How to hash and encode mpesa passcode in java - java

I am trying to dynamically generate a password to be sent with each api request to mpesa apis. According to documentation I need to first concatenate the provided passkey with timestamp and merchant id and then do a sha256 to get a hashed password which I should then encode to base 64 however doing this in Java returns a wrong encoded string whereas a similar process and code works in PHP, where could I be going wrong?
import org.apache.commons.codec.binary.Base64;
import org.apache.cxf.headers.Header;
import org.apache.cxf.jaxb.JAXBDataBinding;
import javax.xml.bind.JAXBException;
import javax.xml.namespace.QName;
import java.io.UnsupportedEncodingException;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;
import java.util.List;
public class CheckoutHeaderBuilder {
public static Header buildHeader(String merchantId, String passKey, String timestamp) throws JAXBException, NoSuchAlgorithmException, UnsupportedEncodingException {
String hashedEncodedPass = Base64.encodeBase64String(MessageDigest.getInstance("SHA-256").digest((merchantId + passKey + timestamp).getBytes("utf-8")));
List<Header> headers = new ArrayList<>();
CheckOutHeader checkOutHeader = new CheckOutHeader();
checkOutHeader.setTIMESTAMP(timestamp);
checkOutHeader.setMERCHANTID(merchantId);
checkOutHeader.setPASSWORD(hashedEncodedPass);
return new Header(new QName("tns:ns", "CheckOutHeader"), checkOutHeader, new JAXBDataBinding(CheckOutHeader.class));
}
}


Hi Japheth Ongeri Inkalimeva, you do not have to encrypt using SHA256. You may not need to neccesarily set a new password when sending a Lipa na M-Pesa Online Payment API request.
I have ammended your code to remove SHA256 encryption.
import org.apache.commons.codec.binary.Base64;
import org.apache.cxf.headers.Header;
import org.apache.cxf.jaxb.JAXBDataBinding;
import javax.xml.bind.JAXBException;
import javax.xml.namespace.QName;
import java.io.UnsupportedEncodingException;
import java.util.ArrayList;
import java.util.List;
public class CheckoutHeaderBuilder {
public static Header buildHeader(String merchantId, String passKey, String timestamp) throws JAXBException, NoSuchAlgorithmException, UnsupportedEncodingException {
String hashedEncodedPass = Base64.encodeBase64String((merchantId + passKey + timestamp).getBytes("utf-8"));
List<Header> headers = new ArrayList<>();
CheckOutHeader checkOutHeader = new CheckOutHeader();
checkOutHeader.setTIMESTAMP(timestamp);
checkOutHeader.setMERCHANTID(merchantId);
checkOutHeader.setPASSWORD(hashedEncodedPass);
return new Header(new QName("tns:ns", "CheckOutHeader"), checkOutHeader, new JAXBDataBinding(CheckOutHeader.class));
}
}


Example encode SHA256
import java.nio.charset.StandardCharsets;
import com.google.common.hash.Hashing;
String password = “123456”;
Hashing.sha256().hashString(password, StandardCharsets.UTF_8).toString();
Hope will help you


You can encode the password for Mpesa in this way:
import java.nio.charset.StandardCharsets;
import java.util.Base64;
public class MpesaUtils {
public static String getMpesaEncodedPassword(String lipaNaMpesaShortCode,
String password, String timeStamp) {
StringBuilder sb = new StringBuilder();
sb.append(lipaNaMpesaShortCode).append(password).append(timeStamp);
byte[] bytes = sb.toString().getBytes(StandardCharsets.ISO_8859_1);
return Base64.getEncoder().encodeToString(bytes);
}
}
Usage example:
String lnmShortCode = "your lipa na mpesa short code here";
String password = "your password here";
String timeStamp = getTimeStamp();
String encodedPassword = MpesaUtils.getMpesaEncodedPassword(lnmShortCode, password, timeStamp);

