(SQL Server) Azure OpenID Connect Step 2 -- Get id_token and Validate

See more OIDC Examples

After getting the endpoints by querying the Azure's OIDC well-known discovery document (OpenID Configuration document), we use the authorization_endpoint to get the id_token, and then validate it..

For more information, see https://docs.microsoft.com/en-us/azure/active-directory/develop/v2-protocols-oidc

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    DECLARE @iTmp1 int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @success int

    -- In our previous example (Azure Fetch OpenID Connect metadata document) we fetched
    -- the OpenID configuration document which is JSON which contains an entry for authorization_endpoint.

    DECLARE @authorization_endpoint nvarchar(4000)
    SELECT @authorization_endpoint = 'https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/oauth2/v2.0/authorize'

    -- The OpenID Connect metadata document also contained a jwks_uri entry.  This is the JSON Web Key Set (JWKS),
    -- which is a set of keys containing the public keys used to verify any JSON Web Token (JWT) (in this case the id_token)
    -- issued by the authorization server and signed using the RS256 signing algorithm. 
    DECLARE @jwks_uri nvarchar(4000)
    SELECT @jwks_uri = 'https://login.microsoftonline.com/6d8ddd66-68d1-44b0-af5c-e31b4b7ee5cd/discovery/v2.0/keys'

    -- We're going to send the following GET request, but it will be sent through an interactive web browser (not by Chilkat).
    -- The following code will form the URL that is to be programmatically loaded and sent in a browser.

    -- GET https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize?
    -- client_id=6731de76-14a6-49ae-97bc-6eba6914391e
    -- &response_type=id_token
    -- &redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F
    -- &response_mode=form_post
    -- &scope=openid
    -- &state=12345
    -- &nonce=678910

    -- Use this object to set params and then get the URL-encoded query params string 
    DECLARE @req int
    -- Use "Chilkat_9_5_0.HttpRequest" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.HttpRequest', @req OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    EXEC sp_OAMethod @req, 'AddParam', NULL, 'client_id', 'f125d695-c50e-456e-a579-a486f06d1213'
    EXEC sp_OAMethod @req, 'AddParam', NULL, 'response_type', 'id_token'
    EXEC sp_OAMethod @req, 'AddParam', NULL, 'redirect_uri', 'http://localhost:3017/'
    EXEC sp_OAMethod @req, 'AddParam', NULL, 'response_mode', 'form_post'
    EXEC sp_OAMethod @req, 'AddParam', NULL, 'scope', 'openid'
    DECLARE @prng int
    -- Use "Chilkat_9_5_0.Prng" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Prng', @prng OUT

    EXEC sp_OAMethod @prng, 'GenRandom', @sTmp0 OUT, 3, 'decimal'
    EXEC sp_OAMethod @req, 'AddParam', NULL, 'state', @sTmp0
    EXEC sp_OAMethod @prng, 'GenRandom', @sTmp0 OUT, 4, 'decimal'
    EXEC sp_OAMethod @req, 'AddParam', NULL, 'nonce', @sTmp0

    DECLARE @encodedParams nvarchar(4000)
    EXEC sp_OAMethod @req, 'GetUrlEncodedParams', @encodedParams OUT

    PRINT @encodedParams

    -- Sample URL encoded params:
    -- client_id=6731de76-14a6-49ae-97bc-6eba6914391e&redirect_uri=http%3A%2F%2Flocalhost%3A3017%2F&response_mode=form_post&scope=openid&state=3572902&nonce=57352474

    -- This is the URL to be programmatically loaded and sent in an interactive web browser..
    DECLARE @sbUrl int
    -- Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbUrl OUT

    EXEC sp_OAMethod @sbUrl, 'Append', @success OUT, @authorization_endpoint
    EXEC sp_OAMethod @sbUrl, 'Append', @success OUT, '?'
    EXEC sp_OAMethod @sbUrl, 'Append', @success OUT, @encodedParams
    DECLARE @url nvarchar(4000)
    EXEC sp_OAMethod @sbUrl, 'GetAsString', @url OUT

    -- Before we launch the browser with the contents of sbUrl, create a socket to listen for the eventual callback..

