Maximo

 View Only
Expand all | Collapse all

HTTP 403 error from custom java HTTP Handler

  • 1.  HTTP 403 error from custom java HTTP Handler

    Posted Sat October 01, 2022 08:27 AM
    Hello,

    We are on 7.6.1.1 and we send purchase requisitions from MAXIMO to Peoplesoft via MIF (event listener, out bound Q, end point, Custom java handler etc.). The custom handler java class that implements RouterHandler prepares  the xml messages based upon the requirements from the PeopleSoft app and the "sendData" method performs the HTTP Post to PeopleSoft (the relevant code as follows):
    {
    HTTPExit exit = getExitInstance();
    //PSFSC88HttpExit exit = (PSFSC88HttpExit)getExitInstance();
    String url = getUrl();
    MicUtil.INTEGRATIONLOGGER.debug("Pankaj original url: " + url);
    //Map urlProps = exit.getURLProperties(metaData, data, destinationMap);
    Map urlProps = exit.getURLProperties(metaData, newData, endPointPropVals);
    if(urlProps != null)
    {
    MicUtil.INTEGRATIONLOGGER.debug("Pankaj urlProps: " + urlProps.toString());
    url = addURLProps(url, urlProps);
    }
    MicUtil.INTEGRATIONLOGGER.debug("Pankaj url after adding props: " + url);
    URL postURL = new URL(url);
    if (postURL != null)
    MicUtil.INTEGRATIONLOGGER.debug("Pankaj posturl: " + postURL.toString());
    con = postURL.openConnection();
    con.setRequestProperty("User-Agent", "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.95 Safari/537.11");  // i added this code yesterday
    int setCntLength = newData.length;
    setDefaultRequestProperty(setCntLength);
    Map headerProps = exit.getHeaderProperties(metaData, newData, endPointPropVals);
    if(headerProps != null)
    {
    setHeaderProperties(con, headerProps);
    MicUtil.INTEGRATIONLOGGER.debug("Pankaj headerProps: " + headerProps.toString());
    }
    String strNewData = new String(newData, StandardCharsets.UTF_8); // for UTF-8 encoding
    if (strNewData != null)
    MicUtil.INTEGRATIONLOGGER.debug("Pankaj strNewData: " +strNewData);
    outStream = new BufferedOutputStream(con.getOutputStream());
    outStream.write(newData);
                        outStream.flush();                          // throws IOException 

    Recently we have started observing that the code throws exception by saying

    Server returned HTTP response code: 403 for URL: https://<PSHOSTNAME>/PSIGW/HttpListeningConnector
    psdi.util.MXSystemException: BMXAA1477E - The connection failed to the HTTP handler for the endpoint. Review the error and server log flies for information to indicate the cause of the issue, for example, incorrect properties in the DefaultHTTPExit.java handler class.
    Server returned HTTP response code: 403 for URL: https://<PSHOSTNAME>PSIGW/HttpListeningConnector

    We got the exact same payload  (xml message) by debugging the class and we posted the payload using cURL and Postman and it worked seamlessly without any HTTP error (i.e. response=200). 

    Any reasons why the http post could be failing from the java class running from the app server but works fine from cURL and Postman. We have been using this java class for the last decade and it worked fine, but recently having 403 issues.

    We also issued the exact same cURL command from the same app server's command prompt and it posted correctly without any error (so no firewall issues)

    Any clue? Known issues? 

    Thanks




    ------------------------------
    Pankaj Bhide
    Computer Systems Engineer
    Berkeley National Laboratory
    Berkeley CA
    ------------------------------



    #Maximo
    #AssetandFacilitiesManagement
    #MaximoIntegrationandScripting


  • 2.  RE: HTTP 403 error from custom java HTTP Handler

    Posted Sat October 01, 2022 05:22 PM

    One way I would debug this from code is to look in the web to introduce a fiddler trace in the java code .I t is very easy

    It is available by searching in google .What would happen is the Maximo server sending the payload will be visible through

    The executing code. Normally if you run Fiddler on the server only web browser traffic will be shown bit when

    You do it like this the java code also shows you the same info so with that you will be able to see

    How Maximo java is performing vs CURL or postman.

     

    A 403 from web is basically because the resource the guy on the other side is not allowing you in

    https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/403

    so perhaps the other guys have done something that may be suspecting this payload to be

    a attack vector?