Related

Java soap web service header authentication call from windows application c#

I was create a soap web service at java. When called from java working fine, but when called from c# its not working, would you please help me? How to call getHelloWorldAsString method from c# with header authentication. Thanks in advance
Here is the java code:
package com.mkyong.ws;
import java.util.List;
import java.util.Map;
import javax.annotation.Resource;
import javax.jws.WebService;
import javax.xml.ws.WebServiceContext;
import javax.xml.ws.handler.MessageContext;
//Service Implementation Bean
#WebService(endpointInterface = "com.mkyong.ws.HelloWorld")
public class HelloWorldImpl implements HelloWorld{
#Resource
WebServiceContext wsctx;
#Override
public String getHelloWorldAsString() {
MessageContext mctx = wsctx.getMessageContext();
//get detail from request headers
Map<?,?> http_headers = (Map<?,?>) mctx.get(MessageContext.HTTP_REQUEST_HEADERS);
List<?> userList = (List<?>) http_headers.get("Username");
List<?> passList = (List<?>) http_headers.get("Password");
String username = "";
String password = "";
if(userList!=null){
//get username
username = userList.get(0).toString();
}
if(passList!=null){
//get password
password = passList.get(0).toString();
}
//Should validate username and password
if (username.equals("abcd") && password.equals("abcd123")){
return "Hello World JAX-WS - Valid User!";
}else{
return "Unknown User!";
}
}
#Override
public String getSum() {
return "10";
}
}
Here is the java calling (this is working):
package com.mkyong.client;
import java.net.URL;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import javax.xml.namespace.QName;
import javax.xml.ws.BindingProvider;
import javax.xml.ws.Service;
import javax.xml.ws.handler.MessageContext;
import com.mkyong.ws.HelloWorld;
public class HelloWorldClient{
private static final String WS_URL ="http://localhost:8080/ws/HelloWorld?wsdl";
public static void main(String[] args) throws Exception {
try {
URL url = new URL(WS_URL);
QName qname = new QName("http://ws.mkyong.com/", "HelloWorldImplService");
Service service = Service.create(url, qname);
HelloWorld hello = service.getPort(HelloWorld.class);
/*******************UserName & Password ******************************/
Map<String, Object> req_ctx = ((BindingProvider)hello).getRequestContext();
req_ctx.put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, WS_URL);
Map<String, List<String>> headers = new HashMap<String, List<String>>();
headers.put("Username", Collections.singletonList("abcd"));
headers.put("Password", Collections.singletonList("abcd123"));
req_ctx.put(MessageContext.HTTP_REQUEST_HEADERS, headers);
/**********************************************************************/
System.out.println(hello.getHelloWorldAsString());
System.out.println(hello.getSum());
} catch (Exception e) {
System.out.println(e.getMessage());
}
}
}
C# Client Call:
After adding wsdl to the windows application web service,written following C# code,
webService.HelloWorldImplService ws = new webService.HelloWorldImplService(); Console.WriteLine(ws.getHelloWorldAsString());

