SQL Server
SQL Server
Azure OpenID Connect Step 2 -- Get id_token and Validate
See more OIDC Examples
After getting the endpoints by querying the Azure's OIDC well-known discovery document (OpenID Configuration document), we use the authorization_endpoint to get the id_token, and then validate it..Chilkat SQL Server Downloads
-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
DECLARE @hr int
DECLARE @iTmp0 int
DECLARE @iTmp1 int
-- Important: Do not use nvarchar(max). See the warning about using nvarchar(max).
DECLARE @sTmp0 nvarchar(4000)
DECLARE @success int
SELECT @success = 0
-- This example requires the Chilkat API to have been previously unlocked.
-- See Global Unlock Sample for sample code.
-- In our previous example (Azure Fetch OpenID Connect metadata document) we fetched
-- the OpenID configuration document which is JSON which contains an entry for authorization_endpoint.
DECLARE @authorization_endpoint nvarchar(4000)
SELECT @authorization_endpoint = 'https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize'
-- The OpenID Connect metadata document also contained a jwks_uri entry. This is the JSON Web Key Set (JWKS),
-- which is a set of keys containing the public keys used to verify any JSON Web Token (JWT) (in this case the id_token)
-- issued by the authorization server and signed using the RS256 signing algorithm.
DECLARE @jwks_uri nvarchar(4000)
SELECT @jwks_uri = 'https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys'
-- We're going to send the following GET request, but it will be sent through an interactive web browser (not by Chilkat).
-- The following code will form the URL that is to be programmatically loaded and sent in a browser.
-- GET https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?
-- client_id=6731de76-14a6-49ae-97bc-6eba6914391e
-- &response_type=id_token
-- &redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
-- &response_mode=form_post
-- &scope=openid
-- &state=12345
-- &nonce=678910
-- Use this object to set params and then get the URL-encoded query params string
DECLARE @req int
EXEC @hr = sp_OACreate 'Chilkat.HttpRequest', @req OUT
IF @hr <> 0
BEGIN
PRINT 'Failed to create ActiveX component'
RETURN
END
EXEC sp_OAMethod @req, 'AddParam', NULL, 'client_id', '{client_id}'
EXEC sp_OAMethod @req, 'AddParam', NULL, 'response_type', 'id_token'
EXEC sp_OAMethod @req, 'AddParam', NULL, 'redirect_uri', 'http://localhost:3017/'
EXEC sp_OAMethod @req, 'AddParam', NULL, 'response_mode', 'form_post'
EXEC sp_OAMethod @req, 'AddParam', NULL, 'scope', 'openid'
DECLARE @prng int
EXEC @hr = sp_OACreate 'Chilkat.Prng', @prng OUT
EXEC sp_OAMethod @prng, 'GenRandom', @sTmp0 OUT, 3, 'decimal'
EXEC sp_OAMethod @req, 'AddParam', NULL, 'state', @sTmp0
EXEC sp_OAMethod @prng, 'GenRandom', @sTmp0 OUT, 4, 'decimal'
EXEC sp_OAMethod @req, 'AddParam', NULL, 'nonce', @sTmp0
DECLARE @encodedParams nvarchar(4000)
EXEC sp_OAMethod @req, 'GetUrlEncodedParams', @encodedParams OUT
PRINT @encodedParams
-- Sample URL encoded params:
-- client_id=6731de76-14a6-49ae-97bc-6eba6914391e&redirect_uri=http%3A%2F%2Flocalhost%3A3017%2F&response_mode=form_post&scope=openid&state=3572902&nonce=57352474
-- This is the URL to be programmatically loaded and sent in an interactive web browser..
DECLARE @sbUrl int
EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbUrl OUT
EXEC sp_OAMethod @sbUrl, 'Append', @success OUT, @authorization_endpoint
EXEC sp_OAMethod @sbUrl, 'Append', @success OUT, '?'
EXEC sp_OAMethod @sbUrl, 'Append', @success OUT, @encodedParams
DECLARE @url nvarchar(4000)
EXEC sp_OAMethod @sbUrl, 'GetAsString', @url OUT
-- Before we launch the browser with the contents of sbUrl, create a socket to listen for the eventual callback..
DECLARE @listenSock int
EXEC @hr = sp_OACreate 'Chilkat.Socket', @listenSock OUT
-- This is the connection received from the browser.
DECLARE @browserSock int
EXEC @hr = sp_OACreate 'Chilkat.Socket', @browserSock OUT
-- Listen at the port indicated by the redirect_uri above.
