Programmatically create a project area on RTC with curl

Kivanc Ahat (11●2●2) | asked Sep 22 '11, 4:09 a.m.

Hi,
I am using rtc 2.0.0.2 and i want to create a project area with curl commands but i get HTTP/1.1 403 Forbidden error.
On the other hand i succeed to add members to a rtc project area with curl.

My user has got "JazzAdmins" role.

Project area creation commands:(fail)
@echo off
curl -k -c cookies.txt https://<server>:<port>/jazz/authenticated/identity
curl -k -L -b cookies.txt -c cookies.txt -d j_username=user -d j_password=pass https://<server>:<port>/jazz/authenticated/j_security_check
curl -D - -k -b cookies.txt -H "Content-Type: application/xml" -X POST --data-binary @pa.xml https://<server>:<port>/jazz/process/project-areas

pa.xml:
Specified from "https://jazz.net/wiki/bin/view/Main/DraftTeamProcessRestApi#POST_project_areas_collection"

adding members to project area commands are: (succeed)

curl -k -c cookies.txt https://<server>:<port>/jazz/authenticated/identity
curl -k -L -b cookies.txt -c cookies.txt -d j_username=user -d j_password=pass https://<server>:<port>/jazz/authenticated/j_security_check
curl -D - -k -b cookies.txt -H "Content-Type: application/xml" -X POST --data-binary @member.xml https://<server>:<port>/jazz/process/project-areas/_Ssh3sCr5EeCeN45TDlZ_OA/members

and i got error message when creating project area is:

HTTP/1.1 403 Forbidden
Server: Apache-Coyote/1.1
Content-Type: text/html;charset=utf-8
Content-Length: 964
Date: Thu, 22 Sep 2011 07:51:35 GMT

<html><head><title>Apache Tomcat/5.5.28 - Error report</title><style><H1></style> </head><body><h1>HTTP Status 403 - </h1><HR><p><b>type</b> Status report</p><p><b>message</b> <u></u></p><p><b>description</b> <u>Access to the specified resource () has been forbidde
n.</u></p><HR><h3>Apache Tomcat/5.5.28</h3></body></h>

Also i read and tried "https://jazz.net/forums/viewtopic.php?p=59796&sid=bd0f0fe85a4950a4be1aa869e176d6b2" topic but it didn't help.

I really don't undstand the problem.
Please help..

5 answers

Most liked answers ↑|Newest answers|Oldest answers

permanent link

Kivanc Ahat (11●2●2) | answered Sep 28 '11, 4:08 a.m.

Hi,
We are using rtc 2.0.0.2 Standard Edition.
Mentioned difference between standard edition and enterprise edition is High Availability. What is the details of High Availability ?
Is that may be reason of 403 error message while posting project area collection ?

please help.

permanent link

Kevin Gu (171●3●1) | answered Sep 28 '11, 11:16 p.m.
JAZZ DEVELOPER

Hi,
We are using rtc 2.0.0.2 Standard Edition.
Mentioned difference between standard edition and enterprise edition is High Availability. What is the details of High Availability ?
Is that may be reason of 403 error message while posting project area collection ?

please help.

Hi kivancahat,

Have you tried to add specific headers in the post request, e.g.

Referer: https://<server>:<port>/jazz/admin
Host: <server>:<port>
Content-Length: <data_size>
Content-Type: application/xml;charset=UTF-8

Kevin
Jazz Foundation Process Team

permanent link

Kivanc Ahat (11●2●2) | answered Sep 29 '11, 8:32 a.m.

Hi mincer,
Unfortunatelly, that failed again.

I think, this problem is about the tomcat security constraint. I am not sure but i guess.

I have got security constraint like below: (jazz/web.xml)
<security>
<web>
<web>adminsecurepost</web>
<url>/_theming/*</url>
<http>POST</http>
</web>
<auth>
<role>JazzAdmins</role>
</auth>
<user>
<transport>CONFIDENTIAL</transport>
</user>
</security>

Should i add this ??

<web>
<web>adminsecurepost</web>
<url>/process/*</url>
<http>POST</http>
</web>

permanent link

Dancy Xia (116●3●2) | answered Oct 10 '11, 5:38 a.m.

Hi mincer,
Should i add this ??

<web>
<web>adminsecurepost</web>
<url>/process/*</url>
<http>POST</http>
</web>

I don't think it is about the security configuration on Tomcat. You've succeeded in adding members. I feel it maybe about the problem of the cookie data.

How about you try request like this?
set headers:
Referer=https://<host>:9443/jazz/admin
Cookie=JSESSIONID=1oviuaxpzdvsgq215vl23qfpf; JazzFormAuth=Form; net-jazz-ajax-cookie-rememberUserId=
Content-Type=application/xml; charset=utf-8

set body like this:

&lt;?xml version="1.0" encoding="UTF-8"?&gt;
&lt;jp06:project-area xmlns:jp06="http://jazz.net/xmlns/prod/jazz/process/0.6/" jp06:name="PA8" jp06:templateId="com.ibm.team.process.example.process"&gt;
&lt;/jp06:project-area&gt;

I tried with REST client with above data and get the correct 201 response(please make sure to replace &lt; and &gt; with the correct tag, and use the correct templateId)

Dancy

Jazz Foundation Process Team

permanent link

Martha (Ruby) Andrews (3.0k●4●43●51) | answered May 19 '15, 8:57 p.m.
JAZZ DEVELOPER

The key here is to pass in a header that tells Jazz (CLM) that the request is not a CSRF attack. The name of the header is "X-Jazz-CSRF-Prevent" and the value is the JSESSIONID for the current session. You can get the JSESSIONID from the cookies.txt file, if you are willing to do some text manipulation.

Here is the snippet that worked for me:

curl -k -c %COOKIES% -sslv3 "%HOST%/authenticated/identity"

rem log in and save the JSESSIONID to use as X-Jazz-CSRF-Prevent header 
curl  -k -L -b %COOKIES% -c %COOKIES% -d j_username=%USER% -d j_password=%PASSWORD% -sslv3 "%HOST%/authenticated/j_security_check" 
grep "JSESSION" %COOKIES% > %TEMP_JSESSION%
for /F "tokens=7" %%G in (%TEMP_JSESSION%) do set JSESSIONID=%%G

curl -k -b %COOKIES% -H "Content-Type: application/xml" -H "X-Jazz-CSRF-Prevent: %JSESSIONID%" -X POST -d @project_area_xml_jazz.txt -sslv3 "%PROJECT_AREAS_URL%

Hope that helps,
Ruby
Martha (Ruby) Andrews
Jazz Foundation L3 Development Team Lead

Your answer

Register or log in to post your answer.

Dashboards and work items are no longer publicly available, so some links may be invalid. We now provide similar information through other means. Learn more here.

It's all about the answers!

Related questions

Programmatically create a project area on RTC with curl

5 answers

Your answer