(SQL Server) Create JWT using Smart Card

See more JSON Web Token (JWT) Examples

Demonstrates how to create a JWT using an RSA private key and certificate on a smart card. This is for JOSE headers with an "alg" of RS256, RS384, or RS512. When RSA is used, the private key signs (creates) the JWT, and the public key is for verification.

This example also demonstrates how to include time constraints:

• nbf: Not Before Time
• exp: Expiration Time
• iat: Issue At Time

Note: This example requires Chilkat v9.5.0.99 or later.

Chilkat ActiveX Downloads ActiveX for 32-bit and 64-bit Windows

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @sTmp1 nvarchar(4000)
    -- Demonstrates how to create a JWT using an RSA private key and certificate on a smart card.

    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    DECLARE @jwt int
    -- Use "Chilkat_9_5_0.Jwt" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Jwt', @jwt OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @cert int
    -- Use "Chilkat_9_5_0.Cert" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.Cert', @cert OUT

    DECLARE @success int
    EXEC sp_OAMethod @cert, 'LoadFromSmartcard', @success OUT, ''
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @cert, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @jwt
        EXEC @hr = sp_OADestroy @cert
        RETURN
      END

    -- Build the JOSE header
    DECLARE @jose int
    -- Use "Chilkat_9_5_0.JsonObject" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @jose OUT

    -- Use RS256.  Pass the string "RS384" or "RS512" to use RSA with SHA-384 or SHA-512.
    EXEC sp_OAMethod @jose, 'UpdateString', @success OUT, 'alg', 'RS256'
    EXEC sp_OAMethod @jose, 'UpdateString', @success OUT, 'typ', 'JWT'
    EXEC sp_OAMethod @cert, 'GetEncoded', @sTmp0 OUT
    EXEC sp_OAMethod @jose, 'UpdateString', @success OUT, 'x5c[0]', @sTmp0

    -- Now build the JWT claims (also known as the payload)
    DECLARE @claims int
    -- Use "Chilkat_9_5_0.JsonObject" for versions of Chilkat < 10.0.0
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @claims OUT

    EXEC sp_OAMethod @claims, 'UpdateString', @success OUT, 'iss', 'http://example.org'
    EXEC sp_OAMethod @claims, 'UpdateString', @success OUT, 'sub', 'John'
    EXEC sp_OAMethod @claims, 'UpdateString', @success OUT, 'aud', 'http://example.com'

    -- Set the timestamp of when the JWT was created to now.
    DECLARE @curDateTime int
    EXEC sp_OAMethod @jwt, 'GenNumericDate', @curDateTime OUT, 0
    EXEC sp_OAMethod @claims, 'UpdateInt', @success OUT, 'iat', @curDateTime

    -- Set the "not process before" timestamp to now.
    EXEC sp_OAMethod @claims, 'UpdateInt', @success OUT, 'nbf', @curDateTime

    -- Set the timestamp defining an expiration time (end time) for the token
    -- to be now + 1 hour (3600 seconds)
    EXEC sp_OAMethod @claims, 'UpdateInt', @success OUT, 'exp', @curDateTime + 3600

    -- Produce the smallest possible JWT:
    EXEC sp_OASetProperty @jwt, 'AutoCompact', 1

    -- Create the JWT token.  This is where the RSA signature is created.
    DECLARE @token nvarchar(4000)
    EXEC sp_OAMethod @jose, 'Emit', @sTmp0 OUT
    EXEC sp_OAMethod @claims, 'Emit', @sTmp1 OUT
    EXEC sp_OAMethod @jwt, 'CreateJwtCert', @token OUT, @sTmp0, @sTmp1, @cert


    PRINT @token

    EXEC @hr = sp_OADestroy @jwt
    EXEC @hr = sp_OADestroy @cert
    EXEC @hr = sp_OADestroy @jose
    EXEC @hr = sp_OADestroy @claims


END
GO