How to use security in sync sd without gam?

Question

How to use security in SD synchronization without GAM? I need to block unwanted connections. How can I validate the execution of Synchronization.Send () and Synchronization.Receive () I can not use GAM because I have to adapt my application to a pre existing security system.

Answer 1

There is currently no way for sending additional parameters or HTTP headers in the requests, so you'll need other means to identify your user.

One thing you could do, is call a procedure before synchronizing, passing the relevant information to identify the user (an authorization token or something like that). Then, you should validate that the next call is to the synchronization process, and check for instance that the IP address and the "device id" are the same.

Where would you validate the user's information, depends on which synchronization are we talking about.

For the Receive operation, you may perform your validations in the Offline Database object's Start event.

For the Send operation, everything is saved to the database by using Business Components. So you may add your validations in all the BCs that are involved.

Note: having said all the above, it is highly recommended that you use GeneXus Access Manager (a.k.a. GAM), where all this is already solved.

Second note: you should use HTTPS in all your connections; otherwise, none of this will be secure.