OneRoster REST API requests rejected with "Invalid signature"

Dobes Vandermeer

Our OneRoster OAuth 1.0a implementation works well with other solutions, including ClassLink & Infinite Campus, but it does not work with Blackbaud, giving us an error "Invalid signature"


Has anyone successfully use BlackBaud's OneRoster API?  Did you run into a similar issue and find a way to work around it?


Here's an example request we would send, with specifics removed:

GET /ims/oneroster/v1p1/users?offset=0&limit=100&filter=status%3D'active' HTTP/1.1
    Accept: application/json, text/plain, */*
    authorization: OAuth oauth_consumer_key="K6....qg%3D%3D",oauth_nonce="jBDtXpISscIwPP95",oauth_signature_method="HMAC-SHA1",oauth_timestamp="1593211800",oauth_version="1.0",oauth_signature="nSJ...PII%3D"
    User-Agent: axios/0.19.2
    Host: xxxschool.myschoolapp.com
    Connection: close

And the error reply:

401 Unauthorized    
    date: Fri, 26 Jun 2020 22:50:00 GMT
    content-type: application/json; charset=utf-8
    content-length: 83
    connection: close
    server: nginx
    cache-control: no-cache
    pragma: no-cache
    expires: -1
    x-server-upstream: kpe1-webotr-d01

    {"Message":"Unauthorized - the Request requires authorization. [Invalid signature"}

I am wondering what would be the difference in signature calculation with Blackbaud versus the other OneRoster providers we have previously integrated with.


We did try contacting Blackbaud support but they directed us here.


Any help would be appreciated.


Thank you in advance,


Dobes

 

Dobes Vandermeer

Hi,


After some experimentation, I tried using HMAC-SHA256 to sign the OneRoster requests and it worked!


The documentation at https://webfiles.blackbaud.com/files/support/helpfiles/education/k12/full-help/content/bb-core-oauth.html says to use HMAC-SHA1 but that seems to be inaccurate.


Hopefully they can correct their documentation, as this really had me scratching my head for a long time.


Regards,


Dobes