DECLARE @backLog int
SELECT @backLog = 5
EXEC sp_OAMethod @listenSock, 'BindAndListen', @success OUT, 3017, @backLog
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @listenSock, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @req
EXEC @hr = sp_OADestroy @prng
EXEC @hr = sp_OADestroy @sbUrl
EXEC @hr = sp_OADestroy @listenSock
EXEC @hr = sp_OADestroy @browserSock
RETURN
END
-- Wait for the browser's connection in a background thread.
-- (We'll send load the URL into the browser following this..)
-- Wait a max of 60 seconds before giving up.
DECLARE @maxWaitMs int
SELECT @maxWaitMs = 30000
DECLARE @task int
EXEC sp_OAMethod @listenSock, 'AcceptNextAsync', @task OUT, @maxWaitMs, @browserSock
EXEC sp_OAMethod @task, 'Run', @success OUT
-- -------------------------------------------------------------------
-- At this point, your application should load the URL in a browser.
DECLARE @oauth2 int
EXEC @hr = sp_OACreate 'Chilkat.OAuth2', @oauth2 OUT
EXEC sp_OAMethod @oauth2, 'LaunchBrowser', @success OUT, @url
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @oauth2, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @req
EXEC @hr = sp_OADestroy @prng
EXEC @hr = sp_OADestroy @sbUrl
EXEC @hr = sp_OADestroy @listenSock
EXEC @hr = sp_OADestroy @browserSock
EXEC @hr = sp_OADestroy @oauth2
RETURN
END
-- -------------------------------------------------------------------
-- Wait for the listenSock's task to complete.
EXEC sp_OAMethod @task, 'Wait', @success OUT, @maxWaitMs
EXEC sp_OAGetProperty @task, 'StatusInt', @iTmp0 OUT
EXEC sp_OAGetProperty @task, 'TaskSuccess', @iTmp1 OUT
IF Not @success or (@iTmp0 <> 7) or (@iTmp1 <> 1)
BEGIN
IF Not @success
BEGIN
-- The task.LastErrorText applies to the Wait method call.
EXEC sp_OAGetProperty @task, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
END
ELSE
BEGIN
-- The ResultErrorText applies to the underlying task method call (i.e. the AcceptNextConnection)
EXEC sp_OAGetProperty @task, 'Status', @sTmp0 OUT
PRINT @sTmp0
EXEC sp_OAGetProperty @task, 'ResultErrorText', @sTmp0 OUT
PRINT @sTmp0
END
EXEC @hr = sp_OADestroy @task
EXEC @hr = sp_OADestroy @req
EXEC @hr = sp_OADestroy @prng
EXEC @hr = sp_OADestroy @sbUrl
EXEC @hr = sp_OADestroy @listenSock
EXEC @hr = sp_OADestroy @browserSock
EXEC @hr = sp_OADestroy @oauth2
RETURN
END
-- If we get to this point, a connection on listenSock was accepted, and the redirected POST
-- is waiting to be read on the connected socket.
-- The POST we are going to read contains the following:
-- POST /myapp/ HTTP/1.1
-- Host: localhost
-- Content-Type: application/x-www-form-urlencoded
--
-- id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik1uQ19WWmNB...&state=12345
-- But first.. we no longer need the listen socket...
-- Stop listening on port 3017.
EXEC sp_OAMethod @listenSock, 'Close', @success OUT, 10
EXEC @hr = sp_OADestroy @task
-- We're acting as a temporary web server to receive this one redirected HTTP request..
-- Read the start line of the request.. (i.e. the "POST /myapp/ HTTP/1.1")
DECLARE @startLine nvarchar(4000)
EXEC sp_OAMethod @browserSock, 'ReceiveUntilMatch', @startLine OUT, CHAR(13) + CHAR(10)
EXEC sp_OAGetProperty @browserSock, 'LastMethodSuccess', @iTmp0 OUT
IF @iTmp0 = 0
BEGIN
EXEC sp_OAGetProperty @browserSock, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @req
EXEC @hr = sp_OADestroy @prng
EXEC @hr = sp_OADestroy @sbUrl
EXEC @hr = sp_OADestroy @listenSock
EXEC @hr = sp_OADestroy @browserSock
EXEC @hr = sp_OADestroy @oauth2
RETURN
END
-- Read the request header.
DECLARE @requestHeader nvarchar(4000)
EXEC sp_OAMethod @browserSock, 'ReceiveUntilMatch', @requestHeader OUT, CHAR(13) + CHAR(10) + CHAR(13) + CHAR(10)
EXEC sp_OAGetProperty @browserSock, 'LastMethodSuccess', @iTmp0 OUT
IF @iTmp0 = 0
BEGIN
EXEC sp_OAGetProperty @browserSock, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @req
EXEC @hr = sp_OADestroy @prng
EXEC @hr = sp_OADestroy @sbUrl
EXEC @hr = sp_OADestroy @listenSock
EXEC @hr = sp_OADestroy @browserSock
EXEC @hr = sp_OADestroy @oauth2
RETURN
END
PRINT @requestHeader
PRINT '----'
-- Read the body.
