Pro2 uses Spring Security FORM-based authentication with the Extended Local (extlocal) authentication manager to secure all REST, Web, and APSV endpoints. You must authenticate with valid credentials before accessing Pro2 resources. Pro2 introduces enhanced security through server-side authentication that:

  • Requires valid credentials for all REST API, Web, and APSV transport endpoints.

  • Uses form-based login with session management.

  • Validates user credentials against the Progress Application Server (PAS) for OpenEdge user registry.

  • Issues session cookies (JSESSIONID) to maintain authenticated sessions.

  • Automatically redirects unauthenticated requests to the login page.

Authentication flow

The authentication process varies depending on how you access Pro2. The login flow types for web application users and direct URL access are as follows:
  • For Pro2 application users:

    To sign in to Pro2, establish a valid server session, and access protected application features:

    1. Open the Pro2 application in your browser.

      If no valid session exists, Pro2 redirects to the login page.

    2. Enter your credentials in the format: username@domain.
      Note: The default username is admin@pro2 and the default password is admin. For security reasons, you must change the default password the first time you log in before you can proceed further. Progress strongly recommends changing it at frequent intervals thereafter and avoiding reuse of default credentials in any production environment.
    3. Click Login.

      On successful authentication, Pro2 creates a session and redirects you to the application. All subsequent requests use your authenticated session.

  • For direct URL access:
    To navigate directly to a protected URL (such as a REST endpoint):
    1. PAS for OpenEdge redirects your browser to the login page.
    2. Log in with your credentials.
    3. After successful authentication, PAS for OpenEdge redirects you back to the original URL.

Troubleshooting

This following table outlines common authentication issues and their resolutions:
Issue Cause Resolution
Login fails with "Incorrect Username or Password" Invalid credentials or incorrect username format.
  • Verify you are using the correct format: username@domain.
  • Confirm you are using the correct domain name (pro2).
  • Verify your credentials are valid.
  • Contact your administrator if login issues persist.
REST API returns 401 unauthorized No valid session exists, or the session has expired.
  • Log in to Pro2 to establish a session.
  • Ensure your client sends the JSESSIONID cookie with each request.
Direct URL access redirects to login Expected behavior. All protected URLs require authentication.
  • Log in when redirected to the login page.
  • After successful authentication, PAS for OpenEdge redirects you to the requested URL.
APSV connection rejected APSV transport now requires authentication.
  • Ensure your APSV client provides valid credentials.
  • Verify the credentials format: username@pro2.
  • Contact your administrator if connection issues persist.

Security best practices

Follow these guidelines to maintain secure authentication in your Pro2 deployment:
  • Use strong passwords—Enforce password complexity requirements for all users.
  • Monitor session activity—Review PAS for OpenEdge logs regularly for unauthorized access attempts.
  • Rotate passwords regularly—Establish a password change policy for all users.
  • Protect session cookies—Ensure JSESSIONID cookies are handled securely by clients.