Unauthorised and NoSession

HttpClient myClient = new HttpClient();
myClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Basic", "api_key");//API key
myClient.DefaultRequestHeaders.Add("Accept", "application/json,application/zip,text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
HttpResponseMessage packageStatusResponse = myClient.GetAsync(new Uri(url)).Result;

  DocumentPackage documentPackage = PackageBuilder.NewPackageNamed("Package from template via Dlls " + DateTime.Now)
                    .WithSettings(DocumentPackageSettingsBuilder.NewDocumentPackageSettings())
                    .DescribedAs("Package from template via Dlls")
                    .WithEmailMessage("This message should be delivered to all signers")
                    .WithStatus(DocumentPackageStatus.SENT)
                    .WithVisibility(Visibility.ACCOUNT)
                    .WithAutomaticCompletion()

                    // Define the 1st signer first and last name
                    .WithSigner(SignerBuilder.NewSignerWithEmail(contract.emailAddress)
                                             .WithFirstName(contract.firstName)
                                             .WithLastName(contract.lastName)
                                             .Replacing(new Placeholder(placeHolderId1)))

                    // Define the 2nd signer first and last name
                    .WithSigner(SignerBuilder.NewSignerWithEmail(contract.emailAddressSigner2)
                                             .WithFirstName(contract.firstNameSigner2)
                                             .WithLastName(contract.lastNameSigner2)
                                             .Replacing(new Placeholder(placeHolderId2)))

                    .WithDocument(DocumentBuilder.NewDocumentNamed("Electronic Disclosures and Signatures Consent"))

                    // Define the document
                    .WithDocument(DocumentBuilder.NewDocumentNamed("sample_contract2")
                                        .WithInjectedField(FieldBuilder.Label()
                                            .WithName("FirstName")
                                            .WithValue(contract.firstName))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("LastName")
                                            .WithValue(contract.lastName))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("Email")
                                            .WithValue(contract.emailAddress))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("Company")
                                            .WithValue(contract.company))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("Address")
                                            .WithValue(contract.address))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("City")
                                            .WithValue(contract.city))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("State")
                                            .WithValue(contract.state))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("Country")
                                            .WithValue(contract.country))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("Zip")
                                            .WithValue(contract.zip))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("PhoneNumber")
                                            .WithValue(contract.phone))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("PolicyNumber")
                                            .WithValue(contract.policyNumber))
                                        .WithInjectedField(FieldBuilder.TextField()
                                            .WithName("PolicyNumberSigner2")
                                            .WithValue(contract.policyNumberSigner2))

                ).Build();

 string templateId = "tMs3tH1EWD3uKKQCgaLbjG64f-A=";
                PackageId templatePackage = new PackageId(templateId);
                EslClient eslClient = new EslClient(Constants.SANDBOX_API_KEY, Constants.SANDBOX_URL);
sentPackageId = eslClient.CreatePackageFromTemplate(templatePackage, documentPackage);

 class CarLoanApplication
    {
        private static string API_KEY = "";
        private static string API_URL = ""; //e.g. https://sandbox.esignlive.com/api
        public static void start()
        {
            EslClient eslClient = new EslClient(API_KEY, API_URL);

