SSH Authenticate using a Smart Card Private Key

See more SSH Examples

Demonstrates using a private key stored on an HSM (smart card or token) for SSH public-key authentication. A JSON template locates the private and public key objects by class, key type, and label, and the returned handles are bound to an SshKey object.

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    --  This example requires the Chilkat API to have been previously unlocked.
    --  See Global Unlock Sample for sample code.

    --  Demonstrates using a private key stored on an HSM (smart card or token) for SSH public-key
    --  authentication.  Public-key authentication means the client uses the private key, while the
    --  corresponding public key is installed on the server under the SSH account.
    --  
    --  Note: Chilkat's PKCS#11 implementation runs on Windows, Linux, macOS, and other supported
    --  operating systems.

    DECLARE @pkcs11 int
    EXEC @hr = sp_OACreate 'Chilkat.Pkcs11', @pkcs11 OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    --  Use the PKCS#11 driver (.dll, .so, or .dylib) for your particular HSM.
    EXEC sp_OASetProperty @pkcs11, 'SharedLibPath', 'C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS11.dll'

    --  The HSM PIN should come from a secure source rather than being hard-coded.
    DECLARE @pin nvarchar(4000)
    SELECT @pin = '0000'

    --  Normal user = 1
    DECLARE @userType int
    SELECT @userType = 1

    EXEC sp_OAMethod @pkcs11, 'QuickSession', @success OUT, @userType, @pin
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pkcs11
        RETURN
      END

    --  Provide a template describing the PKCS#11 object to find: an RSA private key labeled
    --  "MySshKey".  For how such a key is originally imported, see
    --  PKCS11 Import SSH Key
    DECLARE @jsonTemplate int
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @jsonTemplate OUT

    EXEC sp_OAMethod @jsonTemplate, 'UpdateString', @success OUT, 'class', 'private_key'
    EXEC sp_OAMethod @jsonTemplate, 'UpdateString', @success OUT, 'key_type', 'rsa'
    EXEC sp_OAMethod @jsonTemplate, 'UpdateString', @success OUT, 'label', 'MySshKey'

    DECLARE @privKeyHandle int
    EXEC sp_OAMethod @pkcs11, 'FindObject', @privKeyHandle OUT, @jsonTemplate
    IF @privKeyHandle = 0
      BEGIN
        EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pkcs11
        EXEC @hr = sp_OADestroy @jsonTemplate
        RETURN
      END

    --  The handle is only valid for the duration of this PKCS#11 session.  To use the key in a
    --  later session, find it again.

    PRINT 'private key handle: ' + @privKeyHandle

    --  Find the corresponding public key by changing the class in the same template.
    EXEC sp_OAMethod @jsonTemplate, 'UpdateString', @success OUT, 'class', 'public_key'

    DECLARE @pubKeyHandle int
    EXEC sp_OAMethod @pkcs11, 'FindObject', @pubKeyHandle OUT, @jsonTemplate
    IF @pubKeyHandle = 0
      BEGIN
        EXEC sp_OAGetProperty @pkcs11, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pkcs11
        EXEC @hr = sp_OADestroy @jsonTemplate
        RETURN
      END


    PRINT 'public key handle: ' + @pubKeyHandle

    --  Create an empty SSH key object and tell it to use the PKCS#11 handles, indicating the key type.
    DECLARE @sshKey int
    EXEC @hr = sp_OACreate 'Chilkat.SshKey', @sshKey OUT

    EXEC sp_OAMethod @sshKey, 'UsePkcs11', @success OUT, @pkcs11, @privKeyHandle, @pubKeyHandle, 'rsa'
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @sshKey, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pkcs11
        EXEC @hr = sp_OADestroy @jsonTemplate
        EXEC @hr = sp_OADestroy @sshKey
        RETURN
      END

    DECLARE @ssh int
    EXEC @hr = sp_OACreate 'Chilkat.Ssh', @ssh OUT

    DECLARE @port int
    SELECT @port = 22
    EXEC sp_OAMethod @ssh, 'Connect', @success OUT, 'ssh.example.com', @port
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pkcs11
        EXEC @hr = sp_OADestroy @jsonTemplate
        EXEC @hr = sp_OADestroy @sshKey
        EXEC @hr = sp_OADestroy @ssh
        RETURN
      END

    --  Authentication uses the existing PKCS#11 session.  The signing happens on the smart card --
    --  the private key never leaves the device.
    EXEC sp_OAMethod @ssh, 'AuthenticatePk', @success OUT, 'mySshLogin', @sshKey
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @pkcs11
        EXEC @hr = sp_OADestroy @jsonTemplate
        EXEC @hr = sp_OADestroy @sshKey
        EXEC @hr = sp_OADestroy @ssh
        RETURN
      END


    PRINT 'Public-key authentication successful.'

    --  ... use the authenticated SSH session ...

    EXEC sp_OAMethod @ssh, 'Disconnect', NULL

    EXEC sp_OAMethod @pkcs11, 'Logout', @success OUT
    EXEC sp_OAMethod @pkcs11, 'CloseSession', @success OUT

    EXEC @hr = sp_OADestroy @pkcs11
    EXEC @hr = sp_OADestroy @jsonTemplate
    EXEC @hr = sp_OADestroy @sshKey
    EXEC @hr = sp_OADestroy @ssh


END
GO