Using sas/secure to generate hmac-sha1 oauth signature

[FriedEgg]

If you are having issues with the commons-codec you can use the version that should be included in your sas versioned jar repository using a statement similar to the following:

add sasjar="commons_codec" version="1.7.0.0_SAS_20121211183158";

The version will be specific to your installation.

[BillJones]

Thanks!  I just realized that I need the commons-codec and not the groovy-all.2.4.0.jar.  I used the explicit classpath syntax to get the code to run.

add classpath="C:\Program Files (x86)\Groovy\Groovy-2.4.0\lib\commons-codec-1.10.jar";

Works perfectly now.  Truly appreciate your expertise and help.

[FriedEgg]

I have created a gist containing the various PROC GROOVY codes shared in this post.

Using PROC GROOVY in SAS to Calculate Hash Digests

[BillJones]

FriedEgg,

Thanks again for your help.  I use the code you provided to generate oauth signatures, and everything works great with cURL.  However, when I try to use proc http, I keep getting signature invalid errors.  I'm attempting to query a website that has oauth 1.0.  I checked with the website admin, and they receive my post requests and state there are no issues with the parameters; Keys, header, & body are all fine.  Note the site is https but I updated my SAS config file to reference a cacert file, so I don't believe that's the issue.  Also, I triple checked my signatures, and they match the nouncer.com site.  (Again, I can query the website with cURL  I want to use proc http because it should be faster.)  It appears that proc http does something to the header, url, or body of my request such that the oauth signature becomes invalid.  Do you have any idea of what could be going on?  Also, is there a master document which has all the details of proc http?  I've read the online sas documentation, but was hoping for something more detailed.

-Bill

[FriedEgg]

PROC HTTP does set some header item itself, and manually setting the same header attributes yourself I have seen lead to problems.  The documentation for the procedure that you have found online is as in-depth as I have seen available anywhere (which is not very detailed).  I do not recall exactly what headers I have seen cause issues, but I am pretty sure one of the was the content-type.  I have not tried it, but the documentation for PROC SOAP hints that there are some jreotions you can set to receive additional debug logging for the httpclient.  I would try setting that up for your session and see if it can be helpful at all with PROC HTTP.

http://support.sas.com/documentation/cdl/en/proc/65145/HTML/default/viewer.htm#n1lvy6ht8ywii2n1jpwp3...

the assumption is somewhat confirmed in the 9.4 documentation:

http://support.sas.com/documentation/cdl/en/proc/67327/HTML/default/viewer.htm#n1hee3s3s3j9oxn1x6czz...

There is also an option in PROC HTTP called VERBOSE, which I do not recall being in the documentation syntax?

I have scripts running frequently using a hmac-sha1 authentication schemes daily, through PROC HTTP, so I know at the very least, I know it's possible (even on some of the servers still running 9.2).

[BillJones]

Thanks so much for the detailed response.  I'll tweak the jre options as you suggest and will report back.  Thanks again.

[BillJones]

FriedEgg,

Hope you're doing well.  I tried your suggestions on a couple of occasions.  Unfortunately, I cannot seem to find the log file on my computer with the additional debug information for proc http. 

I saved the following to a properties file (used notepad to create it):

log4j.appender.FILE=org.apache.log4j.FileAppender
log4j.appender.FILE.File=wire.log
log4j.appender.FILE.layout=org.apache.log4j.PatternLayout
log4j.appender.FILE.layout.ConversionPattern =%d %5p [%c] %m%n
log4j.logger.httpclient.wire=DEBUG, FILE

Here are my jreoptions in the SAS configuration file:

-JREOPTIONS=(
-DPFS_TEMPLATE=!SASROOT\tkjava\sasmisc\qrpfstpt.xml
-Djava.class.path=C:\PROGRA~1\SASHome\SASVER~1\eclipse\plugins\SASLAU~1.JAR
-Djava.security.auth.login.config=!SASROOT\tkjava\sasmisc\sas.login.config
-Djava.security.policy=!SASROOT\tkjava\sasmisc\sas.policy
-Djava.system.class.loader=com.sas.app.AppClassLoader
-Dlog4j.configuration=file:/C:/log4j.properties
-Dsas.app.class.path=C:\PROGRA~1\SASHome\SASVER~1\eclipse\plugins\tkjava.jar
-Dsas.ext.config=!SASROOT\tkjava\sasmisc\sas.java.ext.config
-Dsas.jre.libjvm=C:\PROGRA~2\Java\jre6\bin\client\jvm.dll
-Dtkj.app.launch.config=C:\PROGRA~1\SASHome\SASVER~1\picklist
-Xms128m
-Xmx128m
)

Do I need to use a debug option in my code to see the log with the proc http header info?

Thanks very much,

Bill