topic Re: Access Denied in Integration and Testing

Access Denied

rbjohnson78 — Mon, 22 Jun 2015 16:56:04 GMT

I am trying to access this page apitest.authorize.net/soap/v1/Service.asmx?wsdl and I'm getting an access denied error.

Has anyone seen this before?

Re: Access Denied

RaynorC1emen7 — Mon, 22 Jun 2015 17:50:43 GMT

Work fine for me. How are you accessing it?

Re: Access Denied

Lilith — Tue, 07 Jul 2015 15:38:17 GMT

@rbjohnson78 This is the first report we've seen of this error.

Could you provide me with the IP address(es) of the computer(s) where you see this error, please?

Also, had you been connecting to us previously? What sort of API calls, and how often?

Having that information might help us figure out the problem. Thanks in advance.

Re: Access Denied

rbjohnson78 — Tue, 04 Aug 2015 21:25:46 GMT

We have been connecting fine for a while, up until the change from SHA-1 to SHA-2. I have called a few times to our merchant and authorize.net, and they stated that they found we have upto 160 api calls per minute. We don't see any issues on our side, but it appears our IP is blacklisted. Not sure where to go from here.

Our computers are coming from 216.66.77.166.

Re: Access Denied

RichardH — Wed, 05 Aug 2015 01:04:38 GMT

Hello @rbjohnson78

Using SSL Labs server test, I checked the server you specified using https://www.ssllabs.com/ssltest/analyze.html?d=aramarkdemo.renovosoftware.com

According to the results, your server is only configured for TLS 1.0 using SHA1.

RIchard

Re: Access Denied

rbjohnson78 — Wed, 05 Aug 2015 14:31:50 GMT

This is response I got from Authorize.net below... The IP is our firewall, and I was told we have the latest certs installed. I get 2 different responses, so I'm not sure which direction to persue. If our IP is blocked and we could get that removed, and we are still having the issue, then I know I need to figure out some how to beef up the cert that is built in or something.

Hello Robert,

We have found the issue. For this developer in Sandbox we have seen excessive amount of API calls and the IP address was blocked. We see this IP address submitting up to 160 calls every few minutes to Sandbox consistently.

You should only be posting to Sandbox API when testing code changes/updates or any new integration they are creating to our APIs. There shouldn?t be any need to constantly post to Sandbox in this volume.

Can you please provide any explanation as to the activity they are submitting to Sandbox on why they need to submit so many transactions like this so often? We would need this information before requesting the removal of their IP address from the block we have in place in Sandbox.

Thank you for contacting Customer Support.

Regards,

Ashley G

Authorize.Net Customer Support

Re: Access Denied

Lilith — Wed, 05 Aug 2015 14:33:06 GMT

@rbjohnson78 Typically, if we're to blacklist an IP address, it'd be after identifying the merchant, after which we'd make repeated efforts to contact them to alert them to the blacklist. I'll have the IP address checked just in case.

But since you mentioned this started after we started using a SHA-2 certificate, it's more likely your solution is having issues with negotiating TLS with us, stemming from it not being able to validate our certificates.

Which server OS are you running? And does your solution depend on any particular framework or component, such as .NET, Ruby, OpenSSL, Java, etc.? Whatever details you can provide may help narrow down the problem.

Re: Access Denied

rbjohnson78 — Wed, 05 Aug 2015 14:58:44 GMT

That would be very helpful if you can check. I will look into the server side.

Re: Access Denied

Lilith — Wed, 05 Aug 2015 15:08:15 GMT

@rbjohnson78 I'm going to follow up on that email you received as well. Thanks.

Re: Access Denied

rbjohnson78 — Wed, 05 Aug 2015 15:09:35 GMT

Thank you! I appreciate it!

Re: Access Denied

Lilith — Wed, 05 Aug 2015 16:05:01 GMT

@rbjohnson78 OK, I see what had happened. You were in fact blacklisted, but the communication didn't come from the usual escalation channels. We'll refine our processes to make sure we reach out more quickly should we ever need to blacklist a connection--and we apologize for the delay.

We can remove you from the blacklist--but first, we'd like to know if you were load testing, or if you had some malfunctioning code you've since resolved.

Re: Access Denied

rbjohnson78 — Wed, 05 Aug 2015 16:06:57 GMT

I believe we had a bad test database import, and since have fixed it. If we could get removed, that would be great. We are also working on getting our TLS encryption bumped up to 256.

Thanks for all the help!

Re: Access Denied

rbjohnson78 — Wed, 05 Aug 2015 19:48:35 GMT

@Lilith How long will it take before we are removed from the blacklist? Also, is there a way to find out who would be getting the emails on these. No one I have talked to has seen any emails on us getting blacklisted.

Re: Access Denied

Lilith — Wed, 05 Aug 2015 19:51:35 GMT

@rbjohnson78 We would normally be contacting those listed on the Sandbox account, by email initially if possible.

I'll work on getting you off the blacklist right away and will follow up once that's done.

Re: Access Denied

rbjohnson78 — Wed, 05 Aug 2015 20:12:13 GMT

Thank you again for all the help @Lilith

Re: Access Denied

Lilith — Thu, 06 Aug 2015 18:00:04 GMT

@rbjohnson78 We're still working on this but the necessary tickets have been filed to restore access to your IP address.

Re: Access Denied

Lilith — Thu, 06 Aug 2015 19:14:37 GMT

@rbjohnson78 We've lifted the blacklist. Please try connecting now, and let us know if you have issues. Thanks.

Re: Access Denied

rbjohnson78 — Thu, 06 Aug 2015 19:16:39 GMT

@Lilith It is working! Thank you so much!

Re: Access Denied

EunaAuthorize09 — Wed, 23 Sep 2015 12:58:46 GMT

Hi there, I have an issue regarding the "Access Denied" and I've called the customer support for gateway. How do I solve this issue you can verify my issue in this link. http://ez2eat.com/test.php .

Re: Access Denied

Lilith — Fri, 25 Sep 2015 16:13:30 GMT

@EunaAuthorize09 When I use that link I see your query URL in plain text, and no further action occurs.

If you're getting an Access Denied message, could you include a screenshot of the error, please? There is usually an ID string included on the page, and we can investigate any blacklisting from there.

Also, what is your originating IP address? Should I presume it's 104.239.222.241, or is it another address?