Web Script Authentication question

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

mangar

I am following Jeff Pott's intro to web scripts,  and I have a simple Java service that simply logs to the logfile whatever I put in a message parameter.  My descriptor looks like this:

<webscript>
    <shortname>Post Logging message</shortname>
    <description>Writes a message to the log.</description>
    <url>/someco/logging/log</url>
    <format default="json">extension</format>
    <authentication runas="admin">guest</authentication>
    <transaction>required</transaction>
</webscript>

Now when I call the endpoint I get a 401 not authorized.  If I add an authentication header,  it works fine.  I was under the impression that the authentication tag in the descriptor allows anonymous guest access.  Can someone explain this to me?

afaust

The value specified in the authentication section states that at least guest-level access is required, but that anonymous guest access still requires explicit login as the guest user. A fully anonymous access would be the `none` authentication.

Note that allowing unauthenticated or guest level access to your logs is a recipe for DDoS attacks. Make sure you properly restrict which clients / hosts can actually call this endpoint via your web proxy / application gateway.