-- The body will contain "id_token= eyJ......"
DECLARE @sbRequestBody int
EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbRequestBody OUT
EXEC sp_OAMethod @browserSock, 'ReceiveSb', @success OUT, @sbRequestBody
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @browserSock, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @req
EXEC @hr = sp_OADestroy @prng
EXEC @hr = sp_OADestroy @sbUrl
EXEC @hr = sp_OADestroy @listenSock
EXEC @hr = sp_OADestroy @browserSock
EXEC @hr = sp_OADestroy @oauth2
EXEC @hr = sp_OADestroy @sbRequestBody
RETURN
END
EXEC sp_OAMethod @sbRequestBody, 'GetAsString', @sTmp0 OUT
PRINT @sTmp0
-- Given that we're acting as a web server, we must send a response..
-- We can now send our HTTP response.
DECLARE @sbResponseHtml int
EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbResponseHtml OUT
EXEC sp_OAMethod @sbResponseHtml, 'Append', @success OUT, '<html><body><p>Thank you!</b></body</html>'
DECLARE @sbResponse int
EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbResponse OUT
EXEC sp_OAMethod @sbResponse, 'Append', @success OUT, 'HTTP/1.1 200 OK' + CHAR(13) + CHAR(10)
EXEC sp_OAMethod @sbResponse, 'Append', @success OUT, 'Content-Length: '
EXEC sp_OAGetProperty @sbResponseHtml, 'Length', @iTmp0 OUT
EXEC sp_OAMethod @sbResponse, 'AppendInt', @success OUT, @iTmp0
EXEC sp_OAMethod @sbResponse, 'Append', @success OUT, CHAR(13) + CHAR(10)
EXEC sp_OAMethod @sbResponse, 'Append', @success OUT, 'Content-Type: text/html' + CHAR(13) + CHAR(10)
EXEC sp_OAMethod @sbResponse, 'Append', @success OUT, CHAR(13) + CHAR(10)
EXEC sp_OAMethod @sbResponse, 'AppendSb', @success OUT, @sbResponseHtml
EXEC sp_OAMethod @sbResponse, 'GetAsString', @sTmp0 OUT
EXEC sp_OAMethod @browserSock, 'SendString', @success OUT, @sTmp0
EXEC sp_OAMethod @browserSock, 'Close', @success OUT, 50
-- Get the id_token from the sbRequestBody that we just received.
-- (Remember, we're acting as the web server, thus we received the redirect request..)
DECLARE @hashTab int
EXEC @hr = sp_OACreate 'Chilkat.Hashtable', @hashTab OUT
EXEC sp_OAMethod @sbRequestBody, 'GetAsString', @sTmp0 OUT
EXEC sp_OAMethod @hashTab, 'AddQueryParams', @success OUT, @sTmp0
-- See https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens#validating-an-id-token
-- for more information about ID tokens..
DECLARE @idToken nvarchar(4000)
EXEC sp_OAMethod @hashTab, 'LookupStr', @idToken OUT, 'id_token'
DECLARE @jwt int
EXEC @hr = sp_OACreate 'Chilkat.Jwt', @jwt OUT
-- Let's see if the time constraints, if any, are valid.
-- The above JWT was created on the afternoon of 16-May-2016, with an expiration of 1 hour.
-- If the current system time is before the "nbf" time, or after the "exp" time,
-- then IsTimeValid will return false/0.
-- Also, we'll allow a leeway of 60 seconds to account for any clock skew.
-- Note: If the token has no "nbf" or "exp" claim fields, then IsTimeValid is always true.
DECLARE @leeway int
SELECT @leeway = 60
DECLARE @bTimeValid int
EXEC sp_OAMethod @jwt, 'IsTimeValid', @bTimeValid OUT, @idToken, @leeway
PRINT 'time constraints valid: ' + @bTimeValid
-- Now let's recover the original claims JSON (the payload).
DECLARE @payload nvarchar(4000)
EXEC sp_OAMethod @jwt, 'GetPayload', @payload OUT, @idToken
-- The payload will likely be in compact form:
PRINT @payload
-- We can format for human viewing by loading it into Chilkat's JSON object
-- and emit.