Jira communication using java

I am trying to communicate with jira using Java but i am facing an exception as shown below
xception in thread "main" java.lang.NoSuchFieldError: INSTANCE
at org.apache.http.impl.nio.conn.DefaultClientAsyncConnectionFactory.createHttpResponseFactory(DefaultClientAsyncConnectionFactory.java:105)
at org.apache.http.impl.nio.conn.DefaultClientAsyncConnectionFactory.<init>(DefaultClientAsyncConnectionFactory.java:74)
at org.apache.http.impl.nio.conn.DefaultClientAsyncConnectionFactory.<clinit>(DefaultClientAsyncConnectionFactory.java:62)
at org.apache.http.impl.nio.conn.PoolingClientAsyncConnectionManager.createClientAsyncConnectionFactory(PoolingClientAsyncConnectionManager.java:96)
at org.apache.http.impl.nio.conn.PoolingClientAsyncConnectionManager.<init>(PoolingClientAsyncConnectionManager.java:72)
at com.atlassian.httpclient.apache.httpcomponents.DefaultHttpClient$2.<init>(DefaultHttpClient.java:117)
at com.atlassian.httpclient.apache.httpcomponents.DefaultHttpClient.<init>(DefaultHttpClient.java:115)
at com.atlassian.jira.rest.client.internal.async.AsynchronousHttpClientFactory.createClient(AsynchronousHttpClientFactory.java:53)
at com.atlassian.jira.rest.client.internal.async.AsynchronousJiraRestClientFactory.create(AsynchronousJiraRestClientFactory.java:35)
at com.atlassian.jira.rest.client.internal.async.AsynchronousJiraRestClientFactory.createWithBasicHttpAuthentication(AsynchronousJiraRestClientFactory.java:42)
at jira.JiraCommunicate.main(JiraCommunicate.java:33)
Exception i am facing at this line
JiraRestClient client = factory.createWithBasicHttpAuthentication(uri, JIRA_ADMIN_USERNAME, JIRA_ADMIN_PASSWORD);
import java.net.URI;
import java.net.URISyntaxException;
import java.util.Arrays;
import java.util.Collection;
import com.atlassian.jira.rest.client.api.JiraRestClient;
import com.atlassian.jira.rest.client.api.JiraRestClientFactory;
import com.atlassian.jira.rest.client.api.domain.BasicProject;
import com.atlassian.jira.rest.client.api.domain.Comment;
import com.atlassian.jira.rest.client.api.domain.Issue;
import com.atlassian.jira.rest.client.api.domain.SearchResult;
import com.atlassian.jira.rest.client.api.domain.Transition;
import com.atlassian.jira.rest.client.api.domain.User;
import com.atlassian.jira.rest.client.api.domain.input.FieldInput;
import com.atlassian.jira.rest.client.api.domain.input.TransitionInput;
import com.atlassian.jira.rest.client.internal.async.AsynchronousJiraRestClientFactory;
import com.atlassian.util.concurrent.Promise;
public class JiraCommunicate {
private static final String JIRA_URL = "";
private static final String JIRA_ADMIN_USERNAME = "";
private static final String JIRA_ADMIN_PASSWORD = "";
public static void main(String[] args) throws Exception {
// Construct the JRJC client
//System.out.println(String.format("Logging in to %s with username '%s' and password '%s'", JIRA_URL, JIRA_ADMIN_USERNAME, JIRA_ADMIN_PASSWORD));
JiraRestClientFactory factory = new AsynchronousJiraRestClientFactory();
URI uri = new URI(JIRA_URL);
JiraRestClient client = factory.createWithBasicHttpAuthentication(uri, JIRA_ADMIN_USERNAME, JIRA_ADMIN_PASSWORD);
// Invoke the JRJC Client
Promise<User> promise = client.getUserClient().getUser("admin");
User user = promise.claim();
for (BasicProject project : client.getProjectClient().getAllProjects().claim()) {
System.out.println(project.getKey() + ": " + project.getName());
}
Promise<SearchResult> searchJqlPromise = client.getSearchClient().searchJql("project = MYPURRJECT AND status in (Closed, Completed, Resolved) ORDER BY assignee, resolutiondate");
for (Issue issue : searchJqlPromise.claim().getIssues()) {
System.out.println(issue.getSummary());
}
// Print the result
System.out.println(String.format("Your admin user's email address is: %s\r\n", user.getEmailAddress()));
// Done
System.out.println("Example complete. Now exiting.");
System.exit(0);
}
}
Blockquote
Please i need your help..I want to communicate Jira to upload or download Story or create bugs..

