Consuming SAIT API via ITS ESB from web / desktop application

Transcription

1 Consuming SAIT API via ITS ESB from web / desktop application 1. Configuration Requirements: To be able to test / consume API via ITS ESB the following steps must be addressed: a. The certificate should be installed in Windows Certificate Store using computer account option. Administrative rights should be granted to account the application is running under only to specific operation of reading certificate from the store. The certificate should be issued by InCommon; otherwise, contact ESB team for further instructions. The above steps usually complete by network administrator. b. Send CN (common name) of the SSL to ESB team to be whitelisted on their end. c. Send the IP address of the machine you consuming / testing the API on to ESB team to be whitelisted it on their end 2. Consuming Workflow Step 1: Get ESB token by sending request to: a. ESB TEST URL b. ESB QA URL c. ESB PROD URL Step 2: Configure request to get ESB Token using: a. Basic Auth with your ApiKey and Secret using POST request b. Add header: Content-Type = application/x-www-form-urlencoded;charset=utf-8 c. Post Body: grant_type=client_credentials Step 3: Using received token make another request to get payload a. + [end point] Example: b. The token must be supplied via header with header key name esmauthnclienttoken 3. Sample.NET code reading SSL from Windows Certificate Store and making a secure connection to ESB network to get oauthtoken and then Payload Here are the references to imported assemblies.

2 using Newtonsoft.Json; using System; using System.IdentityModel.Selectors; using System.IO; using System.Net; using System.Net.Security; using System.Security.Cryptography.X509Certificates; using System.Text; public class SecureWebRequest private string _sslcn; private string _apikey; private string _secret; private string _sslfilepath; private string _sslpasswd; /// <summary> /// /// </summary> /// <param name="sslcn">the value that specified in Common Name (CN) field of of SSL certificate</param> /// <param name="apikey"></param> /// <param name="secret"></param> public SecureWebRequest(string sslcn, string apikey, string secret) _sslcn = sslcn; _apikey = apikey; _secret = secret; private static bool AllwaysGoodCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors policyerrors) return true; private static void ValidateX509(X509Certificate2 cert) var validator = X509CertificateValidator.ChainTrust; ServicePointManager.ServerCertificateValidationCallback += new RemoteCertificateValidationCallback(AllwaysGoodCertificate); validator.validate(cert); private static X509Certificate2 GetCertificateCN(string certificatecn) X509Store store = new X509Store(StoreLocation.LocalMachine); //requires admin rights store.open(openflags.readonly); X509Certificate2Collection certcollection = store.certificates.find(x509findtype.findbysubjectname, certificatecn, true); if (certcollection.count > 0) ValidateX509(certCollection[0]); return certcollection[0];

3 store.close(); return null; private CredentialCache SetBasicAuthCredential(string url, string username, string passw) CredentialCache credentialcache = new CredentialCache(); credentialcache.add(new System.Uri(url), "Basic", new NetworkCredential(username, passw)); return credentialcache; /// <summary> /// A POST request issued to specified end point, using SSL to get a token /// </summary> /// <param name="url">end point to call to get the token</param> /// <param name="postbody">data to be sent with POST request</param> /// <returns></returns> public OAuthToken GetOAuthToken(string url, string postbody) X509Certificate2 cert = GetCertificateCN(_sslCN); if (cert == null) throw new Exception("No installed certificate found on local machine"); HttpWebRequest webrequest = (HttpWebRequest)WebRequest.Create(url); webrequest.clientcertificates.add(cert); webrequest.method = WebRequestMethods.Http.Post; webrequest.contenttype = "application/x www form urlencoded;charset=utf 8"; webrequest.preauthenticate = true; webrequest.keepalive = false; webrequest.credentials = SetBasicAuthCredential(url, _apikey, _secret); var data = Encoding.ASCII.GetBytes(postBody); using (var stream = webrequest.getrequeststream()) stream.write(data, 0, data.length); //network setting to match the protocol type used on server connection //ServicePointManager.MaxServicePoints = 4; //ServicePointManager.MaxServicePointIdleTime = 1000; ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 SecurityProtocolType.Tls11 SecurityProtocolType.Tls; var response = (HttpWebResponse)webrequest.GetResponse(); var result = new StreamReader(response.GetResponseStream()).ReadToEnd(); return JsonConvert.DeserializeObject<OAuthToken>(result); if (ex is WebException)

4 WebException we = ex as WebException; WebResponse webresponse = we.response; throw new Exception("Exception calling method. " + ex.message); throw new Exception(ex.Message); public string GetApiPayload(string endpointurl, OAuthToken oauthtoken) HttpWebRequest webrequest = (HttpWebRequest)WebRequest.Create(endPointURL); webrequest.method = WebRequestMethods.Http.Get; webrequest.headers.add("esmauthnclienttoken", oauthtoken.access_token); var response = (HttpWebResponse)webrequest.GetResponse(); var result = new StreamReader(response.GetResponseStream()).ReadToEnd(); return result; if (ex is WebException) WebException we = ex as WebException; WebResponse webresponse = we.response; throw new Exception("Exception calling method. " + ex.message); return null; 4. Sample code how to use the library ApiTestModel model = new ApiTestModel(); SecureWebRequest secwebreq = new SecureWebRequest(sslCN, "your apikey", "your secret"); string postbody = "grant_type=client_credentials"; model.token = secwebreq.getoauthtoken(" postbody); model.payload = secwebreq.getapipayload(" model.token);

5 5. Contacts: SAIT: Saheli Datta access management Eddy Mishiyev SOA system issues ESB Team: Rakesh Darji ESB connection issues, access mapping