Catalog Credentials in Rule Execution Service REST request

Prior to 5.7.3, catalog credentials were expected to be in the request sent to Rule Execution Service (RES) via the REST endpoint. As of 5.7.3, this was disallowed by default, and catalog credentials were not accepted on RES REST requests unless explicitly enabled. Instead, username and password should be added to a config to avoid having to send them in the request.

note

As of 5.8.1, the default for on-premises installations has changed: allowPerRequestCatalogCredentials now defaults to true. We recommend manually setting it to false. See "On prem: Set default for all per request catalog credentials" in the InRule Decisioning Version 5.8.1 Release Notes.

This can be configured by editing the web.config for the service if its IIS hosted or by editing the app.config if you are windows hosted. It can be configured in the following settings:

<inrule.runtime.service>

    <catalog catalogServiceUri="http://localhost/InRuleCatalogService/Service.svc" userName="admin" password="password" allowPerRequestCatalogCredentials="true" />

    <!-- specify userName / password to utilize no-credentials client auth. -->

    <restRuleApplication path="RuleApps" />

    <!-- Absolute path to ruleapps -->

    <messagingLimits maxItemsInObjectGraph="2147483647" />

</inrule.runtime.service>

or by adding the following to appSettings

<add key="inrule:runtime:service:catalog:allowPerRequestCatalogCredentials" value="true" />

As of 5.8.1, the default value for allowPerRequestCatalogCredentials on on-premises installations is true, meaning the RES REST call accepts catalog credentials on requests unless this is manually set to false. We recommend setting it to false.