STATUS_CODE returned for the response: 403 STATUS_MESSAGE returned for the response: Forbidden

Question

Can someone please guide me how to resolve the access forbidden 403 status code error ? What can i do to at least hit the end point? I am executing the code anonymously in developer console

string algorithmName = 'HMAC-SHA256';
string accessKeyID = 'XX000';
string secretAccessKey = 'XXXX';
string host = 'http://XXXXX:XXXX';
string endpoint = '/api/xxx/xxx';
string S1DealerId = 'XXOHX';
string contenttype = 'application/json';    
Datetime requestedDate = datetime.now(); 
string timestamp  = requestedDate.formatGMT('EEE, dd MMM yyyy HH:mm:ss' + ' ' 
+ 'zzz').tolowerCase();
String requestbody='';
string jsonresponse;
string httpVerb = 'GET';

//string strmd5= EncodingUtil.base64Encode (Crypto.generateDigest('MD5', Blob.valueOf(requestbody)));
//string contentmd5 = strmd5.toLowerCase();
//system.debug('CONTENT-MD5 is: ' +contentmd5);

string encodedURIPath = '' + endpoint + '\n'; 

string canonicalizedResource = encodedURIPath;

List<String> headerList = new list<String> { 'X-SourceOne-Act-As-Dealership' , 'X-SourceOne-Partner-User-ID' , 'X-SourceOne-User-ID' ,'X-SourceOne-Act-As- Dealership-Partner-ID' };
string canonicalizedHeader = headerList[0].toLowerCase() + ':' + 
R1DealerId.trim() ;

//If the request has no body and there is no Content-MD5 HTTP header included 
in the request, an empty string will be used here.
string stringToSign =   'GET' + '\n' + '\n' +
                            contenttype + '\n' +
                            timestamp + '\n' +
                            canonicalizedHeader + '\n' + 
                            canonicalizedResource;

    system.debug('The stringToSign is :' + stringToSign);

    Blob mac = Crypto.generateMac('HMAC-SHA256', blob.valueOf(stringToSign),blob.valueOf(secretAccessKey));
    String signature = EncodingUtil.base64Encode(mac);
    system.debug(signature);

    String authorization_header = 'SourceOne' + ' ' + accessKeyID + ':'+signature;
    system.debug('Authorization Header: '+authorization_header );


    HttpRequest request = new HttpRequest();
    HttpResponse res = new HttpResponse();
    Http http = new Http(); 


    request.setMethod(httpVerb);
    request.setEndpoint(host + endpoint); 

    request.setHeader('X-SourceOne-Date',timestamp);
    request.setHeader('Authorization', authorization_header);


    res = http.send(request);

    system.debug('Retrieved status message and status code returned in the response: ' + res.toString());
   system.debug('Retrieved STATUS_MESSAGE returned for the response: ' + res.getStatus());
   system.debug('Retrieved STATUS_CODE returned for the response: '+res.getStatusCode());

    jsonresponse = res.getBody();    
    system.debug('Capturing response body in a string: ' + jsonresponse);

Answer 1

Resolved the issue..

The webservice my Apex code was trying to invoke is hosted on a server that can't be accessed from outside the organization. The firewalls restrict API calls coming from outside of the network. As as result Salesforce (which is on the cloud) was unable to access that webservice. Resolution: We migrated the web service to an environment which is hosted on the server that allows calls from the internet. In this environment, we use a two way SSL and a stringent authentication mechanism to be able to get the response