rsapi/auth.go
func (a *ssAuthenticator) Sign(r *http.Request) error {
	if time.Now().After(a.refreshAt) {
		u := buildURL(a.host, "api/catalog/new_session")
		u += "?account_id=" + strconv.Itoa(a.accountID)
		authReq, err := http.NewRequest("GET", u, nil)
		if err != nil {
			return err
		}
		if err := a.auther.Sign(authReq); err != nil {
			return err
		}

		// A bit tricky: if the auther is the cookie signer it could have updated the
		// host after being redirected.
		if ca, ok := a.auther.(*cookieSigner); ok {
			a.SetHost(ca.host)
			authReq.Host = a.host
			authReq.URL.Host = a.host
		}

		authReq.Header.Set("Content-Type", "application/json")
		resp, err := a.client.DoHidden(authReq)
		if err != nil {
			return fmt.Errorf("Authentication failed: %s", err)
		}
		if resp.StatusCode != 303 {
			body, err := ioutil.ReadAll(resp.Body)
			var msg string
			if err != nil {
				msg = " - <failed to read body>"
			}
			if len(body) > 0 {
				msg = " - " + string(body)
			}
			return fmt.Errorf("Authentication failed: %s%s", resp.Status, msg)
		}
		a.refreshAt = time.Now().Add(2 * time.Hour)
	}
	a.auther.Sign(r)
	r.Header.Set("X-Api-Version", "1.0")
	r.Host = a.host
	r.URL.Host = a.host

	return nil
}
func (a *ssAuthenticator) Sign(r *http.Request) error {
	if time.Now().After(a.refreshAt) {
		u := buildURL(a.host, "api/catalog/new_session")
		u += "?account_id=" + strconv.Itoa(a.accountID)
		authReq, err := http.NewRequest("GET", u, nil)
		if err != nil {
			return err
		}
		if err := a.auther.Sign(authReq); err != nil {
			return err
		}

		// A bit tricky: if the auther is the cookie signer it could have updated the
		// host after being redirected.
		if ca, ok := a.auther.(*cookieSigner); ok {
			a.SetHost(ca.host)
			authReq.Host = a.host
			authReq.URL.Host = a.host
		}

		authReq.Header.Set("Content-Type", "application/json")
		resp, err := a.client.DoHidden(authReq)
		if err != nil {
			return fmt.Errorf("Authentication failed: %s", err)
		}
		if resp.StatusCode != 303 {
			body, err := ioutil.ReadAll(resp.Body)
			var msg string
			if err != nil {
				msg = " - <failed to read body>"
			}
			if len(body) > 0 {
				msg = " - " + string(body)
			}
			return fmt.Errorf("Authentication failed: %s%s", resp.Status, msg)
		}
		a.refreshAt = time.Now().Add(2 * time.Hour)
	}
	a.auther.Sign(r)
	r.Header.Set("X-Api-Version", "1.0")
	r.Host = a.host
	r.URL.Host = a.host

	return nil
}
// Self-Service authenticator first creates a global session with the core then creates a local
// session with self-service.