WooCommerce Api authentication error using java

​I am facing problem while connecting with WooCommerce API (http://woothemes.github.io/woocommerce-rest-api-docs/#authentication). I am successfully able to generate the signature using java program and also checked the generated signature having same time stamp and nonce on linked in console(as given in the WooCommerce document) for any discrepancy but the generated signature is same on linked in and java output console.
The process of our working is described below :
​1. We have generated the signature with the help of signature base string and secret key using java program. Signature base string looks like :
GET&http%3A%2F%2FEndPointURL%2Fwc-api%2Fv2%2Forders&oauth_consumer_key%3D%26oauth_nonce%3D70810941%26oauth_signature_method%3DHMAC-SHA1%26oauth_timestamp%3D1433226349%26oauth_version%3D1.0
2. ​While we are trying to access the url http://EndPointURL/wc-api/v2/orders, It is showing error given below :
{"errors":[{"code":"woocommerce_api_authentication_error","message":"Invalid Signature - provided signature does not match"}]}
3.We have also generated the signature with the help of Linked in test Console using same value of time stamp and nonce and getting the same signature. But we are not able to access the data.
The java code that I am using is given below :
import java.io.IOException;
import java.io.InputStream;
import java.io.UnsupportedEncodingException;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URLEncoder;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;
import java.util.List;
import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.lang3.RandomStringUtils;
import org.apache.http.HttpEntity;
import org.apache.http.HttpResponse;
import org.apache.http.NameValuePair;
import org.apache.http.client.ClientProtocolException;
import org.apache.http.client.HttpClient;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.utils.URIUtils;
import org.apache.http.client.utils.URLEncodedUtils;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.message.BasicNameValuePair;
public class OAuthForWooCommerce {
private static String key = "consumer_Key";
private static String secret = "consumer_Secret";
private static final String HMAC_SHA1 = "HmacSHA1";
private static final String ENC = "UTF-8";
private static Base64 base64 = new Base64();
private static String getSignature(String url, String params)
throws UnsupportedEncodingException, NoSuchAlgorithmException,
InvalidKeyException {
/**
* base has three parts, they are connected by "&": 1) protocol 2) URL
* (need to be URLEncoded) 3) Parameter List (need to be URLEncoded).
*/
StringBuilder base = new StringBuilder();
base.append("GET&");
base.append(url);
base.append("&");
base.append(params);
System.out.println("String for oauth_signature generation:" + base);
// yea, don't ask me why, it is needed to append a "&" to the end of
// secret key.
byte[] keyBytes = (secret + "&").getBytes(ENC);
SecretKey key = new SecretKeySpec(keyBytes, HMAC_SHA1);
Mac mac = Mac.getInstance(HMAC_SHA1);
mac.init(key);
// encode it, base64 it, change it to string and return.
return new String(base64.encode(mac.doFinal(base.toString().getBytes(
ENC))), ENC).trim();
}
public static void main(String[] args) throws ClientProtocolException,
IOException, URISyntaxException, InvalidKeyException,
NoSuchAlgorithmException {
System.out.println("*** Welcome to WooCommerce Klipfolio integration Wizard ***");
HttpClient httpclient = new DefaultHttpClient();
List<NameValuePair> qparams = new ArrayList<NameValuePair>();
// These params should ordered in key
//qparams.add(new BasicNameValuePair("oauth_callback", "oob"));
qparams.add(new BasicNameValuePair("oauth_consumer_key", key));
String nonce = RandomStringUtils.randomAlphanumeric(32);
//String nonce2 = URLEncoder.encode(nonce1, "UTF-8");
qparams.add(new BasicNameValuePair("oauth_nonce", nonce));
//qparams.add(new BasicNameValuePair("oauth_nonce", ""+ (int) (Math.random() * 100000000)));
qparams.add(new BasicNameValuePair("oauth_signature_method",
"HMAC-SHA1"));
qparams.add(new BasicNameValuePair("oauth_timestamp", ""
+ (System.currentTimeMillis() / 1000)));
qparams.add(new BasicNameValuePair("oauth_version", "1.0"));
// generate the oauth_signature
String signature = getSignature(URLEncoder.encode(
"http://MY_END_URL/wc-api/v2/orders", ENC),
URLEncoder.encode(URLEncodedUtils.format(qparams, ENC), ENC));
System.out.println("Getting Oauth Signature...");
// add it to params list
qparams.add(new BasicNameValuePair("oauth_signature", signature));
// generate URI which lead to access_token and token_secret.
URI uri = URIUtils.createURI("http", "MY_END _URL", -1,
"wc-api/v2/orders",
URLEncodedUtils.format(qparams, ENC), null);
System.out.println("Connecting to the URL : \n"
+ uri.toString());
HttpGet httpget = new HttpGet(uri);
// output the response content.
System.out.println("Getting Response from the server :");
HttpResponse response = httpclient.execute(httpget);
HttpEntity entity = response.getEntity();
if (entity != null) {
InputStream instream = entity.getContent();
int len;
byte[] tmp = new byte[2048];
while ((len = instream.read(tmp)) != -1) {
System.out.println(new String(tmp, 0, len, ENC));
}
}
}
}
Please let me know where I am doing wrong.
Thanks,