    DECLARE @listenSock int
    -- Use "Chilkat_9_5_0.Socket" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Socket', @listenSock OUT

    -- Listen at the port indicated by the redirect_uri above.
    DECLARE @backLog int
    SELECT @backLog = 5
    EXEC sp_OAMethod @listenSock, 'BindAndListen', @success OUT, 3017, @backLog
    IF @success <> 1
      BEGIN
        EXEC sp_OAGetProperty @listenSock, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @req
        EXEC @hr = sp_OADestroy @prng
        EXEC @hr = sp_OADestroy @sbUrl
        EXEC @hr = sp_OADestroy @listenSock
        RETURN
      END

    -- Wait for the browser's connection in a background thread.
    -- (We'll send load the URL into the browser following this..)
    -- Wait a max of 60 seconds before giving up.
    DECLARE @maxWaitMs int
    SELECT @maxWaitMs = 60000
    DECLARE @task int
    EXEC sp_OAMethod @listenSock, 'AcceptNextConnectionAsync', @task OUT, @maxWaitMs
    EXEC sp_OAMethod @task, 'Run', @success OUT

    -- -------------------------------------------------------------------
    -- At this point, your application should load the URL in a browser.
    -- You'll need to add code here to do it..

    -- For example, 
    -- in C#: System.Diagnostics.Process.Start(url);
    -- in Java: Desktop.getDesktop().browse(new URI(url));
    -- in VBScript: Set wsh=WScript.CreateObject("WScript.Shell")
    --              wsh.Run url
    -- in Xojo: ShowURL(url)  (see http://docs.xojo.com/index.php/ShowURL)
    -- in Dataflex: Runprogram Background "c:\Program Files\Internet Explorer\iexplore.exe" sUrl        
    -- The account owner would interactively accept or deny the authorization request.

    -- Add the code to load the url in a web browser here...
    -- Add the code to load the url in a web browser here...
    -- Add the code to load the url in a web browser here...
    -- System.Diagnostics.Process.Start(url);

    -- -------------------------------------------------------------------

    -- Wait for the listenSock's task to complete.
    EXEC sp_OAMethod @task, 'Wait', @success OUT, @maxWaitMs
    EXEC sp_OAGetProperty @task, 'StatusInt', @iTmp0 OUT
    EXEC sp_OAGetProperty @task, 'TaskSuccess', @iTmp1 OUT
    IF Not @success or (@iTmp0 <> 7) or (@iTmp1 <> 1)
      BEGIN
        IF Not @success
          BEGIN
            -- The task.LastErrorText applies to the Wait method call.
            EXEC sp_OAGetProperty @task, 'LastErrorText', @sTmp0 OUT
            PRINT @sTmp0
          END
        ELSE
          BEGIN
            -- The ResultErrorText applies to the underlying task method call (i.e. the AcceptNextConnection)
            EXEC sp_OAGetProperty @task, 'Status', @sTmp0 OUT
            PRINT @sTmp0
            EXEC sp_OAGetProperty @task, 'ResultErrorText', @sTmp0 OUT
            PRINT @sTmp0
          END
        EXEC @hr = sp_OADestroy @task

        EXEC @hr = sp_OADestroy @req
        EXEC @hr = sp_OADestroy @prng
        EXEC @hr = sp_OADestroy @sbUrl
        EXEC @hr = sp_OADestroy @listenSock
        RETURN
      END

    -- If we get to this point, a connection on listenSock was accepted, and the redirected POST
    -- is waiting to be read on the connected socket.
    -- The POST we are going to read contains the following:

    -- POST /myapp/ HTTP/1.1
    -- Host: localhost
    -- Content-Type: application/x-www-form-urlencoded
    -- 
    -- id_token=eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsIng1dCI6Ik1uQ19WWmNB...&state=12345

