javarestsslapache-httpclient-4.xcyber-ark

Cyberark retrieve password from vault using JAVA


I am working on a Java application, trying to retrieve the password from a Cyberark Vault using Rest API call. I get the data back for the API call through the browser (Edge/Chrome)after importing the client certificate. I tried adding the same cert into java truststore "C:\jdk1.8.0_77\jre\lib\security\cacerts" but when making the call, I get the below error

403 - Forbidden: Access is denied. You do not have permission to view this directory or page using the credentials that you supplied.

I used to get this error in the browser as well until I imported the client cert. So what am I missing now? Are there any attributes/variables that needs to be set to make the call? I am using Apache HttpClient. I am passing the truststore, password as VM arguments in Eclipse.

        KeyStore keyStore = null;
    String baseUrl = "https://cyberarkservices:23456/api/Accounts?AppID=myapp&Safe=Test&Object=testobject";
            try {
        keyStore = KeyStore.getInstance("JKS");
    } catch (KeyStoreException e) {
        System.out.println(e.getStackTrace());
                }

    FileInputStream instream = null;
    try {
        instream = new FileInputStream(new File(System.getProperty("javax.net.ssl.trustStore")));
        keyStore.load(instream, System.getProperty("javax.net.ssl.trustStorePassword").toCharArray());
    } catch (Exception e) {
        System.out.println("Exception occured loading cacerts: " + e);
    } finally {
        instream.close();
    }

    // Trust own CA and all self-signed certs
    SSLContext sslcontext = null;
    try {
        sslcontext = SSLContexts.custom()
                .loadKeyMaterial(keyStore, System.getProperty("javax.net.ssl.trustStorePassword").toCharArray())
                .build();

    } catch (KeyManagementException | UnrecoverableKeyException | NoSuchAlgorithmException | KeyStoreException e) {
        System.out.println("Exception occured loading SSL key material: " + e);
    }

    HttpClientBuilder builder = HttpClientBuilder.create();
    SSLConnectionSocketFactory sslConnectionFactory = new SSLConnectionSocketFactory(sslcontext,
            new String[] { "TLSv1.1", "TLSv1.2" }, null,
         NoopHostnameVerifier.INSTANCE);
            builder.setSSLSocketFactory(sslConnectionFactory);
    builder.setSSLSocketFactory(sslConnectionFactory);

    CloseableHttpClient httpclient = builder.build();
    CloseableHttpResponse response = null;

    try {
        
        HttpGet httpget = new HttpGet(baseUrl);
    
        // CALL API
        String reply = "";
        response = httpclient.execute(httpget);

        String res_xml = EntityUtils.toString(response.getEntity());
        if(res_xml!=null && !res_xml.isEmpty())
        {
             reply = res_xml;   
             System.out.println(reply);
            
        }

Solution

  • I got it to work. Just read in/loaded the client certificate(.p12) directly from java while making the API call without importing it into trust store or keystore file. Passed in the cert location/password as VM arguments and it worked just fine.