# phpGroupWare XML-RPC/SOAP Methodology

###

# System level requests

## Login and authentication

Authentication for user logins is handled internally no differently than for the typical phpGroupWare login via web browser. Server logins, added for XML-RPC and SOAP, are only slightly different. For either protocol, user and server login and authentication and subsequent requests are handled by their respective server apps, xmlrpc.php and soap.php. A server is identified by a custom HTTP header, without which a normal user login will be undertaken.

A client or server sends the appropriate XML-RPC or SOAP packet containing host, user, and password information to the phpgw server. The server then assigns a sessionid and key, which is returned to the client in the appropriate format.

Our current method for authenticating requests after successful login is via the Authorization: Basic HTTP header to be sent by the client or requesting server. The format of this header is a base64 encoding of the assigned sessionid and kp3 variables, seperated by a ':'.

Further security may be obtained by using SSL on the client and server. In the future, we may encrypt/descrypt the data on either end, or at least provide this as an option. The sessionid and key variables will make this possible, and relatively secure.

### system.login

The first request a client will make is the system.login method. Here is a sample of a server login packet in XML-RPC:

    <?xml version="1.0"?>
    <methodCall>
    <methodName>system.login</methodName>
    <params>
    <param>
    <value><struct>
    <member><name>server_name</name>
    <value><string>my.host.name</string></value>
    </member>
    <member><name>username</name>
    <value><string>bubba</string></value>
    </member>
    <member><name>password</name>
    <value><string>gump</string></value>
    </member> </struct></value>
    </param>
    </params>
    </methodCall>

And the same in SOAP:

    <?xml version="1.0"?>
    <SOAP-ENV:Envelope
    xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/1999/XMLSchema-instance" xmlns:xsd="http://www.w3.org/1999/XMLSchema" xmlns:SOAP-ENC="http://schemas.xmlsoap.org/soap/encoding/" xmlns:si="http://soapinterop.org/xsd"
    xmlns:ns6="http://soapinterop.org" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
    <SOAP-ENV:Body> <ns6:system_login>
    <server_name xsi:type=":string">my.host.name</server_name>
    <username xsi:type=":string">bubba</username>
    <password xsi:type=":string">gump</password>
    </ns6:system_login>
    </SOAP-ENV:Body>
    </SOAP-ENV:Envelope>

The same style of packet would be required for a user/client login. A successful login should yield the following reply:

    <methodResponse>
    <params>
    <param>
    <value><struct>
    <member><name>sessionid</name>
    <value><string>cf5c5534307562fc57915608377db007</string></value>
    </member>
    <member><name>kp3</name>
    <value><string>2fe54daa11c8d52116788aa3f93cb70e</string></value>
    </member>
    </struct></value>
    </param>
    </params>
    </methodResponse>

And a failed login:

    <methodResponse>
    <params>
    <param>
    <value><struct>
    <member><name>GOAWAY</name>
    <value><string>XOXO</string></value>
    </member>
    </struct></value>
    </param>
    </params>
    </methodResponse>

eqweqw

### system.logout

Logout:

    <?xml version="1.0"?>
    <methodCall>
    <methodName>system.logout</methodName>
    <params> <param>
    <value><struct>
    <member><name>sessionid</name>
    <value><string>ea35cac53d2c12bd05caecd97304478a</string></value>
    </member>
    <member><name>kp3</name>
    <value><string>4f2b256e0da4e7cbbebaac9f1fc8ca4a</string></value>
    </member>
    </struct></value>
    </param>
    </params>
    </methodCall>

Logout worked:

    <methodResponse>
    <params>
    <param>
    <value><struct>
    <member><name>GOODBYE</name>
    <value><string>XOXO</string></value>
    </member>
    </struct></value>
    </param>
    </params>
    </methodResponse>

|  | Next
|  | Business layer requests