---
sourceDocument: Yokohama IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/yokohama/it-operations-management

 Release :

    - yokohama

ft:locale :

    - en-US

ft:publication_title :

    - Yokohama IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Configure key-based MID Web Server authentication

# Configure key-based MID Web Server authentication {#ariaid-title1}

* Release version: Yokohama
* 
* Updated January 30, 2025
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 2 minutes to read

Provide added security to your MID Web Server extension by using key-based authentication. Generate an authentication token to be sent in the Authorization header of incoming client requests.{#configure-mid-web-server-extension-metric-data__ph_MIDWebServerShortDesc}

## Before you begin

Note:  
This procedure is only for compatibility with releases prior to Yokohama. For details on the procedure in the Yokohama release for configuring the MID Web Server, see [Configure the MID Web Server extension](https://www.servicenow.com/docs/_6TI0U~gdVg0W_7HIWP7AA "The MID Web Server is a MID Server extension that enables developing REST APIs to send events and metrics to the MID Server. The extension is leveraged by other MID Server extensions, such as Metric Intelligence, MID WebService Event Listener, and the Agent Client Collector websocket endpoint extension.").

* Deploy and start a MID Server.
* Configure a MID Web Server extension and select Keybased as the authentication type. For details, see [Configure the MID Web Server extension](https://www.servicenow.com/docs/_6TI0U~gdVg0W_7HIWP7AA "The MID Web Server is a MID Server extension that enables developing REST APIs to send events and metrics to the MID Server. The extension is leveraged by other MID Server extensions, such as Metric Intelligence, MID WebService Event Listener, and the Agent Client Collector websocket endpoint extension.").

{#configure-mid-web-server-extension-metric-data__ul_mvm_k4y_zrb}

Role required: agent_admin

## Procedure

1. Using a script program, create a token by constructing a string using defined elements of the HTTP/HTTPS request (HTTP verb, content type header, and request path, received from the client accessing the MID Web Server extension endpoints).
2. Create an HMAC (Hash Message Authentication Code) of the string by signing the generated string with the auto-generated secret key that is displayed in the Secret Key.  
   This key is unique per context.
3. Provide information to send this authentication token in the request Authorization header.  
   {#configure-mid-web-server-extension-metric-data__table_dsc_k3w_nrb__entry__2}

   | Item | Value |
   |-|-|
   | Path to a web service API for sending raw data | URL format: https://\<MID Server IP address\>:\<port number\>/api/mid/sa/metrics Use a port number that matches one of the port numbers set up in the Web Server extension. Example: http://10.10.10.10:8097/api/mid/sa/metrics |
   | Request type | POST |
   | Date format | yyyy-MM-dd'T'HH:mm:ss.SSS'Z' For example: 2016-06-08T20:54:58.917Z |
   | Content-Type | application/json |
   [ ]

   {#configure-mid-web-server-extension-metric-data__table_dsc_k3w_nrb}

   Use the following request elements to generate the required string: HTTP-Verb, Content-Type, Date, and request path. Specify these elements and place them in this order:
   * HTTP-Verb + "\\n" +
   * Content-Type + "\\n" +
   * Date + "\\n" +
   * Request-Path

   {#configure-mid-web-server-extension-metric-data__ul_bg4_p3w_nrb}

   For this example, the request string is:

   <kbd class="ph userinput">POST\napplication/json\n2016-06-08T20:54:58.917Z\n/api/mid/sa/metrics</kbd>

   For the timestamp requirement, a valid timestamp that uses HTTP date header is required for authenticating the request. Ensure that the timestamp is within 15 minutes of the MID
   Server.
{#configure-mid-web-server-extension-metric-data__steps_nd5_flc_bx}

## How to generate the HMAC of the string that uses defined elements of the HTTP/HTTPS request, using Java {#configure-mid-web-server-extension-metric-data__example_mzb_yxs_1sb}

    package sample;
    import com.glide.util;
    import java.security.SignatureException;

    import javax.crypto.Mac;
    import javax.crypto.spec.SecretKeySpec;

    public class AuthUtil {
    	
    private static final String HMAC_SHA1_ALGORITHM = "HmacSHA1";

    /***
     * Generates base64-encode the HMAC(Hash Message Authentication Code) of input data
     * 
     * @param data
     * @param key
     * @return
     * @throws java.security.SignatureException
     */
    public static String signData(String data, String key) throws java.security.SignatureException {
    	String result;
    	try {
    		// get an hmac_sha1 key from the raw key bytes
    		SecretKeySpec signingKey = new SecretKeySpec(key.getBytes(), HMAC_SHA1_ALGORITHM);

    		// create hmac_sha1 Mac instance and initialize with the signing key
    		Mac = Mac.getInstance(HMAC_SHA1_ALGORITHM);
    		mac.init(signingKey);

    		// compute the hmac on input data bytes
    		byte[] rawHmac = mac.doFinal(data.getBytes("UTF-8"));

    		// base64-encode the hmac
    		result = Base64.encode(rawHmac);

    	} catch (Exception e) {
    		throw new SignatureException("Failed to generate HMAC : " + e.getMessage());
    	}
    	return result;
    }
    }