Digest Authentication

[Peeyush_Singhai]

Hi All,

We have requirement to do digest authentication in our proxy we know apigee doesn't have built-in policy for that so we are doing with java script policy. 

We are sending a request to server(with username and password) and server is responding with ( WWW-Authenticate →Digest realm="Users", nonce="YywQ5zlDGgTQs7Ki2r6HnPFQSemyS7Ea", qop="auth")

So we need to send  nonce and an encrypted version of the username, password and realm (a hash) with the use of md5 algorithm to the server.

So we are creating a java script policy to send above request but not getting correct response.

If anyone has done  digest-auth their advise will help us.

Thanks

[Peeyush_Singhai]

+

@Harish123

@shrenikkumar-s 

[dchiesa1]

I suggest that you use a Java or Python callout to compute the Digest. 

[Peeyush_Singhai]

Hi @dchiesa1 ,

I have tried  python callout also in that  I am using 'request' module but it is not supported in apigee. Can you provide some refrence how to do in python or java that supports in apigee.

[dknezic]

Another approach could be to use the message templates hash function since this just requires MD5 hash? Then avoiding java/python callouts

https://docs.apigee.com/api-platform/reference/message-template-intro#hash-functions

[dchiesa1 · Accepted solution]

The problem with the MD5 in Message Templates is... the payload for the digest is sort of dynamic.  There's a bunch of If..THEN...ELSE stuff you need to deal with, to implement HTTP Digest correctly. 

I wrote a callout that shows how to do it. 

https://github.com/DinoChiesa/Apigee-Java-HttpDigest

I tested this with a few known-good HTTP Digest endpoints and it works.  It is limited in a few ways. Check the README.