    -- But first.. we no longer need the listen socket...
    -- Stop listening on port 3017.
    EXEC sp_OAMethod @listenSock, 'Close', @success OUT, 10

    -- Get the connected socket.
    DECLARE @sock int
    -- Use "Chilkat_9_5_0.Socket" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Socket', @sock OUT

    EXEC sp_OAMethod @sock, 'LoadTaskResult', @success OUT, @task
    EXEC @hr = sp_OADestroy @task

    -- We're acting as a temporary web server to receive this one redirected HTTP request..
    -- Read the start line of the request.. (i.e. the "POST /myapp/ HTTP/1.1")
    DECLARE @startLine nvarchar(4000)
    EXEC sp_OAMethod @sock, 'ReceiveUntilMatch', @startLine OUT, CHAR(13) + CHAR(10)
    EXEC sp_OAGetProperty @sock, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @sock, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @req
        EXEC @hr = sp_OADestroy @prng
        EXEC @hr = sp_OADestroy @sbUrl
        EXEC @hr = sp_OADestroy @listenSock
        EXEC @hr = sp_OADestroy @sock
        RETURN
      END

    -- Read the request header.
    DECLARE @requestHeader nvarchar(4000)
    EXEC sp_OAMethod @sock, 'ReceiveUntilMatch', @requestHeader OUT, CHAR(13) + CHAR(10) + CHAR(13) + CHAR(10)
    EXEC sp_OAGetProperty @sock, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 <> 1
      BEGIN
        EXEC sp_OAGetProperty @sock, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @req
        EXEC @hr = sp_OADestroy @prng
        EXEC @hr = sp_OADestroy @sbUrl
        EXEC @hr = sp_OADestroy @listenSock
        EXEC @hr = sp_OADestroy @sock
        RETURN
      END


    PRINT @requestHeader

    PRINT '----'

    -- Read the body.
    -- The body will contain "id_token= eyJ......"
    DECLARE @sbRequestBody int
    -- Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbRequestBody OUT

    EXEC sp_OAMethod @sock, 'ReceiveSb', @success OUT, @sbRequestBody
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @sock, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @req
        EXEC @hr = sp_OADestroy @prng
        EXEC @hr = sp_OADestroy @sbUrl
        EXEC @hr = sp_OADestroy @listenSock
        EXEC @hr = sp_OADestroy @sock
        EXEC @hr = sp_OADestroy @sbRequestBody
        RETURN
      END

    EXEC sp_OAMethod @sbRequestBody, 'GetAsString', @sTmp0 OUT
    PRINT @sTmp0

    -- Given that we're acting as a web server, we must send a response..
    -- We can now send our HTTP response.
    DECLARE @sbResponseHtml int
    -- Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbResponseHtml OUT

    EXEC sp_OAMethod @sbResponseHtml, 'Append', @success OUT, '<html><body><p>Thank you!</b></body</html>'

    DECLARE @sbResponse int
    -- Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbResponse OUT

    EXEC sp_OAMethod @sbResponse, 'Append', @success OUT, 'HTTP/1.1 200 OK' + CHAR(13) + CHAR(10)
    EXEC sp_OAMethod @sbResponse, 'Append', @success OUT, 'Content-Length: '
    EXEC sp_OAGetProperty @sbResponseHtml, 'Length', @iTmp0 OUT
    EXEC sp_OAMethod @sbResponse, 'AppendInt', @success OUT, @iTmp0
    EXEC sp_OAMethod @sbResponse, 'Append', @success OUT, CHAR(13) + CHAR(10)
    EXEC sp_OAMethod @sbResponse, 'Append', @success OUT, 'Content-Type: text/html' + CHAR(13) + CHAR(10)
    EXEC sp_OAMethod @sbResponse, 'Append', @success OUT, CHAR(13) + CHAR(10)
    EXEC sp_OAMethod @sbResponse, 'AppendSb', @success OUT, @sbResponseHtml

