Here is Support:
Re: Reference Number: 17127682 : WebEA: 400 Request does not contain User ID
Unfortunately there is not currently any workaround to login to a security enabled model in WebEA without entering an ID/Password. Currently you will need to use login_prompt = "true" and enter credentials to log in.
Please also note, WebEA does not support automatic login using Windows Authentication. When functioning as intended, the only way to login (to a Security enabled model) in WebEA without a User/Password prompt is to use...
From this it seems that Active Directory Security MUST be switched off....
Well, not quite I think. It doesn't say that Windows authentication must be disabled in order to allow WebEA users access to a project, only that WebEA can't utilize Windows authentication. The way I read it, it should still be possible for regular EA users to use Windows authentication.
Thinking further, you could always set up the WebEA site to allow access only to members of certain AD groups. That's just a web server config. However, this would only ensure that the WebEA
site is restricted to authenticated users: the WebEA
service would still be wide open to anyone who can guess a password.
Possibly the service could be secured by a firewall rule requiring an authenticated connection, listing the permitted AD groups in the rule.
If that works, the problem of restricting access to properly authenticated users can be solved. But WebEA users would still need to identify themselves with user ID / password upon connecting.
Assuming I'm reading Sparx' response to you correctly, that only leaves the question of whether users connecting using the EA client and Windows authentication can coexist with users connecting via WebEA and user ID / password. Ie, two authentication schemes in one project.
And it imposes the restriction that users must be placed in one or the other group. They can't connect with the EA client one day and WebEA the next. (Unless the password hash that's stored in the project can be reversed. What the hell is that thing, anyway?)
It really would help if Sparx could provide some feedback on this. There are just too many ifs and buts and ginormous gaps in the documentation.
/Uffe
