220. EPMO Open Source Coordination Office Redaction File Detail Report

Produced by Araxis Merge on 5/25/2018 9:22:54 AM Central Daylight Time. See www.araxis.com for information about Merge. This report uses XHTML and CSS2, and is best viewed with a modern standards-compliant browser. For optimum results when printing this report, use landscape orientation and enable printing of background images and colours in your browser.

220.1 Files compared

#	Location	File	Last Modified
1	C:\AraxisMergeCompare\Pri_un\ZIP\DSM-cif\Direct_API\application\views\api\onboarding\services	validate.php	Tue May 22 13:19:28 2018 UTC
2	C:\AraxisMergeCompare\Pri_re\ZIP\DSM-cif\Direct_API\application\views\api\onboarding\services	validate.php	Thu May 24 22:26:16 2018 UTC

220.2 Comparison summary

Description	Between Files 1 and 2
Description	Text Blocks	Lines
Unchanged	5	198
Changed	4	10
Inserted	0	0
Removed	0	0

220.3 Comparison options

Whitespace
Character case	Differences in character case are significant
Line endings	Differences in line endings (`CR` and `LF` characters) are ignored
CR/LF characters	Not shown in the comparison detail

220.4 Active regular expressions

No regular expressions were active.

220.5 Comparison detail

	1	<?php
	2	/**
	3	* @package direct-as -a-service
	4	* @subpack age views
	5	* @fileso urce
	6	/ /* */
	7
	8	$t his->load- >view('api /header');
	9	$t his->load- >view('api /nav');
	10	?>
	11	<h1><a h ref="/onbo arding/doc umentation /" class=" underline" >Documenta tion</a> & rarr; /dir ect/valida te - GET</ h1>
	12	<p>The v alidate we b service allows aut horized ap plications to check if a Direc t address is a trust ed recipie nt and can be access ed by send ing a GET request to /direct/v alidate.</ p>
	13	<h3>Auth entication </h3>
	14	<p>
	15	The API au thenticati on utilize d is based upon hash message a uthenticat ion code ( HMAC). HMA C is an au thenticati on method that combi nes a cryp tographic hash funct ion with a secret cr yptographi c key. Aft er the suc cessful re gistration of an app lication o n the API, a public and privat e key like the examp le below w ill be pro visioned f or its use .
	16	</p>
	17	<p class ="code">
	18	Public Key : REDACTED
	19	<br/>Priva te Key: RE DACTED
	20	</p>
	21	<p>
	22	On every r equest tha t an appli cation sen ds to the API they m ust includ e an Autho rization h eader. The authoriza tion heade r is a str ing that t he API wil l utilize to confirm the ident ity, and t he message content, of the sen der. The a uthorizati on header consists o f three pa rts. The f irst part is the API identifie r, represe nted by th e word "DA AS", which stands fo r Direct a s a Servic e. The API identifie r is follo wed by a s pace that separates it from th e identify ing conten t. The ide ntifying c ontent con sists of t he unique public key and the b ase64 enco ded HMAC h ash genera ted by the request c ontent and the priva te key, de limited by a colon. An example of the au thorizatio n header i s below.
	23	</p>
	24	<p class ="code">
	25	Authorizat ion: DAAS REDACTED
	26	</p>
	27	<p>
	28	The HMAC s tring is g enerated b y running an HMAC ha sh functio n on a pla in text st ring and t he applica tion's pri vate key. The plain text strin g that mus t be hashe d using HM AC is cons tructed as follows:
	29	<ul>
	30	<l i>HTTP Req uest Type< /li>
	31	<l i>Date</li >
	32	<l i>Content- MD5 (Optio nal)</li>
	33	<l i>URI</li>
	34	</ul>
	35	These valu es are sep arated by new line c haracters ("\n"). An example o f the plai n text str ing is bel ow:
	36	</p>
	37	<p class ="code">
	38	GET\n06/03 /2013 12:1 3:56 EST\n iB94gawbwU SiZy5FuruI OQ==\n/dir ect/valida te/format/ json?addre ss=untrust ed@<?php e cho CLINIC AL_DOMAIN; ?>
