Solved: Digest Authentication - Page 2

Peeyush_Singhai · 01-17-2023 05:41 AM

Hi All,

We have requirement to do digest authentication in our proxy we know apigee doesn't have built-in policy for that so we are doing with java script policy.

We are sending a request to server(with username and password) and server is responding with ( WWW-Authenticate →Digest realm="Users", nonce="YywQ5zlDGgTQs7Ki2r6HnPFQSemyS7Ea", qop="auth")

So we need to send nonce and an encrypted version of the username, password and realm (a hash) with the use of md5 algorithm to the server.

So we are creating a java script policy to send above request but not getting correct response.

If anyone has done digest-auth their advise will help us.

Thanks

dchiesa1

The problem with the MD5 in Message Templates is... the payload for the digest is sort of dynamic. There's a bunch of If..THEN...ELSE stuff you need to deal with, to implement HTTP Digest correctly.

I wrote a callout that shows how to do it.

https://github.com/DinoChiesa/Apigee-Java-HttpDigest

I tested this with a few known-good HTTP Digest endpoints and it works. It is limited in a few ways. Check the README.

View solution in original post