AIS Authentication Types

      The AIS Server uses EnterpriseOne authentication to authenticate AIS clients. All AIS sessions are established with requests to the EnterpriseOne HTML Server to establish a corresponding HTML Server (JAS) session. 
       
        The AIS Server can maintain open sessions linked to open JAS sessions. It can also execute stateless calls where sessions are temporarily established only for the time of the call and thereafter terminated. See "Session Management" below for more information.

       You can configure the AIS Server to use SSL so that all communication is over HTTPS. It can also be configured to communicate over HTTPS with the EnterpriseOne HTML Server.

     You must make sure that the type of authentication (or login type) used by the AIS client is enabled in the Application Interface Services Security Settings section in Server Manager. 

The following are the supported authentication types.

Username and Password
This type of authentication is used in JD Edwards EnterpriseOne mobile enterprise applications for authentication. It involves passing the username and password in the body of the request JSON, for example:

            {
                "username":"JDE",
                "password":"JDE"
            }
            

HTTP Basic Authentication
This type of authentication is used for authenticating Internet of Things (IoT) devices calling orchestrations on the AIS Server. It is also used by the EnterpriseOne Orchestrator Client to test running orchestrations on the AIS Server. It involves passing the username and password in the basic authorization header, for example:

Authorization: Basic QWxhZGRpbjpPcGVuU2VzYW1l

PS Token
This type of authentication is used in EnterpriseOne ADF applications. It is also used by EnterpriseOne Pages designed to call AIS services through the e1pagehelper.js API. It involves passing the username and psToken in the body, for example:

        {
            "psToken": "pgAAAAQDAgEBAAAAvAIAAAAAAAAsAAAABABTaGRyAk4AcQg4AC4A

MQAwABQJrwo/Lw6l8FT3c1jCCRFRdRTiVmYAAAAFAFNkYXRhWnicHYhBDkAwEEVfqysH

sHaBSjUlLInGpsHG2hncz+FMZpL/3p//Aq6yxog/i159sXBTOHGZluZh12+VvXBI28ikSKBnx

Ku9JConOmmDcGAWBnHQPcEPnWgLvQ==",
            "username": "JDE"
        }
        

JSON Web Token
This authentication method can be used in a JD Edwards EnterpriseOne mobile application integration with Oracle Mobile Cloud Service. You can also use this login type to employ OAuth 2.0 authentication for third-party AIS clients, including clients developed using the AIS Client Java API to call AIS services and orchestrations on the AIS Server.
Note: You can use OAuth 2.0 if you have an EnterpriseOne configuration with Oracle Access Manager (OAM), where OAM is the OAuth provider.
This authentication method involves passing a JWT in the Bearer Header, for example:

Authorization: Bearer eyJ4NXQiOiJkUHFHSDRadktiUUNRTExqTXRTVkRSc3hYSjAiLCJ0eXAiOiJKV1QiLCJhbGci...

Using JWT for authentication requires a trusted node configuration and an EnterpriseOne HTML Server trusted certificate configuration. 

Session Management

     After a token request is sent to the AIS Server with successful authentication, the AIS Server generates a token and maintains a session for the user session according to the time out and time-to-live settings in Server Manager (rest.ini). A corresponding user session is also maintained on the EnterpriseOne HTML Server. You can view the AIS sessions in Server Manager, which displays "AIS Server" in the Display Mode for active AIS sessions. The AIS token is the key to the user session and must be passed on all subsequent calls that use that AIS session.
     For stateless AIS requests, credentials are supplied (not AIS tokens). Requests are given a temporary session that is removed once that request completes.
The original security model put in place for mobile applications still applies, even for non-mobile clients. The deviceName (or Device ID) is not required. If Device ID is not passed, the requesting IP address is used. Thus a token requested from one device or IP address cannot be used by another device or IP address. Validation is performed every time the token is used.

source: Oracle Documentation