integrator/user/login/1

This guide explains how to use the integrator/user/login/1 Webapi2 method to log in as a user on behalf of an integrator and obtain a login session webtoken.

• Overview
• Prerequisites
• Arguments
• Result
• Constructing the Request
• Example

Overview

The integrator/user/login/1 webapi allows an integrator to log in as a specific user and retrieve a login session webtoken (sid). This session ID can then be used to interact with the hosted ISL Online service on behalf of that user, for example to start sessions, search ISL AlwaysOn computers, or retrieve session history.

This Webapi2 call is part of the integrator module, therefore the request must be in {"jwt":"..."} format.

Note: This guide is specifically for use with the Integrator API on Hosted Service. If you have not yet set up Integrator API access, please follow the Setup access to Integrator API guide first.

Prerequisites

This method can be called for the main account on your hosted service.
Ensure you have the following before proceeding:

• Your Integrator ID, obtained from the setup wizard.
• Your Integrator Private Key, generated by yourself during setup.
• The User Private Key, obtained from the setup wizard.

Arguments

The JWT payload data (isldata) for this method accepts the following optional argument:

An empty JSON object is valid when no overrides are needed:

{}

Result

Success

On success, the response contains a sid (session ID) and the detected or assigned language code.

{
  "data": {
    "lang": "en",
    "sid": "2_3zXFRu7QogWvmA6MS3Bub...dddLJH8kj99jJK"
  },
  "result": {
    "code": "OK",
    "hs": "<webtoken>",
    "server": <server_id>
  }
}

Failed

On failure, no data object is returned. The result object contains the error details.

{
  "result": {
    "args": {...},
    "code": "USER_ERROR|IMPLEMENTATION_ERROR|INTERNAL_ERROR",
    "description": "<description>",
    "errors": {[<errors>]},
    "hs": "<webtoken>",
    "server": <server_id>
  }
}

Note: It's common to receive IMPLEMENTATION_ERROR: failed to parse webapi2 JSON request. You should check the following common causes:

• Incorrect Key ID (islkid)
• JWT signing error (wrong private key or encryption used)
• Incorrect current timestamp (iat)
• User specified does not have the correct permissions (is not the main account)

ISL Online support can check for a more specific error if you're still having issues.

Constructing the Request

This method requires a double-signed JWT: an inner JWT signed with the User Private Key, wrapped inside an outer JWT signed with the Integrator Private Key. This two-layer structure verifies both the integrator identity and that the integrator is authorized to act on behalf of the user.

Both JWTs share the same iat timestamp and islhsig value.

Step 1 - Build the inner JWT (signed with the User Private Key)

The isldata for the inner token is the method data as a JSON string. For this method, an empty JSON object is used unless you are overriding the timezone:

{
  "iat": <current_unix_timestamp>,
  "islkid": "\\\\<domain>\\<username>",
  "islhsig": "<sha256(integrator/user/login/1|)>",
  "isldata": "{}"
}

The islkid field must be the full username of the account you are logging in as, in \\domain\username format (e.g. \\Domain1\User1).

The islhsig is the SHA-256 hash of the method name and an empty webtoken string, joined by |:

sha256("integrator/user/login/1|")

Sign this payload using the User Private Key with algorithm PS256. The result is a standard JWT string. Serialize it into a JSON wrapper:

{"jwt":"<signed_inner_jwt>"}

Step 2 - Wrap and sign with the Integrator Private Key

The isldata of the outer JWT is the complete inner {"jwt":"..."} JSON string from Step 1. Build the outer JWT claims using the same iat and islhsig values:

{
  "iat": <current_unix_timestamp>,
  "islkid": "<integrator_key_id>",
  "islhsig": "<sha256(integrator/user/login/1|)>",
  "isldata": "{\"jwt\":\"<signed_inner_jwt>\"}"
}

Sign this outer payload using the Integrator Private Key with algorithm PS256.

Step 3 - Send the request

POST the outer JWT to the hosted service webapi endpoint:

curl 'https://islonline.net/webapi2?method=integrator/user/login/1&he=JSON1&heo=JSON1' \
  --header "Content-Type: application/json" \
  --request POST \
  --data '{"jwt":"<outer_jwt_token>"}'

Note: The iat (issued at) timestamp must be within 60 seconds of the server current time.

Example

A working Golang example is available at https://kfr.islonline.com/i1qojz6u | password: 807538

The example demonstrates a complete call to integrator/user/login/1, including double-JWT construction using both private keys. Before running it, update the following constants in main.go:

Run the example with:

go run .

On success, the session ID is printed to the console:

Login successful. Session ID: 2_3zXFRu7QogWvmA6MS3Bub…