Mailing-List: contact cloudstack-users-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: cloudstack-users@incubator.apache.org
Received-SPF: pass (athena.apache.org: domain of Prasanna.Santhanam@citrix.com
 designates 203.166.19.134 as permitted sender)
Date: Fri, 8 Jun 2012 13:49:51 +0530
From: Prasanna Santhanam <prasanna.santhanam@citrix.com>
To: "cloudstack-users@incubator.apache.org"
	<cloudstack-users@incubator.apache.org>
Subject: Re: Having trouble getting a CloudStack API URL with api_key and
 generated signature to work from the browser (Firefox).
Message-ID: <20120608081951.GD3038@cloud.com>
Mail-Followup-To: "cloudstack-users@incubator.apache.org"
 <cloudstack-users@incubator.apache.org>
References: 
 <93099572B72EB341B81A644E134F240B011CF7695DC6@SJCPMAILBOX01.citrite.net>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: 
 <93099572B72EB341B81A644E134F240B011CF7695DC6@SJCPMAILBOX01.citrite.net>
User-Agent: Mutt/1.5.21 (2010-09-15)

On Thu, Jun 07, 2012 at 10:38:20PM -0400, Evan Miller wrote:
> Hi:
> 
> Right now, I am just testing a simple, final API-based url with signature in a browser. 
> I am getting the following authentication related error in the browser:
> 
> { "listvirtualmachinesresponse" : {"errorcode" : 401, "errortext" : "unable to verify user credentials and/or request signature"}  }
> 
> Here is the final API-based url:
> 
>  http://10.217.5.192:8080/client/api?command=listVirtualMachines&apiKey=8v_GEvJJgDjbbHIBmlle4yyHKseQhRefztnv4UP2fU3K9y12TH7lscsn6-7SEaGO1yCCTnUtE1oT0v7npCuS8Q&response=json&signature=1ca7bc1bbc67b8f578c7d094c523537571ee17b1
> 
> Here is how I built that final url:
> 
> Using perl, it is based on the following pieces:
> 
> my $cs_ip = '10.217.5.192';
> my $base_url = 'http://' . "$cs_ip" . ':8080'; 
> my $api_path = '/client/api?'; 
> my $api_key = '8v_gevjjgdjbbhibmlle4yyhkseqhrefztnv4up2fu3k9y12th7lscsn6-7seago1ycctnute1ot0v7npcus8q';
> my $secret_key = 'kNd2VxlXxCXwyJGlidr0ZcmcqXSH2refwxZTStD6If4vJu4QmJPOIui0rgr88mDI6DuGQTzP9eQNOjlZBTReKg';
> 
> The api_key and secret key come from my account (evan) in domain 1. 
> The keys were just generated in a new CloudStack GUI session.
> The evan account has ROOT Domain privileges.
> 
> Then, following directions in the Developer's Guide ...
> 
> The sorted, lower-case command string ($sorted_lc_cmd) is:
> 
> apikey=8v_gevjjgdjbbhibmlle4yyhkseqhrefztnv4up2fu3k9y12th7lscsn6-7seago1ycctnute1ot0v7npcus8q&command=listvirtualmachines&response=json
> 
> 
> I obtained the hex signature in perl as follows:
> 
> 
> $signature = hmac_sha1_hex ($sorted_lc_cmd, $secret_key);
> 
> 
> And, then, put together the final url, as above, with the calculated signature.
> 
> 
> What am I doing wrong or missing?

Before you obtain the hmac SHA-1 you need to url encode the request
url stripping it off reserved characters like "+, !, $" etc. Then you
perform the HMAC on the resultant string. This then is passed through
a base64 encoder to obtain the signature. It looks like you missed
this step. Can you base64 encode the hmac result and give it a shot?


-- 
Prasanna.,