DECLARE @json int
EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @json OUT
EXEC sp_OAMethod @json, 'Load', @success OUT, @payload
EXEC sp_OASetProperty @json, 'EmitCompact', 0
EXEC sp_OAMethod @json, 'Emit', @sTmp0 OUT
PRINT @sTmp0
-- Sample output:
-- {
-- "aud": "f125d695-c50e-456e-a579-a486f06d1213",
-- "iss": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0",
-- "iat": 1626535322,
-- "nbf": 1626535322,
-- "exp": 1626539222,
-- "aio": "AWQAm/8TAAAAHQncmY0VvhgyMIhfleHX3DjsGfmlPM1CopkJ3mPnBUnCxrJ0ubruaACEhwGO7NsoHBhqFEzRzPxOq7MtuGVFsql+qJKZx8vQCszKYEPX9Wb3b5+d5KJTABHCIH48bTFd",
-- "idp": "https://sts.windows.net/9188040d-6c67-4c5b-b112-36a304b66dad/",
-- "nonce": "1519043321",
-- "rh": "0.ARgAZt2NbdFosEOvXOMbS33VzZXWJfEOxW5FpXmkhvBtEhMYALQ.",
-- "sub": "RMIZlHJ7hfsJmL8Qq3h6M0nPi4g-HEavnAFgxzaT2KM",
-- "tid": "6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd",
-- "uti": "-BXGHxvfREW-r9HI5NBiAA",
-- "ver": "2.0"
-- }
-- We can recover the original JOSE header in the same way:
DECLARE @joseHeader nvarchar(4000)
EXEC sp_OAMethod @jwt, 'GetHeader', @joseHeader OUT, @idToken
-- The payload will likely be in compact form:
PRINT @joseHeader
-- We can format for human viewing by loading it into Chilkat's JSON object
-- and emit.
DECLARE @jsonJoseHeader int
EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @jsonJoseHeader OUT
EXEC sp_OAMethod @jsonJoseHeader, 'Load', @success OUT, @joseHeader
EXEC sp_OASetProperty @jsonJoseHeader, 'EmitCompact', 0
EXEC sp_OAMethod @jsonJoseHeader, 'Emit', @sTmp0 OUT
PRINT @sTmp0
-- Sample output:
-- {
-- "typ": "JWT",
-- "alg": "RS256",
-- "kid": "nOo3ZDrODXEK1jKWhXslHR_KXEg"
-- }
-- Finally, we need to fetch the JSON Web Key Sets from the jwks_uri
-- and use it to verify the id_token's RSA signature.
DECLARE @sbJwks int
EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbJwks OUT
DECLARE @http int
EXEC @hr = sp_OACreate 'Chilkat.Http', @http OUT
EXEC sp_OAMethod @http, 'QuickGetSb', @success OUT, @jwks_uri, @sbJwks
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @http, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC @hr = sp_OADestroy @req
EXEC @hr = sp_OADestroy @prng
EXEC @hr = sp_OADestroy @sbUrl
EXEC @hr = sp_OADestroy @listenSock
EXEC @hr = sp_OADestroy @browserSock
EXEC @hr = sp_OADestroy @oauth2
EXEC @hr = sp_OADestroy @sbRequestBody
EXEC @hr = sp_OADestroy @sbResponseHtml
EXEC @hr = sp_OADestroy @sbResponse
EXEC @hr = sp_OADestroy @hashTab
EXEC @hr = sp_OADestroy @jwt
EXEC @hr = sp_OADestroy @json
EXEC @hr = sp_OADestroy @jsonJoseHeader
EXEC @hr = sp_OADestroy @sbJwks
EXEC @hr = sp_OADestroy @http
RETURN
END
DECLARE @jwkset int
EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @jwkset OUT
EXEC sp_OAMethod @jwkset, 'LoadSb', @success OUT, @sbJwks
EXEC sp_OASetProperty @jwkset, 'EmitCompact', 0
EXEC sp_OAMethod @jwkset, 'Emit', @sTmp0 OUT
PRINT @sTmp0
-- A sample jwkset:
-- {
-- "keys": [
-- {
-- "kty": "RSA",
-- "use": "sig",
-- "kid": "nOo3ZDrODXEK1jKWhXslHR_KXEg",
-- "x5t": "nOo3ZDrODXEK1jKWhXslHR_KXEg",
-- "n": "oaLLT9hkcSj ... NVrZdUdTBQ",
-- "e": "AQAB",
-- "x5c": [
-- "MIIDBTC ... MRku44Dw7R"
-- ],
-- "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
-- },
-- {
-- "kty": "RSA",
-- "use": "sig",
-- "kid": "l3sQ-50cCH4xBVZLHTGwnSR7680",
-- "x5t": "l3sQ-50cCH4xBVZLHTGwnSR7680",
-- "n": "sfsXMXW ... AYkwb6xUQ",
-- "e": "AQAB",
-- "x5c": [
-- "MIIDBTCCA ... BWrh+/vJ"
-- ],
-- "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
-- },
-- {
-- "kty": "RSA",
-- "use": "sig",
-- "kid": "DqUu8gf-nAgcyjP3-SuplNAXAnc",
-- "x5t": "DqUu8gf-nAgcyjP3-SuplNAXAnc",
-- "n": "1n7-nWSL ... V3pFWhQ",
-- "e": "AQAB",
-- "x5c": [
-- "MIIC8TC ... 9pIcnkPQ=="
-- ],
-- "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
-- },
-- {
-- "kty": "RSA",
-- "use": "sig",
-- "kid": "OzZ5Dbmcso9Qzt2ModGmihg30Bo",
-- "x5t": "OzZ5Dbmcso9Qzt2ModGmihg30Bo",
-- "n": "01re9a2BU ... 5OzQ6Q",
-- "e": "AQAB",
-- "x5c": [
-- "MIIC8TC ... YmwJ6sDdRvQ=="
-- ],
-- "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
-- }
-- ]
-- }
-- We should have an RSA key with kid matching the kid from the joseHeader..