            DocumentPackage documentPackage = PackageBuilder.NewPackageNamed("Car Loan Application")
                .WithSigner(SignerBuilder.NewSignerWithEmail("[email protected]")
                        .WithFirstName("John")
                        .WithLastName("Smith")
                        .WithCustomId("Signer1")
                        .WithSMSSentTo("418-555-5585")
                        .WithAttachmentRequirement(AttachmentRequirementBuilder.NewAttachmentRequirementWithName("Driver license")
                            .WithDescription("Please upload a copy of your driver license.")
                            .IsRequiredAttachment()
                            .Build()))
                .WithSigner(SignerBuilder.NewSignerWithEmail("[email protected]")
                        .WithFirstName("Patty")
                        .WithLastName("Galant")
                        .WithCustomId("Signer2")
                        .ChallengedWithQuestions(ChallengeBuilder.FirstQuestion("What's 1+1?")
                            .Answer("2")))
                .WithDocument(DocumentBuilder.NewDocumentNamed("Car Loan Agreement")
                        .FromFile("../4B-CarLoan.pdf")
                        .EnableExtraction()
                        .WithSignature(SignatureBuilder.SignatureFor("[email protected]")
                                .WithName("applicant_signature")
                                .WithPositionExtracted()
                                .WithField(FieldBuilder.SignatureDate()
                                        .WithName("Date")
                                        .WithPositionExtracted())
                                .WithField(FieldBuilder.CheckBox()
                                        .WithName("agree")
                                        .WithPositionExtracted())
                                .WithField(FieldBuilder.RadioButton("radioGroup")
                                        .WithName("radio1")
                                        .WithPositionExtracted()
                                        .WithValue("X"))
                                .WithField(FieldBuilder.RadioButton("radioGroup")
                                        .WithName("radio2")
                                        .WithPositionExtracted())
                                .WithField(FieldBuilder.RadioButton("radioGroup")
                                        .WithName("radio3")
                                        .WithPositionExtracted()))
                        .WithSignature(SignatureBuilder.SignatureFor("[email protected]")
                                .WithName("coapplicant_signature")
                                .WithPositionExtracted())
                        .WithInjectedField(FieldBuilder.TextField()
                                .WithName("amount")
                                .WithValue("50000"))
                        .WithInjectedField(FieldBuilder.TextField()
                                .WithName("applicant_name")
                                .WithValue("John Smith"))
                        .WithInjectedField(FieldBuilder.TextField()
                                .WithName("applicant_email")
                                .WithValue("[email protected]"))
                        .WithInjectedField(FieldBuilder.TextField()
                                .WithName("coapplicant_email")
                                .WithValue("[email protected]"))
                        .WithInjectedField(FieldBuilder.TextField()
                                .WithName("coapplicant_name")
                                .WithValue("Patty Galant"))
                        .WithInjectedField(FieldBuilder.TextField()
                                .WithName("radio5")
                                .WithValue("X"))
                        )
                .Build();

            PackageId packageId = eslClient.CreateAndSendPackage(documentPackage);
        }
    }

Hi Duo,

we tried to use proxy to connect to Saas, we got the same issue, 1st call gets 401, then the next request is working. 

error return: 

{"messageKey":"error.unauthorised.noSession","message":"Failed to retrieve Session","code":401,"name":"Unauthorized"}

any idea?

thanks, 

Hi Cindy,

Is it consistent that the first call always fails? Which particular API or function caused this 401 error, or any API or function as long as it's the first call? 

Are you developing with Java, .NET SDK or RESTful API? API Key vs API Token? Could you share the code around how you build the EslClient or HttpClient? 

Duo

Hi Duo,

we found out that without proxy (via internet) we don't have issue at all, so we suspect this is the proxy issue. since I saw somebody post the exact the same issue here but doesn't found the root cause and solution. from your experience, do you have any idea?

thanks,

Cindy

Hi Cindy,

The 401 error could indicate:

#1 The connection doesn't get blocked by proxy

#2 However somehow the request header "Authorization" is either removed or changed by the proxy.

Hence are you able to pull the outbound raw request from your proxy server? Does the proxy allow you to test against it via another HTTP client (e.g. Postman/Curl from your local)? Or any possible to test through another proxy?

Duo

Hi Duo,

the strange thing is only failed at 1st time or 2nd time for the same request, the subsequent request are all successful, if the connection the request header "Authorization" is removed or changed, why the subsequent requests are successful.

I will try to see if I can get raw request from our proxy server, is it possible to ask Onespan to look at sandbox log to see what request they got? why onespan return 401 for 1st time? 

Yes, I tried to test from SOA test from my local and got the same result via same proxy. 

Another thing I want to ask is the error message (401)we got as below, but actually it's nothing to do with session, right? I tested it, as I mentioned that once getting successful request, all the subsequent ones are successful without any time period, so I suspect nothing to do with session. please confirm.

