JAS and Postman Client get an invalid headers 'location" during authentication sequence
We are trying to use the Postman client to authenticate to our JAZZ 7.0.2 installation configured with a JAS server.
The Postman client is configured with "Automatically follow redirects".
We use the authentication request : GET https://elm702:9643/jazzop/j_security_check?j_username=myUserid&j_password=myPwd
The Request Headers are :
Accept: text/html,application/xhtml+xml,application/xml
Cache-Control: no-cache
Accept-Encoding: gzip, deflate, br
User-Agent: PostmanRuntime/7.32.3
Postman-Token: b832af4d-679f-4d48-8fb8-566abe37666b
Host: elm702:9643
Connection: keep-alive
Cookie: jazzop_sso_cookie=ym31fvl3LF1ApzxjedjFQrva26RQrN1EPDoCFQ4V+lLjys9m972Py9O/1iMPHWWQP+IMDgnwOqqzjbITcQ5+jZtMX19pzywVAQ7AXdm+5nu+Mcf1HP9NW8wm1viZpcx32UmCSt /Agzg6bUHQilgn52IYH+zKrNTmaC36fLwqGWAAweljZroEYUZID43QEq4CmPhy4e90CqFjb0xxzl4803GD2HXiNb1+SD3OWmN/RZBL3Ecuiyw/+ibwDcGK8yPg60Ex9WoPNZ7KOvjbAHWafRCVSjm 5nJ8HaMMZNfWQ9y8zkit2LOXebjYjst2r78y
The first response is with a 302 return code with the Response Headers :
X-Powered-By: Servlet/3.0
Location: https://elm702:9643/jazzop/
Content-Language: en-US
Set-Cookie: jazzop_sso_cookie=C0KIEKXTM8iMMPaleXY//dDONwO821wX0QJmAn0Y0G9+YUVJ3aOJkkvgyJqwQvr8czkDKbupWZ7e91fLdY3gEw+Zye7C1NA+1OqtBWnGunYpXWNAJQmguLu3lrYGV/d2UEpxY /fVKZB+tzkIv9nDaq/SEX1GWh9XxcGLQthLvFqGWMMuP0A/woWTLZTn8qhIDGjENlTsit428mh8hS0DighlHcfSYehQu9mgKreCzLEjcqJ1YAVFtkPjhEtCpe9Xsf/1QJebm+4XIlk9m7z6+sYQqfIG oxVVYKwtRa7344sGqxQngvpG3c0pEVmhQqCS; Path=/; secure; HttpOnly
Set-Cookie: WASReqURL=""; Expires=Thu, 01 Dec 1994 16:00:00 GMT; Path=/; secure; HttpOnly
Transfer-Encoding: chunked
Date: Tue, 08 Aug 2023 16:33:09 GMT
Expires: Thu, 01 Dec 1994 16:00:00 GMT
Cache-Control: no-cache="set-cookie, set-cookie2"
Wanting to follow the value returned by the "Location" headers, the following request ends in failure with the return code 404
Accepted answer
You are not getting an invalid location header, you are sending an invalid request. The Jazz Server redirects you to the authentication method it supports. The request you send is for the form based authentication. If the server is configured for JAS, Form based authentication is not supported, hence the server redirects you to the authentication it supports.
One other answer
If you are using a JAS server, I would recommend you take a look at the OIDC based authentication - I wrote a blog post about it a while back - https://michaelrowe01.com/index.php/day-job/ibm-elm/api-authentication-method-in-elm-oidc/