SSH Authenticate using a Smart Card Private Key

See more SSH Examples

Demonstrates using a private key stored on an HSM (smart card or token) for SSH public-key authentication. A JSON template locates the private and public key objects by class, key type, and label, and the returned handles are bound to an SshKey object.

integer li_rc
integer li_Success
oleobject loo_Pkcs11
string ls_Pin
integer li_UserType
oleobject loo_JsonTemplate
integer li_PrivKeyHandle
integer li_PubKeyHandle
oleobject loo_SshKey
oleobject loo_Ssh
integer li_Port

li_Success = 0

//  This example requires the Chilkat API to have been previously unlocked.
//  See Global Unlock Sample for sample code.

//  Demonstrates using a private key stored on an HSM (smart card or token) for SSH public-key
//  authentication.  Public-key authentication means the client uses the private key, while the
//  corresponding public key is installed on the server under the SSH account.
//  
//  Note: Chilkat's PKCS#11 implementation runs on Windows, Linux, macOS, and other supported
//  operating systems.

loo_Pkcs11 = create oleobject
li_rc = loo_Pkcs11.ConnectToNewObject("Chilkat.Pkcs11")
if li_rc < 0 then
    destroy loo_Pkcs11
    MessageBox("Error","Connecting to COM object failed")
    return
end if

//  Use the PKCS#11 driver (.dll, .so, or .dylib) for your particular HSM.
loo_Pkcs11.SharedLibPath = "C:/Program Files (x86)/Gemalto/IDGo 800 PKCS#11/IDPrimePKCS11.dll"

//  The HSM PIN should come from a secure source rather than being hard-coded.
ls_Pin = "0000"

//  Normal user = 1
li_UserType = 1

li_Success = loo_Pkcs11.QuickSession(li_UserType,ls_Pin)
if li_Success = 0 then
    Write-Debug loo_Pkcs11.LastErrorText
    destroy loo_Pkcs11
    return
end if

//  Provide a template describing the PKCS#11 object to find: an RSA private key labeled
//  "MySshKey".  For how such a key is originally imported, see
//  PKCS11 Import SSH Key
loo_JsonTemplate = create oleobject
li_rc = loo_JsonTemplate.ConnectToNewObject("Chilkat.JsonObject")

loo_JsonTemplate.UpdateString("class","private_key")
loo_JsonTemplate.UpdateString("key_type","rsa")
loo_JsonTemplate.UpdateString("label","MySshKey")

li_PrivKeyHandle = loo_Pkcs11.FindObject(loo_JsonTemplate)
if li_PrivKeyHandle = 0 then
    Write-Debug loo_Pkcs11.LastErrorText
    destroy loo_Pkcs11
    destroy loo_JsonTemplate
    return
end if

//  The handle is only valid for the duration of this PKCS#11 session.  To use the key in a
//  later session, find it again.
Write-Debug "private key handle: " + string(li_PrivKeyHandle)

//  Find the corresponding public key by changing the class in the same template.
loo_JsonTemplate.UpdateString("class","public_key")

li_PubKeyHandle = loo_Pkcs11.FindObject(loo_JsonTemplate)
if li_PubKeyHandle = 0 then
    Write-Debug loo_Pkcs11.LastErrorText
    destroy loo_Pkcs11
    destroy loo_JsonTemplate
    return
end if

Write-Debug "public key handle: " + string(li_PubKeyHandle)

//  Create an empty SSH key object and tell it to use the PKCS#11 handles, indicating the key type.
loo_SshKey = create oleobject
li_rc = loo_SshKey.ConnectToNewObject("Chilkat.SshKey")

li_Success = loo_SshKey.UsePkcs11(loo_Pkcs11,li_PrivKeyHandle,li_PubKeyHandle,"rsa")
if li_Success = 0 then
    Write-Debug loo_SshKey.LastErrorText
    destroy loo_Pkcs11
    destroy loo_JsonTemplate
    destroy loo_SshKey
    return
end if

loo_Ssh = create oleobject
li_rc = loo_Ssh.ConnectToNewObject("Chilkat.Ssh")

li_Port = 22
li_Success = loo_Ssh.Connect("ssh.example.com",li_Port)
if li_Success = 0 then
    Write-Debug loo_Ssh.LastErrorText
    destroy loo_Pkcs11
    destroy loo_JsonTemplate
    destroy loo_SshKey
    destroy loo_Ssh
    return
end if

//  Authentication uses the existing PKCS#11 session.  The signing happens on the smart card --
//  the private key never leaves the device.
li_Success = loo_Ssh.AuthenticatePk("mySshLogin",loo_SshKey)
if li_Success = 0 then
    Write-Debug loo_Ssh.LastErrorText
    destroy loo_Pkcs11
    destroy loo_JsonTemplate
    destroy loo_SshKey
    destroy loo_Ssh
    return
end if

Write-Debug "Public-key authentication successful."

//  ... use the authenticated SSH session ...

loo_Ssh.Disconnect()

loo_Pkcs11.Logout()
loo_Pkcs11.CloseSession()


destroy loo_Pkcs11
destroy loo_JsonTemplate
destroy loo_SshKey
destroy loo_Ssh