{
    "messageKey" : "error.unauthorised.noSession",
    "message" : "Failed to retrieve Session",
    "code" : 401,
    "name" : "Unauthorized"
}

Yes, the error message is not necessary related to session. If you simply hit this link:

"https://sandbox.esignlive.com/api/packages/07YTkf-tiKA0IBdIm5hvAI-cPzE=" in your browser (It's a GET /api/packages/{packageId} call, refers to a package created by me)

it returns you the same error message.

Duo

I see, I removed "Authorization: Basic ${API_KEY}" in the header, I got 401 all the times. 

by the way, is it possible to check sandbox log to see what Onespan get for the 401 error? 

this is my request:

GET https://sandbox.esignlive.com/api/packages/5uQLpwRrjhuSmtYG5oaioxQwXBc= HTTP/1.0
Host: sandbox.esignlive.com
Authorization: Basic RExxxQ==
Accept: application/json; esl-api-version=11.21

thanks,

Cindy

Hi Cindy,

Just consulted with our support team and seems due to security concern, the "Authorization" header won't be logged no matter whether it's included in the request. 

Duo

thanks for the information. meanwhile, I am trying to see if I can get raw request from our proxy. 

BTW, I tested from Postman ->Proxy ->SaaS, and I am getting the same result.

Hi Duo,

Regarding this issue, I found out the difference between successful request vs error one (401), the difference is Cookie. if there is Cookie, it's successful, and it gets 401 without Cookie. does it make sense to you? 

Successful one:

GET https://sandbox.e-signlive.ca/api/packages/oaSfJlDW19aMSi9fnWR8EVjv9o0= HTTP/1.1
Host: sandbox.e-signlive.ca
Authorization: Basic NldxxQ==
Accept: application/json; esl-api-version=11.21
Cookie: BCSI-CS-1a37b6c6e9fad08c=1

Error One: 

GET https://sandbox.e-signlive.ca/api/packages/oaSfJlDW19aMSi9fnWR8EVjv9o0= HTTP/1.1
Host: sandbox.e-signlive.ca
Authorization: Basic NlxxQ==
Accept: application/json; esl-api-version=11.21

Hi Cindy,

As per below article, seems this cookie is set by proxy server and to determine if to forward credentials upstream - This is to avoid leaking enterprise credentials to an external server in most cases. Leaking credentials would be a serious security risk, especially when Basic credentials were used.

https://knowledge.broadcom.com/external/article/200712/what-is-the-http-header-bcsics-cookie-se.html

Duo

thanks for the information. Does Onespan check cookie in the request? I will check with our proxy team to see why sometimes it set the cookie, and sometimes not.

but from Onespan, it seems the request with cookie is successful.

Cindy

OneSpan Sign won't expect cookie in the request, except "ESIGNLIVE_SESSION_ID", which is used for UI interactions.

Duo

I see. probably without cookie, upstream won't get authentication which make it fail.

Hi Duo,

I tried the one flow as our application server -> Proxy ->SaaS.

I have same request if it's sending to US sandbox, it is working fine, but if it's sending to CA sandbox, I got the below error:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Is there any setting different between US and CA sandbox?

thanks,

Cindy

Hi Cindy,

Please make sure either the root CA or leaf certificate of CA sandbox environment has been added to your JRE trust chain, as per below documentation:

https://community.onespan.com/documentation/onespan-sign/guides/admin-guides/user/updating-certificates

If this still doesn't work, can you try connecting to CA sandbox without proxy? 

Duo

Hi Duo,

thanks for the information. after i import the cert in my trust store, it works.

in the cert which I download from your website, it contains 3 certification. what's the purpose for each certificate (eSignlive.ca, globalSign, globalSign GCC)? and which one should be imported? 

thanks,

Cindy

Hi Cindy,

Do you mean the root RA, intermediate RA and the leaf certificate in the chain path?

I believe only to import leaf certificate should be sufficient.

Duo

leaf cert will be expired on Nov 2021, and root cert will be expired on 2029, and currently I imported root cert and seems working. 

Yes, leaf certificate will be rotated before it got expired, and theoretically import any of these three certificates will work. 

Duo