You must remove the version number from params, according to the documentation. I think also you should remove "&" you added to the secret key when generating signature, since I managed to get 200 response without it.
The require parameters are: oauth_consumer_key, oauth_timestamp, oauth_nonce, oauth_signature, and oauth_signature_method. oauth_version is not required and must be omitted.
You should also sort the parameters in byte order before adding them to the string you used to create the signature.
Also, I suggest you to debug by changing the message line to see the signature you sent to the server and the signature you should have sent.
For instance, you can change it to:
throw new Exception( __( 'Invalid Signature - provided signature does not match Secret:' . $user->woocommerce_api_consumer_secret . ', StringToSign: ' . $string_to_sign . ', TakenSign: ' . $consumer_signature . ', GeneratedSign: ' . $signature, 'woocommerce' ), 401 );

Thanks for your code Archit, this helped me jump through hoops.
I have updated your code and the below works.
package com.woocommerce.experiments;
import org.apache.commons.codec.EncoderException;
import org.apache.commons.codec.binary.Base64;
import org.apache.commons.codec.net.URLCodec;
import org.apache.commons.io.IOUtils;
import org.apache.commons.lang3.RandomStringUtils;
import org.apache.http.Consts;
import org.apache.http.HttpEntity;
import org.apache.http.HttpResponse;
import org.apache.http.NameValuePair;
import org.apache.http.client.HttpClient;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.utils.URIUtils;
import org.apache.http.client.utils.URLEncodedUtils;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.message.BasicNameValuePair;
import javax.crypto.Mac;
import javax.crypto.SecretKey;
import javax.crypto.spec.SecretKeySpec;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URI;
import java.net.URISyntaxException;
import java.net.URLEncoder;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;
import java.util.List;
import java.util.Map;
import java.util.TreeMap;
public class OAuthForWooCommerce {
private static String key = "ck_your_consumer_key";
private static String secret = "cs_your_consumer_secret";
private static final String HMAC_SHA1 = "HmacSHA1";
private static final String ENC = "UTF-8";
private static Base64 base64 = new Base64();
private static String getSignature(String url, String params)
throws UnsupportedEncodingException, NoSuchAlgorithmException,
InvalidKeyException, EncoderException {
/**
* base has three parts, they are connected by "&": 1) protocol 2) URL
* (need to be URLEncoded) 3) Parameter List (need to be URLEncoded).
*/
StringBuilder base = new StringBuilder();
base.append("GET&");
//follow Step 2 and encode
base.append(new URLCodec(Consts.UTF_8.displayName()).encode(url));
base.append("&");
base.append(params);
System.out.println("String for oauth_signature generation: " + base);
byte[] keyBytes = (String.format("%s", secret)).getBytes(ENC);
SecretKey key = new SecretKeySpec(keyBytes, HMAC_SHA1);
Mac mac = Mac.getInstance(HMAC_SHA1);
mac.init(key);
// encode it, base64 it, change it to string and return.
String signature = new String(base64.encode(mac.doFinal(base.toString().getBytes(ENC))), ENC).trim();
return signature;
}
public static void main(String[] args) throws IOException, URISyntaxException, InvalidKeyException,
NoSuchAlgorithmException, EncoderException {
String nonce = RandomStringUtils.randomAlphanumeric(32);
Map<String, String> paramMap = new TreeMap<>();
paramMap.put("oauth_consumer_key", key);
paramMap.put("oauth_timestamp", "" + (System.currentTimeMillis() / 1000));
paramMap.put("oauth_nonce", nonce);
paramMap.put("oauth_signature_method", "HMAC-SHA1");
List<NameValuePair> qparams = new ArrayList<>();
//uksort( $params, 'strcmp' ) mimic
paramMap.entrySet().stream().forEach(stringStringEntry -> qparams.add(new BasicNameValuePair(stringStringEntry.getKey(), stringStringEntry.getValue())));
//double encode Step 3 (in order to replace '%' with '%25') after sorting (Step 4)
String encodedParams = URLEncoder.encode(URLEncodedUtils.format(qparams, ENC), ENC);
System.out.println("Encoded Params "+ encodedParams);
String signature = getSignature("http://your_end_url/wc-api/v2/orders", encodedParams);
qparams.add(new BasicNameValuePair("oauth_signature", signature));
HttpClient httpclient = HttpClientBuilder.create().build();
System.out.println("Getting Oauth Signature...");
// generate URI which lead to access_token and token_secret.
URI uri = URIUtils.createURI("http", "your_end_url", -1, "wc-api/v2/orders", URLEncodedUtils.format(qparams, ENC), null);
System.out.println("Connecting to the URL : \n" + uri.toString());
HttpGet httpget = new HttpGet(uri);
httpget.setHeader("X-Stream" , "true");
// output the response content.
System.out.println("Getting Response from the server :");
HttpResponse response = httpclient.execute(httpget);
HttpEntity entity = response.getEntity();
System.out.println("Response Code " + response.getStatusLine().getStatusCode());
if (entity != null) {
System.out.println("Json response" + IOUtils.toString(entity.getContent(), ENC));
}
}
}
I hope this helps you (hopefully not late!) and others. Step by step process for authentication can be found at WooCommerce REST API Documentation

