How to authenticate remote user using Modx RESTful server api?

Some background:
I'm building a Job Bid/Estimate app using HTML5 + Cordova + jQuery app for android and iOS (For the App I'll be using Intel XDK to compile and do it's thing.). I want to use Modx as the back end server syncing up data from the app. The app will use native db and will work offline. However, based on user preferences, I would like to sync up data from the app tables, images/files, etc. to the modx install (EC2). I will be in real-time or they can manually "sync". The user should only see objects that he/she has created or are allowed to view by all. The functionality online (modx install) will be the same as the app (maybe a few more extras like exporting data). The Online version is not a problem, because the user is logged in and has a session on the domain. The remote app is the problem...

Research:

1. I developed the restful server using info here: https://rtfm.modx.com/revolution/2.x/developing-in-modx/advanced-development/developing-rest-servers and is working by using POST/GET/PUT/DELETE, etc.for objects. also, used this info https://gist.github.com/splittingred/2346752
2. I have looked into Token based authentication, but cannot wrap my head around integrating it with Modx.


3. I don't want the user to enter their username and password every time they sync up.

Server Setup:

• Modx 2.4.0 (can switch to 2.3 if needed)
• Amazon EC2
• LAMP
• MySQL 5.5
• PHP 5.5.9

The Questions:

1. How can I register a user directly from the app to create a user with proper permissions and user attributes?
2. How can I authenticate the user per transaction (or when they manually sync up)?
3. Can/should this be done with a Token based authentication? user posts their credentials via SSL to modx install server (http://mydomain.com/rest/auth. Server confirms and returns token. I can store that token on the app, but on my next call to sync, how can I truly authenticate the user simply based on the token (with proper resource groups/ACL's/permissions)? Can I user data from the modx_session table and join it to the token?
4. Any best practices for syncing objects from apps per record (maybe using timestamps)?

Any advice or best practices would be greatly appreciated. I'm even ok with a scolding if that's what's needed.

So after a little more research on rest I decided to use JSON Web Tokens (JWT). Will report back as I get further into the development on how to use the rest server.

What did you end up using? We're currently facing the same challenge and I'd really like to know how you approached this.

Quote from: dev7apps at Sep 04, 2015, 12:04 AM

So after a little more research on rest I decided to use JSON Web Tokens (JWT). Will report back as I get further into the development on how to use the rest server.

Did you get anywhere with this? Looking into doing the same in an ionic 2 / Angular app

Quote from: jonhorner at Aug 09, 2016, 08:00 AM

Quote from: dev7apps at Sep 04, 2015, 12:04 AM

So after a little more research on rest I decided to use JSON Web Tokens (JWT). Will report back as I get further into the development on how to use the rest server.

Did you get anywhere with this? Looking into doing the same in an ionic 2 / Angular app

Have you look at HTTP_MODAUTH?

https://rtfm.modx.com/revolution/2.x/developing-in-modx/advanced-development/validating-requests-tokens-and-nonces?

I'm about to delve into this alongside Gitify for our angular apps but also as an app framework.

The example her is kind of backwards from what you're doing, but I think it may help. It describes how to bypass the standard Login process and still log the user in.

I think you could just make the login form invisible, use $_POST data to authenticate the user, and then have them logged in automatically:

http://bobsguides.com/blog.html/2016/04/06/bypassing-the-modx-manager-login-i/

Note that it usually doesn't work to redirect user in a login plugin. You have to use the &loginResourceId property (and, optionally, &loginResourceParams) to redirect all users to some page. You can forward them from there to wherever you want with a snippet using $modx->sendRedirect().

This might also be helpful. It's about NewsPublisher, but it describes a method for telling whether a page was created by the user and redirecting them if not: http://bobsguides.com/blog.html/2013/04/28/newspublisherrestricting-users-to-their-own-pages/

Quote from: dev7apps at Sep 03, 2015, 07:04 PM

So after a little more research on rest I decided to use JSON Web Tokens (JWT). Will report back as I get further into the development on how to use the rest server.

I am also looking for something like this. Any update?