looking for a way to authenticate a ThingWorx user through a REST API.

Wouldn't be possible OOTB, you may look into custom authenticators.

Refer to this chapter for the information on authenticator sample extension configuration:

Digital Media Publisher

Yeah, a custom authenticator would do it. Here is a KCS Article on the subject. The authenticate method would not need to be complicated, just something like:

  String username = httpRequest.getHeader("Username");

  String password =  httpRequest.getHeader("Password");

  if(username.isEmpty() || password.isEmpty())

     throw new AuthenticatorException("User login info is empty in CustomAuth");

  try {

       // Checks that user exists and is enabled; throws exception if can't validate

       AuthenticationUtilities.validateEnabledThingworxUser(username);

       // Tells rest of ThingWorx which user is logged in for purposes of permissions, etc.

      this.setCredentials(username);

  } catch(Exception e) {

        //TODO implement logging

  }

So if you sent a request with a header that contained Username and Password, just like how you include content-type, etc., then, this would log that user in if it could.

Hello,

If you're using a REST API there is OOTB possibility to authenticate request with the Header, no need in preparing own, custom Authenticator.

You just need to pass a Header: Userid and Password.

Regards,

Jakub.

Rdhakrishnan, if you want to pass in your username and password, you can use something like this (with x-session for the session to persist)-

localhost/Thingworx/Things?userid=Administrator&password=admin&x-thingworx-session=true

With that being said, is there a specific reason why you would want to send your username/ password instead of using the appKey to authenticate?