I get the auth cookie back correctly, but when I try to do something after that I am unauthorized.

I use this the get this to get auth cookie (seems to work):

HttpWebRequest myauthrequest = (HttpWebRequest)WebRequest.Create("https://server/qcbin/authentication-point/alm-authenticate");

            string AuthenticationXML = @"<alm-authentication>
                        <user>username</user>                
                        <password>password</password>       
                        </alm-authentication>";

            byte[] Requestbytes = Encoding.UTF8.GetBytes(AuthenticationXML);
            myauthrequest.Method = "POST";
            myauthrequest.ContentType = "application/xml";
            myauthrequest.ContentLength = Requestbytes.Length;
            myauthrequest.Accept = "application/xml";
            Stream RequestStr = myauthrequest.GetRequestStream();
            RequestStr.Write(Requestbytes, 0, Requestbytes.Length);
            RequestStr.Close();
            HttpWebResponse myauthres = (HttpWebResponse)myauthrequest.GetResponse();
            var AuthenticationCookie = myauthres.Headers.Get("Set-Cookie");
            AuthenticationCookie = AuthenticationCookie.Replace(";Path=/;HTTPOnly", "");

I am not sure if the .Replace is needed. Just read it somewhere. I get 401 both with or without it though, when trying to do subsequent requests.

Trying eg this after getting auth cookie:

 HttpWebRequest req = (HttpWebRequest)WebRequest.Create("https://server/qcbin/rest/domains/FS/projects/P3602_SLS_Project/defects/1");
            req.Method = "GET";
            req.ContentType = "application/xml";
            req.Accept = "application/octet-stream";
            req.Headers.Set(HttpRequestHeader.Cookie, AuthenticationCookie);
            HttpWebResponse res = (HttpWebResponse)req.GetResponse();
            Stream RStream2 = res.GetResponseStream();
            XDocument doc = XDocument.Load(RStream2);

Which fails with 401.

Anyone have complete working code for the ALM 12.21 REST API?

Answer 1

You need two main cookies to get the ALM REST API works perfectly.

1. LWSSO_COOKIE_KEY

2. QCSession

   almURL = "https:// . .com/qcbin/"

   authEndPoint = almURL + "authentication-point/authenticate"

   qcSessionEndPoint = almURL + "rest/site-session"

After you get successful response for authEndPoint you will get the LWSSO_COOKIE_KEY

Use that cookie in your next request to qcSessionEndPoint , it should give you QCSession cookie.

Use both LWSSO_COOKIE_KEY and QCSession cookies in your subsequent requests to get data from ALM.

I see that you are using octet-stream to get the defect response. When I checked the documentation, it can return one of the following types.

"application/xml"
"application/atom+xml"
"application/json"

Just in case, if you need to see some working implementation in python, here it is https://github.com/macroking/ALM-Integration/blob/master/ALM_Integration_Util.py It may give you some idea.

Answer 2

Thank you @Barney. You sent me in the correct direction :-) For anyone interested, I managed it like this, eg for getting defect ID 473:

Logging on to create a CookieContainer and then use that to do the actual ALM data fetch:

   private void button1_Click(object sender, EventArgs e)
    {
        string almURL = @"https://url/qcbin/";
        string domain = "domain";
        string project = "project";
        CookieContainer cookieContainer = LoginAlm2(almURL, "username", "password", domain, project);

        HttpWebRequest myWebRequest1 = (HttpWebRequest)WebRequest.Create(almURL + "/rest/domains/" + domain + "/projects/" + project + "/defects/473");
        myWebRequest1.CookieContainer = cookieContainer;
        myWebRequest1.Accept = "application/json";
        WebResponse webResponse1 = myWebRequest1.GetResponse();
        StreamReader reader = new StreamReader(webResponse1.GetResponseStream());
        string res = reader.ReadToEnd();

    }


   public CookieContainer LoginAlm2(string server, string user, string password, string domain, string project)
    {
        //Creating the WebRequest with the URL and encoded authentication
        string StrServerLogin = server + "/api/authentication/sign-in";
        HttpWebRequest myWebRequest = (HttpWebRequest)WebRequest.Create(StrServerLogin);
        myWebRequest.Headers[HttpRequestHeader.Authorization] = "Basic " + Base64Encode(user + ":" + password);
        WebResponse webResponse = myWebRequest.GetResponse();

        CookieContainer c = new CookieContainer();
        Uri uri = new Uri(server);

        string StrCookie = webResponse.Headers.ToString();
        string StrCookie1 = StrCookie.Substring(StrCookie.IndexOf("LWSSO_COOKIE_KEY=") + 17);
        StrCookie1 = StrCookie1.Substring(0, StrCookie1.IndexOf(";"));
        c.Add(new Cookie("LWSSO_COOKIE_KEY", StrCookie1) { Domain = uri.Host });

        //Then the QCSession cookie
        string StrCookie2 = StrCookie.Substring(StrCookie.IndexOf("QCSession=") + 10);
        StrCookie2 = StrCookie2.Substring(0, StrCookie2.IndexOf(";"));
        c.Add(new Cookie("QCSession", StrCookie2) { Domain = uri.Host });

        //Then the ALM_USER cookie
        string StrCookie3 = StrCookie.Substring(StrCookie.IndexOf("ALM_USER=") + 9);
        StrCookie3 = StrCookie3.Substring(0, StrCookie3.IndexOf(";"));
        c.Add(new Cookie("ALM_USER", StrCookie3) { Domain = uri.Host });

        //And finally the XSRF-TOKEN cookie
        string StrCookie4 = StrCookie.Substring(StrCookie.IndexOf("XSRF-TOKEN=") + 12);
        StrCookie4 = StrCookie4.Substring(0, StrCookie4.IndexOf(";"));
        c.Add(new Cookie("XSRF-TOKEN", StrCookie4) { Domain = uri.Host });

        return c;
    }

Works like a charm :-)