Troubleshooting the SuiteSignOn Signature

This section covers generating a valid signature.

Note:

The values defined in this section are the values used in the examples in the following sections.

Generate a Signature

Some users have difficulty constructing a valid signature. There are many ways to generate a signature for SuiteSignOn (Outbound SSO). This is one example of how to do it correctly.

The following sections describe how to correctly create a signature. There are PHP examples for each step.

• Input Parameters for the Example

• Step One: Construct a Base String for the Signature

• Step Two: Signature Key

• Step Three: Signature

Note:

All encoding in SuiteSignOn (Outbound SSO) is percent-encoding. For more information about percent-encoding, go to (https://tools.ietf.org/html/rfc5849#section-3.6). The examples in this section use PHP rawurlencode.

Related Topics

Troubleshooting SuiteSignOn (Outbound SSO)

Input Parameters for the Example

These are the input parameters used for this example.

              $url = 'https://<accountID>.app.netsuite.com/app/common/integration/ssoapplistener.nl';
$httpMethod = 'GET';
$tokenKey = '030e6a121766126c6b445655477e7252517c395926f3430a';
$tokenSecret = '';                    //Outbound SSO does not use token secret
$consumerKey = 'VutaTaro1ktGNXKD';
$consumerSecret = 'S3cr3t P@ssw0rd';           //In UI called "Shared secret"
$signatureMethod = 'HMAC-SHA256';     //or HMAC-SHA1 or PLAINTEXT
$nonce = 'fjaLirsIcCGVZWzBX0pg';      //substr(str_shuffle("0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"), 0, 20);
$timestamp = '1508242306';            //time();
$version = '1.0'; 

            

Construct a Base String for the Signature

The first step in creating signature is constructing a Base String.

Note:

This step is not needed when using PLAINTEXT as a signature method.

Base String Creation

                $baseString = oauth_get_sbs($httpMethod, $url, array('oauth_consumer_key' => $consumerKey,
                                                     'oauth_nonce' => $nonce,
                                                     'oauth_signature_method' => $signatureMethod,
                                                     'oauth_timestamp' => $timestamp,
                                                     'oauth_token' => $tokenKey,
                                                     'oauth_version' => $version)); 

              

Base String Example

                  GET&https%3A%2F%2F<accountID>.app.netsuite.com%2Fapp%2Fcommon%2Fintegration%2Fssoapplistener.nl&oauth_consumer_key%3DVutaTaro1ktGNXKD%26oauth_nonce%3DfjaLirsIcCGVZWzBX0pg%26oauth_signature_method%3DHMAC-SHA256%26oauth_timestamp%3D1508242306%26oauth_token%3D030e6a121766126c6b445655477e7252517c395926f3430a%26oauth_version%3D1.0 

                

Note:

The examples use the oauth library. The command for installing the library is sudo pecl install oauth. See https://tools.ietf.org/html/rfc5849#section-3.4.1 for more information about the signature base string.

See also Create the Base String Manually.

Signature Key

Important:

The signature key must be percent-encoded as specified in https://tools.ietf.org/html/rfc5849#section-3.4.1.

The signature key is used to sign the base string in the HMAC-SHA algorithm. The key is constructed from the URL-encoded values for:

• consumer secret and

• token secret (empty string)

• with the ampersand character (&) as the delimiter

              $key = rawurlencode($consumerSecret) .'&'. rawurlencode($tokenSecret); 

            

Signature

HMAC-SHA

Signature HMAC-SHA Example

                  $signature = base64_encode(hash_hmac('sha256', $baseString, $key, true));
//$signature = base64_encode(hash_hmac('sha1', $baseString, $key, true)); 

                

The signature is a base64 value of the HMAC-SHA, where the message is Base String and key is the key from the previous step.

Signature HMAC-SHA256 Example

                  PP1VMUdgDJeSkeNwJ8EqjKowOVddSWy9JqRT3WQJWck= 

                

Signature HMAC-SHA1 Example

                  6nMUbMdr0cssfVDo0YmsBelwnpo= 

                

PLAINTEXT

Signature PLAINTEXT

                  $signature = $key; 

                

Signature PLAINTEXT Example

                    S3cr3t%20P%40ssw0rd& 

                  

General Notices