DataFlex

SSH Keyboard-Interactive Authentication

Demonstrates keyboard-interactive authentication with an SSH server. StartKeyboardAuth returns XML describing the server's prompts, and ContinueKeyboardAuth submits each response. Authentication is complete when the returned XML contains either a success or an error node.

Background: Keyboard-interactive is SSH's flexible, prompt-driven method: rather than assuming a single password, the server asks one or more questions — a password, a one-time code, a security question — and the client answers each. This is how SSH supports two-factor and other challenge-response schemes. The prompt XML also indicates whether each response should be echoed, so a client knows when to mask input. A server may issue several rounds, so a robust implementation loops until it sees success or error rather than assuming one exchange is enough.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoSsh
    String sHostname
    Integer iPort
    String sXmlResponse
    Handle hoXml
    String sPassword
    String sTemp1
    Boolean bTemp1

    Move False To iSuccess

    //  This example requires the Chilkat API to have been previously unlocked.
    //  See Global Unlock Sample for sample code.

    //  Demonstrates keyboard-interactive authentication with an SSH server.  The server sends one or
    //  more prompts as XML, and the application answers each with ContinueKeyboardAuth.

    Get Create (RefClass(cComChilkatSsh)) To hoSsh
    If (Not(IsComObjectCreated(hoSsh))) Begin
        Send CreateComObject of hoSsh
    End

    Set ComConnectTimeoutMs Of hoSsh To 5000
    Set ComReadTimeoutMs Of hoSsh To 15000

    Move "ssh.example.com" To sHostname
    Move 22 To iPort
    Get ComConnect Of hoSsh sHostname iPort To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Begin keyboard-interactive authentication.  The returned XML describes the server's prompts.
    Get ComStartKeyboardAuth Of hoSsh "mySshLogin" To sXmlResponse
    Get ComLastMethodSuccess Of hoSsh To bTemp1
    If (bTemp1 = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  If the server sent a user authentication banner, an application may display it before
    //  prompting.
    Get ComUserAuthBanner Of hoSsh To sTemp1
    Showln "UserAuthBanner: " sTemp1

    Get Create (RefClass(cComChilkatXml)) To hoXml
    If (Not(IsComObjectCreated(hoXml))) Begin
        Send CreateComObject of hoXml
    End
    Get ComLoadXml Of hoXml sXmlResponse To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoXml To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Authentication is complete when the XML contains either a "success" or an "error" node.
    Get ComHasChildWithTag Of hoXml "success" To bTemp1
    If (bTemp1) Begin
        Showln "No password required, already authenticated."
        Procedure_Return
    End

    Get ComHasChildWithTag Of hoXml "error" To bTemp1
    If (bTemp1) Begin
        Showln "Authentication failed."
        Procedure_Return
    End

    //  Normally you would not hard-code the password in source.  You should instead obtain it
    //  from an interactive prompt, environment variable, or a secrets vault.
    Move "mySshPassword" To sPassword

    //  Answer the prompt.  Typically one call is enough, but a server may issue several rounds of
    //  prompts, so a robust client loops until it sees "success" or "error".
    Get ComContinueKeyboardAuth Of hoSsh sPassword To sXmlResponse
    Get ComLastMethodSuccess Of hoSsh To bTemp1
    If (bTemp1 = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComLoadXml Of hoXml sXmlResponse To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoXml To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Get ComHasChildWithTag Of hoXml "success" To bTemp1
    If (bTemp1) Begin
        Showln "SSH keyboard-interactive authentication successful."
        Procedure_Return
    End

    Get ComHasChildWithTag Of hoXml "error" To bTemp1
    If (bTemp1) Begin
        Showln "Authentication failed."
    End



End_Procedure