DataFlex

SSH Authenticate using Smart Card Private Key

See more SSH Examples

Demonstrates how to use a private key stored on an HSM (smartcard or token) for SSH public-key authentication. (Public-key authentication means the client, which is your application, uses the private key, while the corresponding public key is installed on the server under your SSH account.)

Note: This example requires Chilkat v9.5.0.96 or later.

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Variant vPkcs11
    Handle hoPkcs11
    String sPin
    Integer iUserType
    Variant vJsonTemplate
    Handle hoJsonTemplate
    UInteger iPrivKeyHandle
    UInteger iPubKeyHandle
Key    Handle hoSshKey
    Handle hoSsh
    String sTemp1

    Move False To iSuccess

    // This example requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // Note: Chilkat's PKCS11 implementation runs on Windows, Linux, Mac OS X, and other supported operating systems.

    Get Create (RefClass(cComChilkatPkcs11)) To hoPkcs11
    If (Not(IsComObjectCreated(hoPkcs11))) Begin
        Send CreateComObject of hoPkcs11
    End

    // Use the PKCS11 driver (.dll, .so, .dylib) for your particular HSM.
    // For example:
    Set ComSharedLibPath Of hoPkcs11 To "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS11.dll"

    // Use your HSM's PIN.
    Move "0000" To sPin

    // Normal user = 1
    Move 1 To iUserType

    // Establish a logged-on user session with the HSM.
    Get ComQuickSession Of hoPkcs11 iUserType sPin To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Provide a template to find a PKCS11 object.
    Get Create (RefClass(cComChilkatJsonObject)) To hoJsonTemplate
    If (Not(IsComObjectCreated(hoJsonTemplate))) Begin
        Send CreateComObject of hoJsonTemplate
    End

    // Find an RSA private key with the label "MySshKey".
    // Here's an example of how the key was originally imported: 
    // PKCS11 Import SSH Key
    Get ComUpdateString Of hoJsonTemplate "class" "private_key" To iSuccess
    Get ComUpdateString Of hoJsonTemplate "key_type" "rsa" To iSuccess
    Get ComUpdateString Of hoJsonTemplate "label" "MySshKey" To iSuccess

    Get pvComObject of hoJsonTemplate to vJsonTemplate
    Get ComFindObject Of hoPkcs11 vJsonTemplate To iPrivKeyHandle
    If (iPrivKeyHandle = 0) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // The private key handle is only valid during the PKCS11 session.
    // If you wish to use the private key in another PKCS11 session,
    // you'll first need to find it.  See:  
    Showln "private key handle: " iPrivKeyHandle

    // We'll also need the PKCS11 public key handle
    // Modify the template by updating the "class" to "public_key"
    Get ComUpdateString Of hoJsonTemplate "class" "public_key" To iSuccess

    Get pvComObject of hoJsonTemplate to vJsonTemplate
    Get ComFindObject Of hoPkcs11 vJsonTemplate To iPubKeyHandle
    If (iPubKeyHandle = 0) Begin
        Get ComLastErrorText Of hoPkcs11 To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "public key handle: " iPubKeyHandle

    // Create an empty SSH key object, and tell it to use the PKCS11 handles.
    // We also need to indicate the key type.
    Get Create (RefClass(cComChilkatSshKey)) To hoSshKey
    If (Not(IsComObjectCreated(hoSshKey))) Begin
        Send CreateComObject of hoSshKey
    End
    Get pvComObject of hoPkcs11 to vPkcs11
    Get ComUsePkcs11 Of hoSshKey vPkcs11 iPrivKeyHandle iPubKeyHandle "rsa" To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSshKey To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Create an SSH object and authenticate using the SSH key, which will utilize the existing PKCS11 session.
    Get Create (RefClass(cComChilkatSsh)) To hoSsh
    If (Not(IsComObjectCreated(hoSsh))) Begin
        Send CreateComObject of hoSsh
    End

    Get ComConnect Of hoSsh "my-ssh-server.com" 22 To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // This is where the PKCS11 private key on the smart card is used.
    Get pvComObject of hoSshKey to vSshKey
    Get ComAuthenticatePk Of hoSsh "your_ssh_username" vSshKey To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoSsh To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    // Do whatever it is your app needs to do using the authenticated SSH session....
    // ...
    // ...

    Send ComDisconnect To hoSsh

    Get ComLogout Of hoPkcs11 To iSuccess
    Get ComCloseSession Of hoPkcs11 To iSuccess


End_Procedure