401 Unauthorized response through API

The "Windows Authentication" is done by the IIS underneath. And to do so you need to specify the windows credentials in your PowerShell call (Invoke-restmethod).

A quick Google search gave me this.

To authenticate with Windows Authentication, you can use the -UseDefaultCredentials parameter of Invoke-RestMethod and Invoke-WebRequest . This will perform negotiate authentication whether you are running inside IIS or a service.

https://docs.powershelluniversal.com/api/security

Hi Markus,

Thanks for you response. Now with the parameter "-UseDefaultCredentials" I can authenticate the user used into the PowerShell script if I run the script from the same machine where the AppServer is located.

But if I use the same script from another machine it gives to me the same "401 Unauthorized" error. This is strange because if i try to log from the machine where i receive the error with the same script's user through the AppServer Web Portal I can log in. It seems not to be a network error.

You can try to explicitly provide your credentials using the -Credential parameter like this.

$Cred = Get-Credential

Invoke-RestMethod -Credential $Cred .......

In addition, did you check the log of the application server?

In addition, did you check the log of the application server?

Hi Markus,

I've resolved the issue adding an extra API before the code that I've reported above. So my code now is:

$Cred = Get-Credential
$url1='http://[IPAppServer]'
$url3='http://[IPAppServer]/AppServer/auth/apphost'

$LoginRequest1 = Invoke-RestMethod -Uri $url1 -Credential $Cred -SessionVariable session1

$bi3=@{
"authString"="Module=RoleBasedManualADS;User=****;Password=****"

}
$authJson = ConvertTo-Json $bi3 -Depth 2
$LoginRequest3 = Invoke-RestMethod -Uri $url3 -Body $authJson.ToString() -Method POST  -WebSession $session1

With this code I can log in and I can do API. I've learned that $LoginRequest1 send the request to the AppServer machine and save to session in $session1. Using $session1 I can log in into OIM AppServer with LoginRequest3.

I think that this is done because the Anonymous Authentication is disabled and so I must authenticate before. But what changes for the fat client connections and web connections if I enable the Anonymous Authentication? Is it a best practice to disable the Anonymous Authentication?

Thanks for your help.