Apigee URL Redirect on Apigee Private Instance

[Annapurna]

Hi All,

I am working on a scenario where login to the website to be done and download the files via Apigee.

1. I am using service callout to do the website login and get the session ID.

2. Trying to invoke the actual file download url by adding the session ID in header.

This is giving me an error and not downloading the file. I am testing using postman.

Please help me on this.

[Annapurna]

@dchiesa1,

we are working on a scenario of redirecting to url from apigee edge.

PFB scenario details:

1. login to the website and get the session details in header

2. Pass the session details and invoke the url to download the File.

we have the service callout to login and get the session ID. Now passing this session ID in the header and invoking the file download url, but it is still giving "307 Temporarily Redirect" response.

Can you help us to proceed further on this.

Tried this solution https://www.googlecloudcommunity.com/gc/Apigee/Trying-to-redirect-to-the-new-url-from-the-target-ser... but didnt help.

Thanks.

[dchiesa1]

---

@Annapurna wrote:

but it is still giving "307 Temporarily Redirect" response.

---

Did you look at the Location header in the response with status code 307? In some cases, there will be a redirect from the "download URL".  If you get a 3xx status, the Location header should be there, and it should contain another URL, which you (your app) should be able to fetch, for the actual download. 

In other words, everything may be "working correctly", except that  you (or your app) just didn't follow the final redirect. 

See if that works to solve your problem.

BTW I am not really clear on which system is invoking which URL.  your description was: 

we have the service callout to login and get the session ID. Now passing this session ID in the header and invoking the file download url, but it is still giving "307 Temporarily Redirect" response.

OK, so "Service callout" implies that there is an Apigee proxy that invokes the /login endpoint and obtains a session ID.  

But "Now passing the session ID..." - which system is doing that?  Is that an Apigee API proxy?    Is it some system outside of Apigee?  If it's a webapp, then there is a way to set the fetch() API to automatically follow redirects. If it is another ServiceCallout within Apigee, or maybe a targetEndpoint within Apigee, then there is no way to tell it to "auto-follow redirects".  you need to "manually" follow 307 redirects, by grabbing the Location header and invoking THAT. 

For hints, search on this community forum for "dynamic target url" or "dynamic url servicecallout" - you will see how to configure a target or a servicecallout with a URL that is determined only at runtime. and in your case you will just use the value of the variable serviceCalloutResponse.header.Location as the URL.  (where serviceCalloutResponse is the variable that you specified in your SC to download the file). 

So the sequence is

1. ServiceCallout to /login
2. parse response to obtain session ID 
3. ServiceCallout (or target?) to /download link
4. check status , if 302 or 307, or 304, then look for Location header, and extract THAT
5. ServiceCallout to that URL to get the actual downloadable file

That will "work" within some constraints. Remember that Apigee is not designed to handle unlimited payloads. The request and response payload limits are 10mb.  Downloadable files can be much larger. If you expect to have large downloads, then the final invocation for the downloadable thing should not be done from Apigee.  It should be done from some external app, like the client to Apigee. In other words, rather than step 5 above where  Apigee invokes the final download url, Apigee can send that URL as a response to its client, and the client app can invoke the download URL directly. If the downlaod is 200mb or something, then that would eliminate apigee from the data path for the download .

[Annapurna]

@dchiesa1 , Thank You for the quick response. This is still not working .Please find more insights below and guide us.

I have implemented the suggested sequence :

1. ServiceCallout to /login--> Invoking the login url using service callout from Target Request Flow
2. parse response to obtain session ID --> Extracting the Session ID from the service callout response
3. ServiceCallout (or target?) to /download link--> Invoking the download link as a target url by passing the SessionID in header
4. check status , if 302 or 307, or 304, then look for Location header, and extract THAT--> This target url (download link url) is giving status code 307 Temporary redirect with some html response along with Location header containing an url again
5. ServiceCallout to that URL to get the actual downloadable file--> we are extracting the Location header url and doing the service callout to it in target response flow . This is again giving the same response as 307 Temporary redirect and html response with again url in Location header.But no actuall download response.The size of the download link file is in KB's only.THis is totally implemented in apigee. 

[dchiesa1]

This is again giving the same response as 307 Temporary redirect 

Are the URLs changing?  I would suppose the URLs you are seeing from the Location header are different?  HTTP doesn't put a limit on the number of redirects you might need to follow.  so you may see a sequence like login => 200, download => 307, follow link1 => 307, follow link2 > 200. 

Or, if the Location URL is always the same, the target website may be challenging pigee for an additional authentication step or parameter, like a Cookie or something else. 

From your description, I understand you're trying to implement, in Apigee, the client side of an authentication-then-download flow that is prescribed by a _website_.  Generally Apigee is not designed for the purpose of emulating a browser, but on a limited basis you can do what you're describing.  Most websites that offer something like this (login-then-download) don't specify the specific sequence of requests and responses, which parameters are required on each request, etc. The only thing you have is the actual implementation and you'll need to reverse engineer it. That can be tricky.

OR maybe there is an API for your target website and they actually DO prescribe how to interact with it programmatically. With OAuthv2 or an API Key or some other way to authenticate that is not browser-based nor user-based.  That would be much easier to implement in Apigee. 

Without knowing anything else about the situation, I can't offer any more advice than that. 

[Annapurna]

Hi @dchiesa1 ,

looks like there is a requirement gap, for the website login we need to pass data in form data. username,password and formId and then invoke the login url.Then get the session and invoke the download url.

can you share me how to build form data request with username,password and formid and invoke the login url?