How to access fields of user story's Owner with Java Rest API?

We are using the Java Rest API to export data.
For the HierarchicalRequirement object, how do we access the email address for the Owner?

Owner is a reference to a User object, and this object's fields need to be included in the fetch, for exaple:
storyRequest.setFetch(new Fetch("Name","Owner","UserName", "EmailAddress"));
Here is the full code:
import com.google.gson.JsonObject;
import com.rallydev.rest.RallyRestApi;
import com.rallydev.rest.request.QueryRequest;
import com.rallydev.rest.response.QueryResponse;
import com.rallydev.rest.util.Fetch;
import com.rallydev.rest.util.QueryFilter;
import java.io.IOException;
import java.net.URI;
import java.net.URISyntaxException;
public class aRESTstories {
public static void main(String[] args) throws URISyntaxException, IOException {
String host = "https://rally1.rallydev.com";
String username = "user#co.com";
String password = "secret";
String projectRef = "/project/2222";
String workspaceRef = "/workspace/1111";
String applicationName = "RESTExampleStoriesChildren";
RallyRestApi restApi = new RallyRestApi(
new URI(host),
username,
password);
restApi.setApplicationName(applicationName);
System.out.println(restApi.getWsapiVersion()); //v.2.0 by default when using 2.0.2 jar
QueryRequest storyRequest = new QueryRequest("HierarchicalRequirement");
storyRequest.setFetch(new Fetch("Name","Owner","UserName", "EmailAddress"));
storyRequest.setLimit(1000);
storyRequest.setScopedDown(false);
storyRequest.setScopedUp(false);
storyRequest.setWorkspace(workspaceRef);
storyRequest.setProject(projectRef);
storyRequest.setQueryFilter(new QueryFilter("FormattedID", "=", "US16"));
QueryResponse storyQueryResponse = restApi.query(storyRequest);
JsonObject storyJsonObject = storyQueryResponse.getResults().get(0).getAsJsonObject();
System.out.println("Name: " + storyJsonObject.get("Name"));
JsonObject userObject = storyJsonObject.get("Owner").getAsJsonObject().getAsJsonObject();
System.out.println(userObject.get("UserName"));
System.out.println(userObject.get("EmailAddress"));
}
}

How to create a signature using HMACSHA1 and secret key to connect to Kayako API

I'm trying to connect to a third party application API using apache commons HTTP Client. The API I'm trying to connect is http://wiki.kayako.com/display/DEV/REST+API.
The API requires me to pass a API key and a signature along with a salt used to create the signature.
As per the API documentation these are the steps to create the signature
Generate a random string to create a salt (in PHP, you would use mt_and() to do this)
Generate the signature by hashing the salt using SHA256 with the secret key as the key (in PHP, you would use hash_hmac() to do this)
base64 encode the signature (in PHP, you would use base64_encode() to do this)
URL encode the output (in PHP, you would use urlencode() to do this)
UPDATED
As per the responses I got, I changes some of my code and created a demo account with the Kayako to test the API
I'm using the following class to generate the signature
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.net.URLEncoder;
import java.security.GeneralSecurityException;
import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import org.bouncycastle.util.encoders.Base64Encoder;
public class GenSign2 {
public static void main(String[] args) throws GeneralSecurityException,
IOException {
String secretKey = "M2Y2YjkxZDEtYmNlOC1mYmI0LTkxZTgtOTNiY2RiMDhmN2E2YjExNGUwYjktNGJkYy1jZTM0LWQ1MWYtZGIwYWRlZTE0NGNh";
String salt = "0123456789";
String generateHmacSHA256Signature = generateHmacSHA256Signature(salt,
secretKey);
System.out.println("Signature: " + generateHmacSHA256Signature);
String urlEncodedSign = URLEncoder.encode(generateHmacSHA256Signature,
"UTF-8");
System.out.println("Url encoded value: " + urlEncodedSign);
}
public static String generateHmacSHA256Signature(String data, String key)
throws GeneralSecurityException, IOException {
byte[] hmacData = null;
try {
SecretKeySpec secretKey = new SecretKeySpec(key.getBytes("UTF-8"),
"HmacSHA256");
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(secretKey);
hmacData = mac.doFinal(data.getBytes("UTF-8"));
ByteArrayOutputStream bout = new ByteArrayOutputStream();
new Base64Encoder().encode(hmacData, 0, hmacData.length, bout);
return bout.toString("UTF-8");
} catch (UnsupportedEncodingException e) {
throw new GeneralSecurityException(e);
}
}
}
And the test api is as follows
import java.io.IOException;
import java.net.URISyntaxException;
import java.util.ArrayList;
import java.util.List;
import org.apache.http.HttpResponse;
import org.apache.http.NameValuePair;
import org.apache.http.client.ClientProtocolException;
import org.apache.http.client.HttpClient;
import org.apache.http.client.methods.HttpPost;
import org.apache.http.impl.client.DefaultHttpClient;
import org.apache.http.message.BasicNameValuePair;
public class TestApi {
public static void main(String[] args) throws ClientProtocolException,
IOException, URISyntaxException {
HttpClient client = new DefaultHttpClient();
List<NameValuePair> qparams = new ArrayList<NameValuePair>();
qparams.add(new BasicNameValuePair("apikey",
"f165dc40-ce3f-6864-7d5e-27a7188b2e62"));
qparams.add(new BasicNameValuePair("salt", "0123456789"));
qparams.add(new BasicNameValuePair("signature", "mbrhpXkP0LzNMNDygHAorqMx%2FDGovl%2FauMTOMB6RNMA%3D"));
HttpPost httpget = new HttpPost(
"http://aruntest.kayako.com/api/index.php?e=/Core/Test");
HttpResponse response = client.execute(httpget);
System.out.println(response.getProtocolVersion());
System.out.println(response.getStatusLine().getStatusCode());
System.out.println(response.getStatusLine().getReasonPhrase());
System.out.println(response.getStatusLine().toString());
}
}
The demo site can be accessed using
URL: http://aruntest.kayako.com/admin/
User: admin
Password: ty386rhjzz
It is throwing an unauthorized access exception when I'm trying to connect.

Try and compare your signature method with this (it works)
public static String generateHmacSHA256Signature(String data, String key) throws GeneralSecurityException {
byte[] hmacData = null;
try {
SecretKeySpec secretKey = new SecretKeySpec(key.getBytes("UTF-8"), "HmacSHA256");
Mac mac = Mac.getInstance("HmacSHA256");
mac.init(secretKey);
hmacData = mac.doFinal(data.getBytes("UTF-8"));
return new BASE64Encoder().encode(hmacData);
} catch (UnsupportedEncodingException e) {
// TODO: handle exception
throw new GeneralSecurityException(e);
}
}
The result of this call, will then be the value of your attribute Signature
String signature = generateHmacSHA256Signature(salt, key);
qparams.add(new BasicNameValuePair("signature", signature));
A simple way to generate a salt/nonce
String nonce = String.valueOf(System.currentTimeMillis());
See Example:

Kayako has updated their documentation with a new java sample which works fine.

I think the entire getSaltedKey() routine is unnecessary. You're just signing the salt (it should have been called a nonce) with HMAC and signing with the provided key, it doesn't look like you're supposed to sign the key+salt.

Categories