Authentication and Automation APIs

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

franck102_

I am a bit confused about how authentication works with the Java automation APIs. I would like to use a shared secret between the client and the server, and to use impersonation when a client request comes in to switch the the requesting user's security context. I also need to authenticate the user. Roughly I am trying something along those lines:

// client init
session = client.getSession("Administrator", "Administrator"); // will replace with shared secret

// request comes in from user Bob
session.verifyCredentials("bob", bob's password) // how do I do this??
session.newRequest("Auth.LoginAs").set("name", "bob");
session.do_some_stuff()
session.newRequest("Auth.Logout");

I have two issues:

1. How can I validate Bob's credentials (without starting a new session, which is too slow)?
2. after Auth.LoginAs, I can still successfully use the session to readDocument for which Bob has been denied the READ permission - is LoginAs really impersonating the user?

Thanks!

franck102_

Looking into the source code it seems that LoginAs would work only if I chain it with my "do_some_stuff" on the server side... however that doesn't work well for me, I would need to define automation chains for every operation I ever want to use.