Asking about Content Server web service

Question

                 I have studied Adobe Content Server 4 in evaluation version. I already have finished to setup ACS4 and it
                 can work with sample shop. But now, my company already have own shop for e-commerce purpose. In order to
                 integrate my shop to ACS4, I must use web service to get some information from ACS4 for inventory system.
                 So I have read document many times but still not clear yet. Now I investigate DRM work flow from
                 "Web Service API Inspector" that provide by ACS4. I write own php script for listing all ebook.
                 The following is xml request for listing all book in ACS4 that I copied from "Web Service API Inspector".
                                    http://58.97.41.195:8080/admin/ManageResourceItem
                                    <request action="get" auth="builtin" xmlns="http://ns.adobe.com/adept">
                                      <nonce>RQ4nngAAAAI=</nonce>
                                      <expiration>2010-06-17T09:07:22-00:00</expiration>
                                      <hmac>DP502XxihvqWMDwCezAAVdJBkrA=</hmac>
                                    </request>
                 In the above request I'm very confuse about nonce and hmac value.
                            - What is none created from ? And do you have any sample code to create nonce value
                            - In this case, I understand that hmac is created from the following php function
                                    $request =    '<request action="get" auth="builtin" xmlns="http://ns.adobe.com/adept">' .
                                                       '<nonce>RQ4nngAAAAI=</nonce>' .
                                                       '<expiration>2010-06-17T09:07:22-00:00</expiration>' .
                                                       '</request>';
                                    $key = 'xxxxx' ; // where xxxxx is password for logging in to the ACS4 admin console
                                    hash_hmac('sha1', $request, $key);
                 Am I right ?

Answer 1

Nonce is a contraction of  "Number used only once" and is a standard  way to prevent message replay.  Nonces must be unique until the time specified in expiration.  If the nonce is not unique you will get an E_ADEPT_REPLAY error message.
The signature element is the hmac of a particular infoset serialization of the xml.  For examples of this in Java see the sample code for UploadTest et al. If you ask support, they can provide sample serialization in php.  Hashing the raw bytes of the message as you did is not correct.
An alternative for your development is to turn off authentication by adding the following line into your admin config file:
com.adobe.adept.persist.skipAuthentication=true
The signature element will still be required, but it doesn't matter what the value is other than it being valid base64 encoding, so you could just use aaaa for example.
However if you do turn off authentication then it is up to you make sure the admin service is secure (by restricting access through vpn/firewall rules or whatever other means you choose)