    EXEC sp_OAMethod @sbResponse, 'GetAsString', @sTmp0 OUT
    EXEC sp_OAMethod @sock, 'SendString', @success OUT, @sTmp0
    EXEC sp_OAMethod @sock, 'Close', @success OUT, 50

    -- Get the id_token from the sbRequestBody that we just received.
    -- (Remember, we're acting as the web server, thus we received the redirect request..)
    DECLARE @hashTab int
    -- Use "Chilkat_9_5_0.Hashtable" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Hashtable', @hashTab OUT

    EXEC sp_OAMethod @sbRequestBody, 'GetAsString', @sTmp0 OUT
    EXEC sp_OAMethod @hashTab, 'AddQueryParams', @success OUT, @sTmp0

    -- See https://docs.microsoft.com/en-us/azure/active-directory/develop/id-tokens#validating-an-id-token
    -- for more information about ID tokens..
    DECLARE @idToken nvarchar(4000)
    EXEC sp_OAMethod @hashTab, 'LookupStr', @idToken OUT, 'id_token'

    DECLARE @jwt int
    -- Use "Chilkat_9_5_0.Jwt" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Jwt', @jwt OUT

    -- Let's see if the time constraints, if any, are valid.
    -- The above JWT was created on the afternoon of 16-May-2016, with an expiration of 1 hour.
    -- If the current system time is before the "nbf" time, or after the "exp" time,
    -- then IsTimeValid will return false/0.
    -- Also, we'll allow a leeway of 60 seconds to account for any clock skew.
    -- Note: If the token has no "nbf" or "exp" claim fields, then IsTimeValid is always true.
    DECLARE @leeway int
    SELECT @leeway = 60
    DECLARE @bTimeValid int
    EXEC sp_OAMethod @jwt, 'IsTimeValid', @bTimeValid OUT, @idToken, @leeway

    PRINT 'time constraints valid: ' + @bTimeValid

    -- Now let's recover the original claims JSON (the payload).
    DECLARE @payload nvarchar(4000)
    EXEC sp_OAMethod @jwt, 'GetPayload', @payload OUT, @idToken
    -- The payload will likely be in compact form:

    PRINT @payload

    -- We can format for human viewing by loading it into Chilkat's JSON object
    -- and emit.
    DECLARE @json int
    -- Use "Chilkat_9_5_0.JsonObject" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @json OUT

    EXEC sp_OAMethod @json, 'Load', @success OUT, @payload
    EXEC sp_OASetProperty @json, 'EmitCompact', 0
    EXEC sp_OAMethod @json, 'Emit', @sTmp0 OUT
    PRINT @sTmp0

    -- Sample output:

    -- {
    --   "aud": "f125d695-c50e-456e-a579-a486f06d1213",
    --   "iss": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0",
    --   "iat": 1626535322,
    --   "nbf": 1626535322,
    --   "exp": 1626539222,
    --   "aio": "AWQAm/8TAAAAHQncmY0VvhgyMIhfleHX3DjsGfmlPM1CopkJ3mPnBUnCxrJ0ubruaACEhwGO7NsoHBhqFEzRzPxOq7MtuGVFsql+qJKZx8vQCszKYEPX9Wb3b5+d5KJTABHCIH48bTFd",
    --   "idp": "https://sts.windows.net/9188040d-6c67-4c5b-b112-36a304b66dad/",
    --   "nonce": "1519043321",
    --   "rh": "0.ARgAZt2NbdFosEOvXOMbS33VzZXWJfEOxW5FpXmkhvBtEhMYALQ.",
    --   "sub": "RMIZlHJ7hfsJmL8Qq3h6M0nPi4g-HEavnAFgxzaT2KM",
    --   "tid": "6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd",
    --   "uti": "-BXGHxvfREW-r9HI5NBiAA",
    --   "ver": "2.0"
    -- }

    -- We can recover the original JOSE header in the same way:
    DECLARE @joseHeader nvarchar(4000)
    EXEC sp_OAMethod @jwt, 'GetHeader', @joseHeader OUT, @idToken
    -- The payload will likely be in compact form:

    PRINT @joseHeader

    -- We can format for human viewing by loading it into Chilkat's JSON object
    -- and emit.
    DECLARE @jsonJoseHeader int
    -- Use "Chilkat_9_5_0.JsonObject" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @jsonJoseHeader OUT

    EXEC sp_OAMethod @jsonJoseHeader, 'Load', @success OUT, @joseHeader
    EXEC sp_OASetProperty @jsonJoseHeader, 'EmitCompact', 0
    EXEC sp_OAMethod @jsonJoseHeader, 'Emit', @sTmp0 OUT
    PRINT @sTmp0

    -- Sample output:

    -- {
    --   "typ": "JWT",
    --   "alg": "RS256",
    --   "kid": "nOo3ZDrODXEK1jKWhXslHR_KXEg"
    -- }

    -- Finally, we need to fetch the JSON Web Key Sets from the jwks_uri
    -- and use it to verify the id_token's RSA signature.
    DECLARE @sbJwks int
    -- Use "Chilkat_9_5_0.StringBuilder" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbJwks OUT

    DECLARE @http int
    -- Use "Chilkat_9_5_0.Http" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Http', @http OUT

    EXEC sp_OAMethod @http, 'QuickGetSb', @success OUT, @jwks_uri, @sbJwks
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @http, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @req
        EXEC @hr = sp_OADestroy @prng
        EXEC @hr = sp_OADestroy @sbUrl
        EXEC @hr = sp_OADestroy @listenSock
        EXEC @hr = sp_OADestroy @sock
        EXEC @hr = sp_OADestroy @sbRequestBody
        EXEC @hr = sp_OADestroy @sbResponseHtml
        EXEC @hr = sp_OADestroy @sbResponse
        EXEC @hr = sp_OADestroy @hashTab
        EXEC @hr = sp_OADestroy @jwt
        EXEC @hr = sp_OADestroy @json
        EXEC @hr = sp_OADestroy @jsonJoseHeader
        EXEC @hr = sp_OADestroy @sbJwks
        EXEC @hr = sp_OADestroy @http
        RETURN
      END

    DECLARE @jwkset int
    -- Use "Chilkat_9_5_0.JsonObject" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @jwkset OUT

    EXEC sp_OAMethod @jwkset, 'LoadSb', @success OUT, @sbJwks
    EXEC sp_OASetProperty @jwkset, 'EmitCompact', 0
    EXEC sp_OAMethod @jwkset, 'Emit', @sTmp0 OUT
    PRINT @sTmp0

    -- A sample jwkset:

    -- {
    --   "keys": [
    --     {
    --       "kty": "RSA",
    --       "use": "sig",
    --       "kid": "nOo3ZDrODXEK1jKWhXslHR_KXEg",
    --       "x5t": "nOo3ZDrODXEK1jKWhXslHR_KXEg",
    --       "n": "oaLLT9hkcSj ... NVrZdUdTBQ",
    --       "e": "AQAB",
    --       "x5c": [
    --         "MIIDBTC ... MRku44Dw7R"
    --       ],
    --       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
    --     },
    --     {
    --       "kty": "RSA",
    --       "use": "sig",
    --       "kid": "l3sQ-50cCH4xBVZLHTGwnSR7680",
    --       "x5t": "l3sQ-50cCH4xBVZLHTGwnSR7680",
    --       "n": "sfsXMXW ... AYkwb6xUQ",
    --       "e": "AQAB",
    --       "x5c": [
    --         "MIIDBTCCA ... BWrh+/vJ"
    --       ],
    --       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
    --     },
    --     {
    --       "kty": "RSA",
    --       "use": "sig",
    --       "kid": "DqUu8gf-nAgcyjP3-SuplNAXAnc",
    --       "x5t": "DqUu8gf-nAgcyjP3-SuplNAXAnc",
    --       "n": "1n7-nWSL ... V3pFWhQ",
    --       "e": "AQAB",
    --       "x5c": [
    --         "MIIC8TC ... 9pIcnkPQ=="
    --       ],
    --       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
    --     },
    --     {
    --       "kty": "RSA",
    --       "use": "sig",
    --       "kid": "OzZ5Dbmcso9Qzt2ModGmihg30Bo",
    --       "x5t": "OzZ5Dbmcso9Qzt2ModGmihg30Bo",
    --       "n": "01re9a2BU ... 5OzQ6Q",
    --       "e": "AQAB",
    --       "x5c": [
    --         "MIIC8TC ... YmwJ6sDdRvQ=="
    --       ],
    --       "issuer": "https://login.microsoftonline.com/6d8ddd66-68d1-43b0-af5c-e31b4b7dd5cd/v2.0"
    --     }
    --   ]
    -- }

