Using Orbeon Forms "List Forms Attachments" API

Question

We have the requirement to fetch an attachment to an Orbeon form from a simple automation script. We found the "List Forms Attachments" API (https://doc.orbeon.com/form-runner/api/persistence/list-form-data-attachments.html) and are trying to call it using a simple "curl" script that runs on the same host as the Orbeon Tomcat instance:

curl -v "http://localhost:8080/orbeon/fr/service/$app/$form/attachments?document=$docid"

This returns an HTTP 403 (Forbidden), and even after reading whatever doc we can find on Orbeon security, we're still scratching our heads over how to configure Orbeon. Is there a simple configuration example showing an Orbeon configuration that would allow the API to be called from a local script like ours? We are running Orbeon CE 2017.1.

If getting this API to work is an ordeal, the other option we'd consider would be a database solution. We have Orbeon running on a MySQL persistence layer, and the same script we're using also has access to this database. Is there an easy way to take a submitted form's XML and fetch the attachment for a given form field?

We see in the submitted form's XML that the attachment tag looks like this:

<File1 filename="Original Filename.doc" mediatype="application/msword" size="14236">
    file:/tmp/tomcat7-tomcat7-tmp/xforms_upload_7266596219758922423.tmp?filename=Original+Filename+doc&amp;mediatype=application%2Fmsword&amp;size=14236&amp;mac=fc2febb1227e93643a048fbb02abc16bba346531
</File1>

When we scan the orbeon_form_data_attach database table, we see a row with the file content we expect, but the file_name column doesn't match the file information in the form's XML above...in this example, the file_name on the database is 1af8cd16367470362e13f77e679c0ae590e1f4a5.bin. Some of our forms have multiple attachments, and there doesn't seem to be a direct way to go from the form XML to the file_name in the database table.

Either of these solutions would be fine for us - we just need a way to get the attachments for a form from a simple script.

ebruchez ebruchez · Accepted Answer · 2017-11-30T18:38:34

For reference, the relevant documentation is Authorization of Pages and Services.

You can, although this is not to be done for production but only testing and development, open all services without authentication. See this section. Otherwise, you need to setup an authorization service.

Using Orbeon Forms "List Forms Attachments" API

1 Answers