lumnik. / scenarios All scenarios · Français

An old app behind a login: lumnik logs in like a user

Goal Read the vets of Spring PetClinic, protected by the Tomcat server's login, without touching the app.

Spring PetClinic from before Spring Boot, behind the server's login (j_security_check). No API token: a form and a session cookie.

manifests/lab-docker-compose.yml
# The clinic's application: Spring PetClinic of before Spring Boot, a WAR on Tomcat 11, behind the container's FORM login.name: lumnik-legacy-sessionservices:  petclinic:    build: ../run/petclinic    environment:      # Tomcat reads ${...} in its configuration from system properties.      JAVA_OPTS: -DCLINIC_PASSWORD=${CLINIC_PASSWORD:-clinic-lab-password}    ports: ["127.0.0.1:${PETCLINIC_PORT:-9310}:8080"]   # this machine only
manifests/10-vets-no-auth.yaml
apiVersion: connectors.lumnik.io/v1kind: Connectormetadata:  name: scenario-legacy-session-a  connector_type: rest-generic  scopes: [clinic]spec:  base_url: http://host.docker.internal:9310/petclinic  endpoints:    - id: vets      path: /vets.json      method: GET      pagination: { kind: none, response_path: $.vetList }      target:        kind: hybrid        table: ext.scenario_legacy_session_a        unique_key: $.id        promote:          - { name: first_name, path: $.firstName, type: text }          - { name: last_name, path: $.lastName, type: text }
manifests/20-vets-session.yaml
apiVersion: connectors.lumnik.io/v1kind: Connectormetadata:  name: scenario-legacy-session-a  connector_type: rest-generic  scopes: [clinic]spec:  base_url: http://host.docker.internal:9310/petclinic  auth:    kind: session                                       # the container's form login, the session cookie kept    login_url: http://host.docker.internal:9310/petclinic/j_security_check    prime_url: http://host.docker.internal:9310/petclinic/vets.json    username: lumnik    password_env: SCENARIO_CLINIC_A_PASSWORD    username_field: j_username    password_field: j_password  endpoints:    - id: vets      path: /vets.json      method: GET      pagination: { kind: none, response_path: $.vetList }      target:        kind: hybrid        table: ext.scenario_legacy_session_a        unique_key: $.id        promote:          - { name: first_name, path: $.firstName, type: text }          - { name: last_name, path: $.lastName, type: text }
$ lm connector run scenario-legacy-session-a
run scheduled: 45908ea8-e37c-4e46-920f-2a658563c1be

$ lm run get 45908ea8-e37c-4e46-920f-2a658563c1be
ID        CONNECTOR                  ENDPOINT  STATUS     IN  OUT  SKIPPED  DEAD-LETTERS  STARTED           ENDED             EVALUATED
45908ea8  scenario-legacy-session-a  vets      Completed  6   6    0        0             2026-11-02 21:11  2026-11-02 21:11  yes
$ lm connector run scenario-legacy-session-a
run scheduled: ef5e983b-312f-4889-b17f-ddd2218a9379

$ lm run get ef5e983b-312f-4889-b17f-ddd2218a9379
ID        CONNECTOR                  ENDPOINT  STATUS     IN  OUT  SKIPPED  DEAD-LETTERS  STARTED           ENDED             EVALUATED
ef5e983b  scenario-legacy-session-a  vets      Completed  6   6    0        0             2026-11-02 21:11  2026-11-02 21:11  yes

Limits

  • A plain form: no JavaScript login, no second factor, no SAML or CAS.
  • The cookie only goes to the login's origin: an endpoint on another host is refused.
  • PetClinic's demo data: 6 vets; a throwaway password, drawn at each replay.

Clinic · vets

The clinic's old app asks for a login.

Its vets must be read, every night.

Spring PetClinic behind Tomcat's login

The problem

No API token.

  • A form, a password.
  • Then a session cookie.

What is not changed

The app stays as it is.

  • The login is the server's.
  • The account is a clinic account.

Without auth

The server answers its login page.

  • With 200, in HTML.
  • The hub refuses it: it is not data.

What had to be written

auth: { kind: session }

The hub logs in like a user.

  • 6 vets.
  • A 30-line connector.

The restart

The app restarts, the session is lost.

  • The hub logs in again on its own, once.
  • The run reads the 6 vets.

The limit

A plain form.

  • No JavaScript login.
  • No second factor.

Try it

The scenario replays locally.

Every step is published with its output.

This scenario runs on lumnik Open, free and open source.

Try lumnik Open →