Error Code 40103 when using variables in parameters

[patander]

Hello Team

I am running into the following issue using the Duo Admin API with Postman. When I run a GET request such as the following, I get an HTTP status code of 200 and a valid response.

https://{{duo-API-HOST}}/admin/v1/users?username=xxx.yyy

When instead of the actual username I use a variable in the request URL, which resolves to the same username (when hovering over with the mouse, as seen in the following screenshot)

I get the following error:
code: 40103
message: Invalid signature in request credentials

I am confused as to why one request with the username value works and the same request with the identical username passed as a variable value does not.

Is this a Postman-specific issue? I am using the Pre-Request Script at the end of this post. Could it be that the reason for the invalid signatures is that the “params” used for construction of the signature do not actually use the resolved key=value pair (i.e. username=xxx.yyy) but the unresolved key=value pair (such as username={{username}})?

Thanks in advance for you help!

Best regards
Patrick

######################################################################
let pc = require(‘postman-collection’);
let cryptoJS = require(‘crypto-js’);
let moment = require(‘moment’);

let DATE = (moment().format(“ddd, DD MMM YYYY HH:mm:ss ZZ”));
pm.environment.set(“duo-DATE”, DATE)

let METHOD = request.method;

let URL_OBJECT = new pc.Url(request.url);

//HOST is retrieved from the environment variable itself, since parsing the hostname using
//postman-collection’s URL object will just give you the variable name.
let HOST = pm.environment.get(“duo-API-HOST”)

let PATH = URL_OBJECT.getPath();
let QUERY = URL_OBJECT.getQueryString();

let HMAC_STRING = DATE + “\n”
+ METHOD + “\n”
+ HOST + “\n”
+ PATH + “\n”
+ QUERY

let HMACd = cryptoJS.HmacSHA1(HMAC_STRING, pm.environment.get(“admin-skey”)).toString();

pm.environment.set(“duo-admin-HMAC”, HMACd)

[patander · Accepted solution]

For those interested, I found the answer to my question here: https://github.com/postmanlabs/postman-app-support/issues/6078

Based on what I found out from this discussion, I made the following change to the Pre-Request Script and that way it works:

before: let QUERY = URL_OBJECT.getQueryString();
after: let QUERY = pm.variables.replaceIn(URL_OBJECT.getQueryString());

Cheers
Patrick