AWS Identity TVM returns Http 401 response with 'client signature doesnt match' error

Question

I am using;

• Eclipse Juno
• ADT-22.3.0
• aws-android-sdk-1.7.0

For using AWS Token Vending machine code I used sample code for android from below link; http://aws.amazon.com/code/4598681430241367

My Identity TVM module is deployed on Glassfish server 4.0

My AmazonS3PersonalFileStore sample for android when tries to communicate with Identity TVM sample; its giving error

11-24 15:16:54.886: W/AmazonTVMClient(2262): Request to Token Vending Machine failed with Code: [404] Message: [Unable to reach resource at [http://ip.ip.ip.ip:8080/tvm/login?uid=59434cd89b7ff4b72695fbe55dc06e10&username=useruser&timestamp=2013-11-24T15%3A16%3A54.149Z&signature=fca134941ac0f1432568b1590057a64c1a537934d0f7c94b380c9fb23758bbd8]]

and server side shows error;

[2013-11-24T15:17:00.095+0000] [glassfish 4.0] [WARNING] [] [TokenVendingMachineLogger] [tid: _ThreadID=19 _ThreadName=http-listener-1(2)] [timeMillis: 1385306220095] [levelValue: 900] [[
  Client signature : fca134941ac0f1432568b1590057a64c1a537934d0f7c94b380c9fb23758bbd8 doesnot match with server generated signature .Setting Http status code 401]]

[2013-11-24T15:17:00.097+0000] [glassfish 4.0] [SEVERE] [] [TokenVendingMachineLogger] [tid: _ThreadID=19 _ThreadName=http-listener-1(2)] [timeMillis: 1385306220097] [levelValue: 1000] [[Error validating login request for username : useruser]]`

if someone can help give points to resolve it; also I hope there is nothing special needs to be done to suit Identity TVM code to run on glassfish?

---

EDIT

When I deploy IdentityTVM.war (out of the box that comes with download) on ElasticBeanstalk - it works perfectly. I think problem is with the way I am modifying code to work on glassfish. I am doing following changes in TVM Code;

1. com.amazonaws.tvm.Configuration: hardcoded three items with my TVMUser (created in IAM) credentials (AWS_ACCESS_KEY_ID,AWS_SECRET_KEY,APP_NAME)

2. TokenVendingMachinePolicy.json: changed my policy as below;

   {"Statement": [ {"Effect":"Allow","Action":["s3:PutObject","s3:GetObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::MyBUCKET/__USERNAME__/*"}, {"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::MyBUCKET","Condition":{"StringLike":{"s3:prefix":"__USERNAME__/"}}}, {"Effect":"Deny","Action":["iam:*", "sts:*", "sdb:*"],"Resource":"*"}]}

Am I following right steps to modify IdentityTVM for deployment of glassfish? I have to use glassfish since our architecture have a cluster environment based on it.

Answer 1

I think this will be a problem with your endpoints not matching up, ie:

Client:

AwsCredential.properties

tokenVendingMachineURL=tvm.mydomain.com

TVM

endpoint derived from

HttpServletRequest.getServerName()

I was having the same 401 problem and this was the cause of it. See my post on the Amazon Mobile Forums: https://forums.aws.amazon.com/thread.jspa?threadID=143949

The TVM was using localhost as the endpoint. I needed to update my vhosts file for the project to contain ProxyPreserveHost On

Hope this helps.