0

I am trying to connect third party from Salesforce. I am using Hmac sha256 algorithm for authentication and getting 403 error: Forbidden request, invalid auth credential

my code is as below: can anyone please guide me how to solve this issue. Thanks in advance.

          XmlStreamWriter w = new XmlStreamWriter();
          w.writeStartDocument('utf-8','1.0');
          w.writeStartElement(null,'LoanApplication',null); 
          w.writeStartElement(null, 'LoanReference', null);
          w.writeCharacters('APP1235');
          w.writeEndElement();
          w.writeStartElement(null, 'BrokerConsultantName', null);
          w.writeCharacters('Test');
          w.writeEndElement();
          w.writeEndDocument();

        DateTime dateTimeNow = dateTime.now();
        String unixTime = ''+dateTimeNow.getTime()/1000;        
        String xmlOutput = w.getXmlString();
        String privKey = 'test123456789';
        String publicKey = 'test987654321';
        String responseBody;        

        Blob blobSign = Crypto.generateDigest('SHA256', Blob.valueOf(privKey + xmlOutput.length() + unixTime));
        String HMACKey = EncodingUtil.base64Encode(blobSign);

        String endpoint='https://api-test.test.com/test/test/new/';

        HttpRequest request = new HttpRequest();

        request.setMethod('POST');
        request.setEndpoint(endpoint);
        request.setHeader('Content-Type', 'application/xml');
        request.setHeader('API-KEY',publicKey);
        request.setHeader('API-HMAC',HMACKey );
        request.setHeader('API-Timestamp',unixTime);
        request.setBody(XmlOutput);        


        Http http = new Http();
        HttpResponse response = http.send(request); 
        responseBody = response.getBody(); 
        System.debug('@@@XML Output'+xmlOutput);     
        System.debug('@@@Response:'+ Response);
        System.debug('@@@Response Body:'+ ResponseBody);
        System.debug('@@@time: '+unixTime);
        System.debug('@@@HMACKey: '+ HMACKey);
        System.debug('@@@BlobSign: ' + blobsign);

1 Answer 1

2

This line looks very suspicious:

Blob blobSign = Crypto.generateDigest('SHA256', Blob.valueOf(privKey + xmlOutput.length() + unixTime));

I'm guessing it should be something like:

Blob blobSign = Crypto.generateDigest('SHA256', Blob.valueOf(privKey + xmlOutput + unixTime));
8
  • Hi Metadaddy, Thank you for your reply. I tried removing the lenght, but the same 403 error.
    – User sfdc
    Mar 1, 2016 at 23:42
  • One more observation - shouldn't you be using Crypto. generateMac if the API wants HMAC? So I'm guessing Blob blobSign = crypto.generateMac('HmacSHA256', Blob.valueOf(xmlOutput), Blob.valueOf(privKey));
    – metadaddy
    Mar 2, 2016 at 6:13
  • Hi Metadaddy, I tried with crypto.generateMac, but it is giving error - "Method does not exist or incorrect signature: Crypto.generateMac(String, Blob)".
    – User sfdc
    Mar 2, 2016 at 6:46
  • The Url is correct, but the issue still exists. working on it.
    – User sfdc
    Mar 4, 2016 at 4:20
  • 1
    Hi Metadaddy, Finally got success message with right XML data format.
    – User sfdc
    Mar 10, 2016 at 23:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .