SQL Server

Verify a JWT Created by the Amazon Cognito Service

See more JSON Web Token (JWT) Examples

Demonstrates how to verify a JWT created by the Amazon Cognito Service. SQL Server

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    -- Important: Do not use nvarchar(max).  See the warning about using nvarchar(max).
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    -- This example requires the Chilkat API to have been previously unlocked.
    -- See Global Unlock Sample for sample code.

    -- The public keys for this example are at https://cognito-idp.us-east-2.amazonaws.com/us-east-2_******/.well-known/jwks.json
    -- Let's get them:

    DECLARE @http int
    EXEC @hr = sp_OACreate 'Chilkat.Http', @http OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    DECLARE @sbJsonKeys int
    EXEC @hr = sp_OACreate 'Chilkat.StringBuilder', @sbJsonKeys OUT

    EXEC sp_OAMethod @http, 'QuickGetSb', @success OUT, 'https://cognito-idp.us-east-2.amazonaws.com/us-east-2_******/.well-known/jwks.json', @sbJsonKeys
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @http, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @http
        EXEC @hr = sp_OADestroy @sbJsonKeys
        RETURN
      END

    DECLARE @jsonKeys int
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @jsonKeys OUT

    EXEC sp_OAMethod @jsonKeys, 'LoadSb', @success OUT, @sbJsonKeys
    EXEC sp_OASetProperty @jsonKeys, 'EmitCompact', 0
    EXEC sp_OAMethod @jsonKeys, 'Emit', @sTmp0 OUT
    PRINT @sTmp0

    -- Here are the keys:

    -- {
    --   "keys": [
    --     {
    --       "alg": "RS256",
    --       "e": "AQAB",
    --       "kid": "1A/L5Fsb2EsEwxy5E0cmCMS1BnMe6Jl6NXiMig4iNwU=",
    --       "kty": "RSA",
    --       "n": "y0w7BJrIJYi ... jKG27z2P3OKw",
    --       "use": "sig"
    --     },
    --     {
    --       "alg": "RS256",
    --       "e": "AQAB",
    --       "kid": "mos6VTJnvDwurY3ghJg6IAPUq+dMwl6CL/iThzJOkzg=",
    --       "kty": "RSA",
    --       "n": "qbIEH-7tg6yrT ... 3Fj94ooTd0w",
    --       "use": "sig"
    --     }
    --   ]
    -- }

    -- Try the 1st key.
    DECLARE @jsonKey1 int
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @jsonKey1 OUT

    EXEC sp_OAMethod @jsonKeys, 'ObjectOf2', @success OUT, 'keys[0]', @jsonKey1

    DECLARE @pubKey1 int
    EXEC @hr = sp_OACreate 'Chilkat.PublicKey', @pubKey1 OUT

    EXEC sp_OAMethod @jsonKey1, 'Emit', @sTmp0 OUT
    EXEC sp_OAMethod @pubKey1, 'LoadFromString', @success OUT, @sTmp0
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @pubKey1, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @http
        EXEC @hr = sp_OADestroy @sbJsonKeys
        EXEC @hr = sp_OADestroy @jsonKeys
        EXEC @hr = sp_OADestroy @jsonKey1
        EXEC @hr = sp_OADestroy @pubKey1
        RETURN
      END


    PRINT 'Success'

    DECLARE @jwt int
    EXEC @hr = sp_OACreate 'Chilkat.Jwt', @jwt OUT

    -- I did not include the an actual AWS Cognito token here because our test sample used customer-provided data..
    DECLARE @token nvarchar(4000)
    SELECT @token = 'eyJ..asXg'

    -- First verify the signature.
    DECLARE @sigVerified int
    EXEC sp_OAMethod @jwt, 'VerifyJwtPk', @sigVerified OUT, @token, @pubKey1

    PRINT 'verified: ' + @sigVerified

    -- Let's see if the time constraints, if any, are valid.
    -- The above JWT was created on the afternoon of 16-May-2016, with an expiration of 1 hour.
    -- If the current system time is before the "nbf" time, or after the "exp" time,
    -- then IsTimeValid will return false/0.
    -- Also, we'll allow a leeway of 60 seconds to account for any clock skew.
    -- Note: If the token has no "nbf" or "exp" claim fields, then IsTimeValid is always true.
    DECLARE @leeway int
    SELECT @leeway = 60
    DECLARE @bTimeValid int
    EXEC sp_OAMethod @jwt, 'IsTimeValid', @bTimeValid OUT, @token, @leeway

    PRINT 'time constraints valid: ' + @bTimeValid

    -- Now let's recover the original claims JSON (the payload).
    DECLARE @payload nvarchar(4000)
    EXEC sp_OAMethod @jwt, 'GetPayload', @payload OUT, @token
    -- The payload will likely be in compact form:

    PRINT @payload

    -- We can format for human viewing by loading it into Chilkat's JSON object
    -- and emit.
    DECLARE @json int
    EXEC @hr = sp_OACreate 'Chilkat.JsonObject', @json OUT

    EXEC sp_OAMethod @json, 'Load', @success OUT, @payload
    EXEC sp_OASetProperty @json, 'EmitCompact', 0
    EXEC sp_OAMethod @json, 'Emit', @sTmp0 OUT
    PRINT @sTmp0

    -- We can recover the original JOSE header in the same way:
    DECLARE @joseHeader nvarchar(4000)
    EXEC sp_OAMethod @jwt, 'GetHeader', @joseHeader OUT, @token
    -- The payload will likely be in compact form:

    PRINT @joseHeader

    -- We can format for human viewing by loading it into Chilkat's JSON object
    -- and emit.
    EXEC sp_OAMethod @json, 'Load', @success OUT, @joseHeader
    EXEC sp_OASetProperty @json, 'EmitCompact', 0
    EXEC sp_OAMethod @json, 'Emit', @sTmp0 OUT
    PRINT @sTmp0

    EXEC @hr = sp_OADestroy @http
    EXEC @hr = sp_OADestroy @sbJsonKeys
    EXEC @hr = sp_OADestroy @jsonKeys
    EXEC @hr = sp_OADestroy @jsonKey1
    EXEC @hr = sp_OADestroy @pubKey1
    EXEC @hr = sp_OADestroy @jwt
    EXEC @hr = sp_OADestroy @json


END
GO