Access to WinCC OA from Webservice via C # API

[kilianvp]

you can sign your post with a secrect key and provide the public key (sha1 hmac)

or you use https://jwt.io/

[mhargreaves]

Kilian von Pflugk wrote:

you can sign your post with a secrect key and provide the public key (sha1 hmac)

or you use https://jwt.io/

Thanks for that - is there a way to sign the post within CONTROL script?

[kilianvp]

Mark Hargreaves wrote:

Kilian von Pflugk wrote:

you can sign your post with a secrect key and provide the public key (sha1 hmac)

or you use https://jwt.io/

Thanks for that - is there a way to sign the post within CONTROL script?

you can write a function that use openssl and base64.. you use 3.15?

I wrote a similar function already

[mhargreaves]

Yes - I use 3.15

[Gertjan van Schijndel]

For SHA-1 you could use the 'cryptoHash' function and for base64 you could use the 'base64Encode' function.

Signing your post does not provide any authorization or authentication. It only provides the ability to verify the data against the signature.
But it does not limit anyone from posting data or executing a successful replay attack.

[mhargreaves]

How would I sign the post in CONTROL Script?

At the moment I have tried using basic authentication and use:

netGet("https://mark-pc:9443/api/values", result,
makeMapping("headers", makeMapping("Authorization","Basic "+base64Encode("username:password"))));

[Gertjan van Schijndel]

Your example looks to be correct. What is wrong with it?

[mhargreaves]

Gertjan van Schijndel wrote:

Your example looks to be correct. What is wrong with it?

I was hoping to do it using something better than basic authentication, but couldn't work out how to do that.

[kilianvp]

its wrong! ":" is the seperator. The Server splits the String into 2 Parts. So base64Encode booth Username and Password and concatenate it with ":"


//Edit:

I made a quick nodejs http Server

Your example worked for me:

WCCOAui1:2017.11.30 10:34:18.998[mapping 5 items
WCCOAui1: "headers" : mapping 3 items
WCCOAui1: "Connection" : "keep-alive"
WCCOAui1: "Date" : "Thu, 30 Nov 2017 09:34:18 GMT"
WCCOAui1: "Content-Length" : "14"
WCCOAui1: "httpStatusCode" : 200
WCCOAui1: "content" : "Access granted"
WCCOAui1: "url" : "http://localhost:3000/"
WCCOAui1: "httpStatusText" : "OK"
WCCOAui1:]

[Gertjan van Schijndel]

It is correct! Yes, the server splits it into 2 part, but after decoding it. For an example of the authorization header, see Wikipedia.

Sorry, I do not have time to make free complete examples for everyone on the portal. Our consultancy department could help you with it.