	39	</p>
	40	<p>
	41	The string above is hashed wit h the appl ication's private ke y using th e SHA-256 algorithm. A snippet of JavaSc ript code showing an example o f this is shown belo w:
	42	</p>
	43	<p class ="code">
	44	var hashSt ring = Cry ptoJS.Hmac SHA256("GE T\n06/03/2 013 12:13: 56 EDT\niB 94gawbwUSi Zy5FuruIOQ ==\n/direc t/validate /format/js on?address =untrusted @<?php ech o CLINICAL _DOMAIN;?> "," REDACTED ");
	45	<br/>var b ase64 = en code64(""+ hashString );
	46	<br/>var a uthorizati on = "DAAS REDACTED :"+base64;
	47	</p>
	48	<p>
	49	In the exa mple above the Conte nt MD5 is provided b ut this is an option al field. If the Con tent MD5 h eader is n ot specifi ed then th e hash sho uld not ha ve the MD5 specified either.
	50	</p>
	51	<h3>Head ers</h3>
	52	<div cla ss="column ">
	53	<div class ="left">
	54	<u l>
	55	<li> Authorizat ion</li>
	56	<p>
	57	The fi rst requir ed header is the Aut horization header co vered in t he Authent ication se ction at t he top of this page.
	58	</p>
	59	<li> Date or X- Daas-Date< /li>
	60	<p>
	61	The se cond requi red header that must be includ ed is the Date heade r. Some br owsers wil l not let an applica tion speci fy the Dat e header p rogrammati cally, so in this ca se it is a lso accept able to us e the X-Da as-Date he ader as th e API will interpret them inte rchangeabl y. This he ader shoul d be popul ated with the curren t date and time, in any standa rd format (including time zone informati on if not time zone agnostic), when the GET reques t is submi tted. The value supp lied in th e Date hea der must m atch the v alue used in the cre ation of t he hash st ring for t he Authori zation hea der.
	62	</p>
	63	</ ul>
	64	</div>
	65	<div class ="right">
	66	<u l>
	67	<li> Content-Md 5</li>
	68	<p>
	69	The op tional hea der is the Content-M d5 header. This head er should contain an MD5 hash of the GET query str ing. If th is header is specifi ed then it must also be includ ed in the hash strin g for the authorizat ion header . This ext ra securit y measure is not typ ically nec essary for GET reque sts, howev er the opt ion is ava ilable so that the p arameters sent in th e GET requ est can be validated by the AP I as not h aving been tampered with in tr ansit.
	70	</p>
	71	</ ul>
	72	</div>
	73	</div>
	74	<h3>Argu ments</h3>
	75	<ul>
	76	<li>Addres s</li>
	77	<p>
	78	Th is is a re quired fie ld and def ines what addresses need to be validated . This fie ld will ac cept comma or semi-c olon separ ated RFC82 2 addresse s, encoded with URI and base64 encoding.
	79	Ad dresses mu st be base 64 and the n URI enco ded for se curity rea sons so th at only al lowed char acters wil l be submi tted with the URI du ring the r equest.
	80	</p>
	81	</ul>
	82	<h3>Exam ple Respon se</h3>
	83	<ul>
	84	<li>Succes s</li>
	85	<u l>
	86	<li> HTTP-200, {"request_ id":1,"val id":true}< /li>
	87	<li> HTTP-200, {"request_ id":2,"mes sage":"use r@untruste d.health.m il is not a trusted recipient. ","valid": false}</li >
	88	</ ul>
	89	<li>Error< /li>
	90	<u l>
	91	<li> HTTP-401, {"request_ id":3,"mes sage":"Acc ess Denied . Authenti cation Fai led."}</li >
	92	<li> HTTP-403, {"request_ id":4,"mes sage":"Acc ess Denied . Use Not Authorized ."}</li>
	93	<li> HTTP-422, {"request_ id":5,"val id":false, "message": "Must prov ide addres s field."} </li>
	94	</ ul>
	95	</ul>
	96	<h3>Samp le Code</h 3>
	97	<p>
	98	Please cli ck <a href ="/onboard ing/docume ntation/va lidate_exa mple">here </a> to be taken to some sampl e code sni ppets for the valida te web ser vice.
	99	</p>
	100	</div>
	101	<?PHP $this->loa d->view('a pi/footer' ); ?>
	102	</di v>
	103	</ body>
	104	</html>