Rest HttpRequest to outside system

I’m having issues correctly getting Salesforce to connect to one of our external systems. They recently whitelisted the range of Salesforce addresses (At least so they said). Our Sandbox is coming from cs7.

96.43.144.0/20 _ subnet mask: 255.255.240.0
136.146.0.0/15 _ subnet mask: 255.254.0.0
182.50.76.0/22 _ subnet mask: 255.255.252.0
204.14.232.0/21 _ subnet mask: 255.255.248.0

I have 2 different Chrome plugin REST clients that are managing the login call fine.

Advanced REST Client:

Advanced REST Client

Postman REST Client:

Postman REST Client

I was given some Java code that is being used to connect but I’m having a hard time converting this to Salesforce.

Java:

URL url = new URL(SOME_URL + '/etc/authentication/Login?_contenttype=text/xml");
String urlParams = "username=" + username + "&password=" + password;

HttpsURLConnection uc = (HttpsURLConnection) url.openConnection();
uc.setRequestMethod("POST");
uc.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");

uc.setRequestProperty("Content-Length", "" + Integer.toString(urlParams.getBytes().length));

uc.setUseCaches (false);
uc.setDoInput(true);
uc.setDoOutput(true);

//Send request
DataOutputStream wr = new DataOutputStream (uc.getOutputStream());
wr.writeBytes (urlParams);
wr.flush ();
wr.close ();

if(uc.getContent()!=null) {
   InputStream in = (InputStream) uc.getContent();
   DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
   DocumentBuilder builder = factory.newDocumentBuilder();
   Document doc = builder.parse(in);

   NodeList recordSet = doc.getDocumentElement().getElementsByTagName("recordset");
   String sessionId = recordSet.item(0).getChildNodes().item(1).getAttributes().getNamedItem("UserSessionID").getNodeValue(); 
}

The code I have created in Apex to replicate these calls:

HttpRequest req = new HttpRequest();
req.setEndpoint(SOME_URL + '/etc/authentication/Login?_contenttype=text/xml');
req.setMethod('POST');

req.setHeader('Content-Type', 'application/x-www-form-urlencoded');
//I tried all 3 versions below.  
//String params = 'username=' + EncodingUtil.urlEncode(userName, 'UTF-8') + '&password=' + EncodingUtil.urlEncode(password, 'UTF-8');
String params = 'username=' + userName + '&password=' + password;

//This version gives a different error that says 'Both username and password are required.'
//String params = EncodingUtil.urlEncode('username=' + userName + '&password=' + password, 'UTF-8');
req.setBody(params);
Http hp = new Http();

HTTPResponse res = hp.send(req);
System.debug('body = ' + res.getBody());

My code always returns the message: ‘Invalid stored procedure name.’ I am thinking that potentially the Salesforce IP isn’t correctly whitelisted but I really have no proof since they told me as of this morning it was now whitelisted. Any ideas?

Answer

Based on the discussion in the comments I’ll put this forward as a possible answer.

Details:

  1. Using independent tools such as the Postman REST Client for Chrome on a local machine with a trusted IP address you were able to successfully call the web service.
  2. Using the same tools from another machine with a non-whitelisted IP address resulted in a HTTP 200 Response with the error message “Invalid stored procedure name.”
  3. The response to Salesforce is also an HTTP 200 with the same message – “Invalid stored procedure name.”
  4. In your question you list the valid IP ranges as per Salesforce IP Address to whitelist.

Since the REST request from Salesforce is getting a valid HTTP response and the message is the same as an non-whitelisted IP address it is possible that the Salesforce IP rangers haven’t been added correctly.

This would be hard to prove further without access to the web server logs for your service.

If possible, see if the underlying error with the missing stored procedure can be fixed. Ideally, IMHO, the web service wouldn’t be broadcasting those sort of error messages to the world. That’s how security issues happen.

Attribution
Source : Link , Question Author : dphil , Answer Author : Daniel Ballinger

Leave a Comment