DECLARE @kid nvarchar(4000)
EXEC sp_OAMethod @jsonJoseHeader, 'StringOf', @kid OUT, 'kid'
-- Find the RSA key with the specified key id
DECLARE @jwk int
EXEC sp_OAMethod @jwkset, 'FindRecord', @jwk OUT, 'keys', 'kid', @kid, 1
EXEC sp_OAGetProperty @jwkset, 'LastMethodSuccess', @iTmp0 OUT
IF @iTmp0 = 0
BEGIN
PRINT 'Failed to find a matching RSA key in the JWK key set...'
EXEC @hr = sp_OADestroy @req
EXEC @hr = sp_OADestroy @prng
EXEC @hr = sp_OADestroy @sbUrl
EXEC @hr = sp_OADestroy @listenSock
EXEC @hr = sp_OADestroy @browserSock
EXEC @hr = sp_OADestroy @oauth2
EXEC @hr = sp_OADestroy @sbRequestBody
EXEC @hr = sp_OADestroy @sbResponseHtml
EXEC @hr = sp_OADestroy @sbResponse
EXEC @hr = sp_OADestroy @hashTab
EXEC @hr = sp_OADestroy @jwt
EXEC @hr = sp_OADestroy @json
EXEC @hr = sp_OADestroy @jsonJoseHeader
EXEC @hr = sp_OADestroy @sbJwks
EXEC @hr = sp_OADestroy @http
EXEC @hr = sp_OADestroy @jwkset
RETURN
END
DECLARE @verified int
DECLARE @pubkey int
EXEC @hr = sp_OACreate 'Chilkat.PublicKey', @pubkey OUT
EXEC sp_OAMethod @jwk, 'Emit', @sTmp0 OUT
EXEC sp_OAMethod @pubkey, 'LoadFromString', @success OUT, @sTmp0
IF @success = 0
BEGIN
EXEC sp_OAGetProperty @pubkey, 'LastErrorText', @sTmp0 OUT
PRINT @sTmp0
EXEC sp_OAMethod @jwk, 'Emit', @sTmp0 OUT
PRINT @sTmp0
END
ELSE
BEGIN
EXEC sp_OAMethod @jwt, 'VerifyJwtPk', @verified OUT, @idToken, @pubkey
PRINT 'Verified: ' + @verified
END
EXEC @hr = sp_OADestroy @jwk
EXEC @hr = sp_OADestroy @req
EXEC @hr = sp_OADestroy @prng
EXEC @hr = sp_OADestroy @sbUrl
EXEC @hr = sp_OADestroy @listenSock
EXEC @hr = sp_OADestroy @browserSock
EXEC @hr = sp_OADestroy @oauth2
EXEC @hr = sp_OADestroy @sbRequestBody
EXEC @hr = sp_OADestroy @sbResponseHtml
EXEC @hr = sp_OADestroy @sbResponse
EXEC @hr = sp_OADestroy @hashTab
EXEC @hr = sp_OADestroy @jwt
EXEC @hr = sp_OADestroy @json
EXEC @hr = sp_OADestroy @jsonJoseHeader
EXEC @hr = sp_OADestroy @sbJwks
EXEC @hr = sp_OADestroy @http
EXEC @hr = sp_OADestroy @jwkset
EXEC @hr = sp_OADestroy @pubkey
END
GO