I was running into the same problem. I figured out the solution to it with postman. When DUO api is referring to sending the signature you need to dynamically build the signature using the pre-request script feature in postman. In the API documentation they talk about constructing the signature, this is what they are referring to. In postman the pre-request script will set the signature as a postman environment variable which you will access in the header section. Below is the script I used in the pre-request script to build using their example in the api section and it gave me the correct signature.
You can verify the information by opening up the postman console. In your postman headers you will need to add Date with value of {{timestampHeader}} and Authorization with value of {{hmacAuthHeader}}
The Body tab you will want to select x-www-form-urlencoded. My recommendation would be to start out small and use api: /auth/v2/preauth for your own example. Use the username and alias for value. Make sure that the pre-request script body value matches the same alias value you use in the body section. The script below will fail using their information from the api page. When you replace everything with your own information it should work. This is how I got mine to work. The added console lines will show up in postman console where you can verify the different steps of information. Please be aware the hostname below will need to be replaced because the forum removed the information for client key and secret key. Go to the Auth API | Duo Security page and search for construct the signature and use the host listed, the ikey(CLIENT_KEY) and the secret key they have listed in their test test. One last thing I was never able to use the full username email instead I added a new alias with a short name to the user and made sure that what I was requesting on for username. If I used the full email it was never able to work. example: bob@bob.com I added alias bob and did username=bob . Hopefully this will help others understand what is needed. Good luck
function getAuthHeader(httpMethod, requestUrl, requestBody) {
console.log(requestBody); //body data
console.log(httpMethod); // http type: POST, GET, ETC
var CLIENT_KEY = 'nnnn';
var SECRET_KEY = 'nnnn';
var AUTH_TYPE = 'HMAC-SHA1';
var moment = require('moment')
/* Uncomment out lines below to use your test for getting correct formatted time and date */
/* var timestamp = moment().format("ddd, DD MMM YYYY HH:mm:ss ZZ");
pm.environment.set("timestampHeader",timestamp);*/
var timestamp = "Tue, 21 Aug 2012 17:29:18 -0000"; /* Only for example */
pm.environment.set("timestampHeader",timestamp);
var hostname = "nnnn-xxxxxxxx.duosecurity.com";
var apicall = "/accounts/v1/account/list"
var body = "realname=First%20Last&username=root"
var requestData = timestamp+"\n"+"POST"+"\n"+hostname+"\n"+apicall+"\n"+body;
console.log(requestData);
var hmacDigest = CryptoJS.HmacSHA1(requestData, SECRET_KEY);
console.log(hmacDigest);
var prebase = CLIENT_KEY+":"+hmacDigest;
console.log(prebase);
var baseComplete = btoa(prebase);
console.log(baseComplete);
var authHeader = "Basic "+baseComplete;
return authHeader;
}
postman.setEnvironmentVariable(‘hmacAuthHeader’, getAuthHeader(request[‘method’], request[‘url’], request[‘data’]));
hi ,
i have given below script in pre request script and getting an SyntaxError: Invalid or unexpected token,please help where i am doing wrong
function getAuthHeader(httpMethod, requestUrl, requestBody) {
console.log(requestBody);
console.log(httpMethod); // http type: POST, GET, ETC*/
var CLIENT_KEY = ‘xxxx’;
var SECRET_KEY = ‘xxxxx’;
var AUTH_TYPE = ‘HMAC-SHA1’;
var moment = require(‘moment’)
/*Uncomment out lines below to use your test for getting correct formatted time and date */
var timestamp = moment().format(“ddd, DD MMM YYYY HH:mm:ss ZZ”);
pm.environment.set(“timestampHeader”,timestamp);
/var timestamp = “Tue, 21 Aug 2012 17:29:18 -0000”; / Only for example */
/pm.environment.set(“timestampHeader”,timestamp);/
var hostname = “api-xxxxxxxx
var apicall = “/admin/v1/users”
var body = "realname=testingggggg&username=root"
var requestData = timestamp+"\n"+“POST”+"\n"+hostname+"\n"+apicall+"\n"+body;
console.log(requestData);
var hmacDigest = CryptoJS.HmacSHA1(requestData, SECRET_KEY);
console.log(hmacDigest);
var prebase = CLIENT_KEY+":"+hmacDigest;
console.log(prebase);
var baseComplete = btoa(prebase);
console.log(baseComplete);
var authHeader = "Basic "+baseComplete;
return authHeader;
}
postman.setEnvironmentVariable(‘hmacAuthHeader’, getAuthHeader(request[‘method’], request[‘url’], request[‘data’]));
