When using Postman to connect and authenticate to the actual RESTful API service through Postman, I keep getting the same problem:
{ "Message": "An error has occurred.", "ExceptionMessage": "Object reference not set to an instance of an object.", "ExceptionType": "System.NullReferenceException", "StackTrace": " at Sitecore.Services.Infrastructure.Sitecore.Controllers.AuthenticationServiceApiController.Login(UserCredentials credentials) at lambda_method(Closure , Object , Object[] ) at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ActionExecutor.c__DisplayClass6_1.b__3(Object instance, Object[] methodParameters) at System.Web.Http.Controllers.ReflectedHttpActionDescriptor.ExecuteAsync(HttpControllerContext controllerContext, IDictionary`2 arguments, CancellationToken cancellationToken) --- End of stack trace from previous location where exception was thrown -- .......> }
With these details:
POST /sitecore/api/ssc/auth/login HTTP/1.1 Host: MY-HOST-ENVIRONMENT Content-Type: application/json User-Agent: PostmanRuntime/7.16.3 Accept: */* Cache-Control: no-cache Postman-Token: 1b4ffd83-f627-4955-852b-971d67c5fa72,fd32dcbe-c494-4c06-8db1-b7119005424d Accept-Encoding: gzip, deflate Content-Length: 87 Connection: keep-alive cache-control: no-cache { “domain”:”sitecore”, “username”:”admin”, “password”:”b” }
I haven't made any specific changes in the Sitecore.Services.Client.config
file of my instance and have tried the same on both a local and remote SC9.1 as well as an 8.2 version but in all instances I got the same problem.
Also, when changing the setting for:
<setting name="Sitecore.Services.AllowAnonymousUser" value="false" />
then I am able to execute the actual retrieval of an item's details with calls such as: /sitecore/API/ssc/item/{10083CA0-5093-4D67-99DB-2579ABB421D3}
I used these information sources:
- https://doc.sitecore.com/developers/90/sitecore-experience-management/en/sitecore-services-client.html
- https://therelentlessfrontend.com/2018/02/11/sitecore-postman-a-quick-starter-guide/
Additional question is on the information I found online concerning token based authorization, still somewhat unclear as to where this fits in to the entire story.