Wednesday, August 15, 2007

Capturing the Session ID

I'm out here in Boston visiting the PIH offices and meeting all of the OpenMRS guys from the Boston and Indianapolis offices (more on that later).

Burke and I have been trying to figure out why the forms in OpenOffice.org aren't actually HTTP POSTing the XML data to the OpenMRS server. After scratching our heads and checking the server logs, he suggested I use tcpmon to capture the data from OpenOffice to see what was going wrong.

tcpmon is pretty cool. It works by creating a sort of proxy between your localhost and another server. You give tcpmon a local port and a server and port to connect to, and it relays all of the information sent to localhost:port to server:port, capturing all of the data in between. I tried it out with my OpenMRS installation at home, and here's the result of submitting a form:
HTTP/1.1 302 Moved Temporarily
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=AFD3B8B163899870591929C471BEE8B7; Path=/openmrs
Location: http://localhost:8084/openmrs/logout
Content-Length: 0
Date: Wed, 15 Aug 2007 13:46:45 GMT

HTTP/1.1 405 HTTP method POST is not supported by this URL
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=104147D9161F0663F217CC856D2056FE; Path=/openmrs
Content-Type: text/html;charset=utf-8
Content-Length: 1115
Date: Wed, 15 Aug 2007 13:46:45 GMT

HTTP Status 405 - HTTP method POST is not supported by this URL


type Status report

message HTTP method POST is not supported by this URL

description The specified HTTP method is not allowed for the requested resource (HTTP method POST is not supported by this URL).


Apache Tomcat/6.0.13




This seems to indicate that there's a problem with authentication. I'm given a JSESSIONID and immediately sent to the logout page. I'm also given an HTTP error 405.
The forms in InfoPath use the taskpane combined with some JavaScript trickery to capture the JSESSIONID for an authenticated session so the form is free to communicate with the server and the server thinks this is just a regular Internet Explorer session. I'm thinking that if I can somehow capture this JSESSIONID in OpenOffice, I can use it the same way that InfoPath does. How I'm going to do this, I don't know. It may finally be time to crack into my Macro book and see if I can do some similar HTTP trickery. When I return home and have access to InfoPath, I'll sic tcpmon on it and see what's happening.

3 comments:

Ben Wolfe said...

A little jumpstart on the workflow for you:
The sessionid is pumped into the schema each time its downloaded. As soon as Infopath starts, the taskpane loads and then does a javascript post to the server using that jsessionid. I believe that is the trickery that authenticates both the taskpane (which is just IE) in Infopath and also all of Infopath for its use when it posts to the POST url.

Anonymous said...

Hello, Matthew (and Ben.)

I was taking a look at your "Creating Forms in OpenOffice" page on the wiki, as I don't think I'll have access to a late enough version of InfoPath for my pilot here in Goma, Congo.

I noticed that it was incomplete and followed the page history here. Question: What are my chances of being able to use OpenOffice to get up and running? Your last few posts imply that OpenOffice isn't ready.

If you think it's still possible to do, I'm willing to help write up the docs. All I need is guidance on where to go after the wiki page leaves off...

Matthew Harrison said...

Hello. OOo is ready to go for XForms design, but this issue with the session ID makes it not quite ready for deployment. The wiki instructions are indeed incomplete, and I plan to complete them in the near future once submission is working. Of course, any feedback you may have regarding OOo is most welcome.