The ClientContextId property or SESSION-ID attribute is 0 when an OpenEdge REST web application is configured with the appSecurity-form-oerealm.xml security template within the OpenEdge REST Adapter.

The ClientContextId property or SESSION-ID attribute is 0 when an OpenEdge REST web application is configured with the oeablSecurity-form-oerealm.xml security template within PASOE.

If a REST client logs in manually via the login page and then makes a REST Service call, then the ClientContextId remains 0.

Using the SESSION:CURRENT-REQUEST-INFO:ClientContextId property to get the ClientContextId.
Using the <client-principal handle>:SESSION-ID attribute to get the session ID.

The ClientContextId and session ID are populated only if you are automatically redirected to the login page when trying to call a REST web application, for example from a web browser.

If you use a REST client and do a login manually, the session is generated only after completion of the authentication process. However the Client-Principal generation and sealing occurs during the authentication process, at which time no session has been generated. This causes a session ID of  0 (zero) to be inserted.

However from a browser, due to login redirection, a session is already created during the authentication step when the Client-Principal generation takes place.

If you are on an OpenEdge version which is lower than 11.6, then upgrade to OpenEdge 11.6 or later.

For this fix, starting with OpenEdge 11.6 a new property named 'sealClientPrincipal' (value = true | false, default = false) has been added to the OERealmAuthProvider bean. If the OERealmAuthProvider's createCPAuthn = true and sealClientPrincipal = false, the Client-Principal will be generated in the OERealmAuthProvider bean, but sealing will occur in OEClientPrincipalFilter which will insert a session ID if it was not generated in the last authentication step.

The createCPAuthn property within the OERealmAuthProvider bean
When true will create an OE Client-Principal with its additional attributes that a basic Spring token does not have. This is qualified by the "sealClientPrincipal" property, which when true will use this bean's domain and registry configuration to "seal" the Client-Principal; and when false will leave the Client-Principial unsealed until the OEClientPrincipalFilter performs the seal operation.

When false a basic Spring token is generated and passed to the OEClientPrincpial filter, which will use its configuration to create a Client-Principal, copy the Spring token's information into it, and then seal it using its domain and access-code configuration.  All other properties relating to Client-Principal generation and sealing are ignored.


The OEClientPrincipalFilter bean
This filter is responsible for:
1.    Creating a Client-Principal if one was not created in a previous authentication process step.
2.    If the previous authentication process produced a Spring token - copy that information into the Client-Principal.
3.    If the Client-Principal is not already sealed - seal it using this filter's domain and registry configuration.
4.    If enablecp is true, then send the Client-Principal to the ABL business logic.