Re: [rules-users] guvnor - role based auth enabled - cannot use backup URL anymore

The backup service is protected by role-based-authorization in Drools 5 Guvnor (it was unprotected in Drools 4). Guvnor is using session cookies to track user authentication. In theory we could use wget to login first, once we get the session cookies we can use this session to access the backup service. I.e., sth like below: 1. wget --save-cookies cookies.txt --keep-session-cookies --post-data="user=foo&password=bar" http://localhost:8080/drools-guvnor/org.drools.guvnor.Guvnor/Guvnor.html 2. wget --keep-session-cookies --load-cookies cookies.txt -O repository_export.zip http://localhost:8080/drools-guvnor/org.drools.guvnor.Guvnor/backup However this approach does not work in reality. Guvnor is based on GWT. The Guvnor login screen takes user name and password then calls the server side login method using GWT RPC. There is no such entry point in Guvnor that takes a HTTP POST request to login thus there is no way to get a session cookie. An alternative is to start a separate authentication in RepositoryBackupServlet. I am going to provide a fix on trunk using this approach. See https://jira.jboss.org/jira/browse/GUVNOR-496 for details. Cheers, Jervis Liu John Walker wrote: