Best way to implement the WC1 Request Signature in Java

Options
jsalicrup
jsalicrup Newcomer
in World-Check One

Hello. We are trying to implement a generateSignature method for our Feign interceptor to WC1 Screening Requests.

The problem is, that the signature that I am receiving seems not to be correct, nor even its length seems to be the same as in Postman, though the "dataToSign" looks correct in the logs and debugger.

This is a code example: 

private String generateSignature(String gmtDate, String method, String endpoint, TreeMap<String, String> additionalHeaders) {
        try {          
            StringBuilder sbDataToSign = new StringBuilder("(request-target): " + method.toLowerCase() + " " + gatewayUrl + endpoint + "\n"
                + "host: " + gatewayHost + "\n"
                + "date: " + gmtDate + "\n");
            if(additionalHeaders != null) {
                for (Map.Entry<String, String> entry : additionalHeaders.entrySet()) {
                    sbDataToSign.append(entry.getKey()).append(": ").append(entry.getValue());
                    if(entry != additionalHeaders.lastEntry())
                        sbDataToSign.append("\n");
                }
            }
            log.trace(sbDataToSign.toString());
            Mac sha256_HMAC = Mac.getInstance("HmacSHA256");
            SecretKeySpec secret_key = new SecretKeySpec(apiSecret.getBytes("UTF-8"), "HmacSHA256");
            sha256_HMAC.init(secret_key);
            String result = Base64.getEncoder().encodeToString(
                    Hex.encodeHexString(sha256_HMAC.doFinal(sbDataToSign.toString().getBytes("UTF-8"))).getBytes());     
            log.debug("generateSignature: OK.");
            return result;
        } catch(Exception ex) {
            log.error(ex.getMessage());
            log.debug(ex.getStackTrace().toString());
            throw new RuntimeException(ex);
        }
    }


dataToSign is as follows: 

(request-target): post /v2/cases/screeningRequest
host: rms-world-check-one-api-pilot.thomsonreuters.com
date: Thu, 03 Dec 2020 02:09:42 GMT
content-type: application/json
content-length: 315
{"groupId": "XXXXXXXXXXXX", "clientCaseId": "8ebd0f0c-27c4-4f17-8294-aa59408b962e", "entityType": "INDIVIDUAL", "providerTypes": ["WATCHLIST"], "name": "XXXXX XX XX", "nameTransposition": true, "secondaryFields": [{ "typeId": "SFCT_1",  "value": "MALE" }], "customFields": []}


The request runs successfully via the Postman collection that is provided in devs portal.

I assume that either the content length is not correct when calculating it with Java in the feign interceptor, or the signature is incorrect. e.g.: Signature in postman is of size 44. Signature length in Java is +80 chars.

Any thoughts on this would be appreciated.


Thanks!!!

Tagged:

Best Answer

  • Prabhjyot
    Prabhjyot LSEG
    Answer ✓

    @jsalicrup,

    Thanks for your response.

    Can you please check the time difference between the request and the response as per the headers? Your system clock must be in sync with NTP. If the time difference between request and response headers timestamp is more than 30 seconds, it will also change the validity of the hmac signature, resulting in error 401.

Answers

  • Prabhjyot
    Prabhjyot LSEG

    @jsalicrup,

    Thank you for your query.

    Can you please share the request and response headers along with the request body of the failed request, masking the API credentials from the Authorization, so we may look into the cause of the error?

  • jsalicrup
    jsalicrup Newcomer

    I am using a Feign Client in order to execute SEQ-screen-sync-simple in WC1 Version 2.0.


    In Java, this is what I get from the logs:

    POST https://rms-world-check-one-api-pilot.thomsonreuters.com/v2/cases/screeningRequest HTTP/1.1 Accept: application/json Content-Type: application/json Content-Length: 280 Date: Thu, 03 Dec 2020 07:40:50 GMT Authorization: Signature keyId="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",algorithm="hmac-sha256",headers="(request-target) host date content-length content-type",signature="XXXXXXXXXXXXXXXXXXXXXXXXXXX"


    This is a cURL example (taken from WC1 Postman Collection). Same payload and works in Postman.

    curl --location --request POST 'https://rms-world-check-one-api-pilot.thomsonreuters.com/v2/cases/screeningRequest'; \ --header 'Date: Thu, 03 Dec 2020 07:38:01 GMT' \ --header 'Content-Type: application/json' \ --header 'Authorization: Signature keyId="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",algorithm="hmac-sha256",headers="(request-target) host date content-length content-type",signature="XXXXXXXXXXXXXXXXXXXXXXXXXXX="' \ --header 'Content-Length: 280' \ --data-raw '{"groupId":"myGroupId","clientCaseId":"8ebd0f0c-27c4-4f17-8294-aa59408b962e","entityType":"INDIVIDUAL","providerTypes":["WATCHLIST"],"name":"John Doe","nameTransposition":true,"secondaryFields":[{"typeId":"SFCT_1","value":"MALE"}],"customFields":[]}'
  • Prabhjyot
    Prabhjyot LSEG

    @jsalicrup,

    The details which you have shared are the request headers, we would also need the response headers of the failed api call along with the request headers and the request body.

  • jsalicrup
    jsalicrup Newcomer

    Hi again @Prabhjyot

    Resuming this discussion, I attach the following data:

    I must also mention that we've even changed our implementation by the one provided in the code samples in this developers portal for Java. We've even changed the gatewayUrl from v2 to v1. The result is the same (Http Status 401).


    Request Headers are as follows: 

    [Date: mié, 09 dic 2020 15:06:29 GMT, Cache-Control: no-cache, Content-Type: application/json, Authorization: Signature keyId="XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",algorithm="hmac-sha256",headers="(request-target) host date content-type content-length",signature="XXXXXX"]
    (I've masked the signature and the Api Key for security reasons)


    Request Body: 

    {"groupId":"XXXXXXXXX","clientCaseId":"d97e41cd-f982-469d-9d4e-e600acf7c0a6","entityType":"INDIVIDUAL","providerTypes":["WATCHLIST"],"name":"Alejandra XXXX","nameTransposition":true,"secondaryFields":[{"typeId":"SFCT_1","value":"UNSPECIFIED"},{"typeId":"SFCT_3","value":"VEN"}],"customFields":[]}

    (I've masked the groupId for security reasons)


    Http 401 Response Headers (taken by using the very code sample from Developers portal):

    [Strict-Transport-Security: max-age=15552000, includeSubdomains, Authorization: WWW-Authenticate: Signature realm="World-Check One API",algorithm="hmac-sha256",headers="(request-target) host date content-type content-length", Transfer-Encoding: chunked, Date: Wed, 09 Dec 2020 15:11:54 GMT, Server: ""]


    Please let me know if anything else is required.

  • jsalicrup
    jsalicrup Newcomer

    @Prabhjyot

    Also, when using the sample that is provided here: https://developers.refinitiv.com/content/dam/devportal/api-families/customer-and-third-party-screening/world-check-one-api/downloads/worldcheckoneapi.zip


    The result is the same that the one mentioned above (Http Status 401).

    The same request in the Postman Collection from the same portal runs OK and returns a valid response with status 200. The problem seems to be connected to the signature methods in java.

    Any thoughts on this?

    Thanks a lot.

  • Prabhjyot
    Prabhjyot LSEG
    https://community.developers.refinitiv.com/discussion/comment/70409#Comment_70409

    @jsalicrup,

    If the request and the response headers provided above are of the same request, then there is a difference of more than 30 seconds in the request and response timestamp. Request you to please adjust your system clock as per NTP. It should work fine, please share the latest request and response headers, if you are still facing the issue.

    Please note - the time difference between the request and the response headers should not be more than 30 seconds, else it will result in error 401.

  • jsalicrup
    jsalicrup Newcomer
    https://community.developers.refinitiv.com/discussion/comment/70433#Comment_70433

    Since we are performing the request from a different timezone, we had to force the date generation for the headers in UTC time and with the documented format from the sample. With this, I could get a 201 response. Thanks for your review and advise.

Categories