    -- We should have an RSA key with kid matching the kid from the joseHeader..
    DECLARE @kid nvarchar(4000)
    EXEC sp_OAMethod @jsonJoseHeader, 'StringOf', @kid OUT, 'kid'

    -- Find the RSA key with the specified key id
    DECLARE @jwk int
    EXEC sp_OAMethod @jwkset, 'FindRecord', @jwk OUT, 'keys', 'kid', @kid, 1
    EXEC sp_OAGetProperty @jwkset, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 = 0
      BEGIN

        PRINT 'Failed to find a matching RSA key in the JWK key set...'
        EXEC @hr = sp_OADestroy @req
        EXEC @hr = sp_OADestroy @prng
        EXEC @hr = sp_OADestroy @sbUrl
        EXEC @hr = sp_OADestroy @listenSock
        EXEC @hr = sp_OADestroy @sock
        EXEC @hr = sp_OADestroy @sbRequestBody
        EXEC @hr = sp_OADestroy @sbResponseHtml
        EXEC @hr = sp_OADestroy @sbResponse
        EXEC @hr = sp_OADestroy @hashTab
        EXEC @hr = sp_OADestroy @jwt
        EXEC @hr = sp_OADestroy @json
        EXEC @hr = sp_OADestroy @jsonJoseHeader
        EXEC @hr = sp_OADestroy @sbJwks
        EXEC @hr = sp_OADestroy @http
        EXEC @hr = sp_OADestroy @jwkset
        RETURN
      END

    DECLARE @verified int

    DECLARE @pubkey int
    -- Use "Chilkat_9_5_0.PublicKey" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.PublicKey', @pubkey OUT

    EXEC sp_OAMethod @jwk, 'Emit', @sTmp0 OUT
    EXEC sp_OAMethod @pubkey, 'LoadFromString', @success OUT, @sTmp0
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pubkey, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC sp_OAMethod @jwk, 'Emit', @sTmp0 OUT
        PRINT @sTmp0
      END
    ELSE
      BEGIN
        EXEC sp_OAMethod @jwt, 'VerifyJwtPk', @verified OUT, @idToken, @pubkey

        PRINT 'Verified: ' + @verified
      END

    EXEC @hr = sp_OADestroy @jwk


    EXEC @hr = sp_OADestroy @req
    EXEC @hr = sp_OADestroy @prng
    EXEC @hr = sp_OADestroy @sbUrl
    EXEC @hr = sp_OADestroy @listenSock
    EXEC @hr = sp_OADestroy @sock
    EXEC @hr = sp_OADestroy @sbRequestBody
    EXEC @hr = sp_OADestroy @sbResponseHtml
    EXEC @hr = sp_OADestroy @sbResponse
    EXEC @hr = sp_OADestroy @hashTab
    EXEC @hr = sp_OADestroy @jwt
    EXEC @hr = sp_OADestroy @json
    EXEC @hr = sp_OADestroy @jsonJoseHeader
    EXEC @hr = sp_OADestroy @sbJwks
    EXEC @hr = sp_OADestroy @http
    EXEC @hr = sp_OADestroy @jwkset
    EXEC @hr = sp_OADestroy @pubkey


END
GO