How to add logic in apigee proxy to get kvm value based on input request

[soumikghosh]

I have a requirement where I need to call external Oauth service using clientid and secret saved in kvm. In KVM Name field value is shipto number coming from request and Value field value is concatenation of client id, colon and secret. we have to put a logic in proxy : if shipto number in request matches with kvm name field value then corresponding client id and secret will be used to call external Oauth service to get the access token. Please suggest how to achieve this using Apigee proxy.

[dchiesa1]

KVM GET based on the shipTo inbound parameter 

<KeyValueMapOperations name='KVM-Get-1'>
  <Scope>environment</Scope>
  <MapName>settings</MapName>
  <ExpiryTimeInSecs>300</ExpiryTimeInSecs>
  <Get assignTo='authz_blob'>
    <Key>
      <Parameter ref='request.formparam.shipto'/>
    </Key>
  </Get>
</KeyValueMapOperations>

The preceding example supposes shipto is passed as a form parameter. You can easily modify it to use a query param. If the parameter is passed as a field in a JSON payload, then ... you will need extract the shipto param from the JSON, prior to the KVM step.  

After that , you need to pass the authz_blob (the clientid:secret), into the OAuth endpoint. If the OAuth endpoint does "standard" OAuth2.0, then the the authz_blob from the above needs to be passed into the OAuth endpoint within the Authorization header.  You can do this with an AssignMessage policy: 

<AssignMessage name='AM-Authz'>
  <Set> 
    <Headers>
      <!-- choose one -->
      <!-- A. if authz_blob is already encoded -->
      <Header name='Authorization'>Basic {authz_blob}</Header>

      <!-- B. if authz_blob needs to be base64-encoded -->
      <Header name='Authorization'>Basic {encodeBase64(authz_blob)}</Header>
    </Headers>
  </Set>
</AssignMessage>

 If the message to the OAuth endpoint is not "request" - if you are setting and sending a different message to the OAuth endpoint - then you will need an AssignTo element in there, specifying which message to assign. 

[soumikghosh]

Thanks for your response.
I have used an assign variable policy before kvm lookup where i assigned $.order.shiptoaccountnumber to shipTo variable. as per trace shipTo variable is getting populated correctly. but in next step inside kvm operations policy i used the shipTo variable as below :
<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<KeyValueMapOperations async="false" continueOnError="false" enabled="true" name="KVM.Key-Value-Map-LookUp" mapIdentifier="encrypted_kvm">
<DisplayName>KVM.Key-Value-Map-LookUp</DisplayName>
<Get assignTo="private.kvmcredvalue">
<Key>
<Parameter ref="shipTo"/>
</Key>
</Get>
<Scope>environment</Scope>
</KeyValueMapOperations>

But this is not working as i cannot see private.kvmcredvalue getting populated in trace. Am i missing something? please suggest.

[dchiesa1]

---

@soumikghosh wrote:

this is not working as i cannot see private.kvmcredvalue getting populated in trace. Am i missing something? please suggest.

---

Yes, you are missing something. The something you are missing is this: Trace/DebugSession will not show assignments to private variables, nor reads from private variables (those with a prefix of private. ).  This is the whole purpose of "private variables" - to hide them in Trace.  

Maybe the KVM policy is working as expected. Have you tried using the retrieved value?  

[soumikghosh]

My next task is to substring the value captured in private variable to before colon and after colon and assign them to client id and secret variable respectively in next assign policy. I am not sure how to do that exactly as I doubt if my syntax will work. below is what i tried and i am getting 500 error with fault message "{"fault":{"faultstring":"Unresolved variable : kvmcredvalue.name","detail":{"errorcode":"entities.UnresolvedVariable"}}}"
<Var name="kvm_value">{kvmcredvalue.value}</Var>
</Set>
<!-- Split the KVM value into clientId and clientSecret -->
<AssignTo createNew="false" transport="http" type="request">
<AssignVariable>
<Name>clientId</Name>
<Value ref="kvm_value">
<Pattern>^(.*?):(.*?)$</Pattern>
<Group>1</Group>
</Value>
</AssignVariable>
<AssignVariable>
<Name>secret</Name>
<Value ref="kvm_value">
<Pattern>^(.*?):(.*?)$</Pattern>
<Group>2</Group>
</Value>
</AssignVariable>

I am sure I am missing something here too. Can you please suggest. do i need to decrypt the private variable first?

[soumikghosh]

Requesting to please suggest on my last request. 

[dchiesa1 · Accepted solution]

---

@soumikghosh wrote:

do i need to decrypt the private variable first?

---

No.  the KVM Get decrypts the data and inserts it into your chosen variable. 

Now, regarding your attempt to use AssignMessage to split a string. ...

<AssignMessage name='AM-It-Would-be-Nice-if-This-were-a-real-feature'>
  <AssignVariable>
    <Name>secret</Name>
    <Value ref="kvm_value">
    <Pattern>^(.*?):(.*?)$</Pattern>
    <Group>2</Group>
    ...

Where did you get that syntax?  That's not a thing you can do with AssignMessage.  Did you just make that up, in hopes the policy would magically support it? Here is the documentation for the AssignMessage step type.  There is no support for Pattern or Group elements. There is no support for a ref attribute on the Value element.  Check the examples.

To split a string, use a JavaScript step.

[soumikghosh]

I have used java script to split the value and it worked. Thanks for your suggestion.