Zig Requires Chilkat v11.0.0+

Azure Key Vault Sign with a Certificate's Private Key

See more Azure Key Vault Examples

Signs a hash using the private key of a certificate previously imported to an Azure Key Vault. Zig

const std = @import("std");
const chilkat = @import("chilkat");

pub fn main(init: std.process.Init) !void {
    const alloc = init.arena.allocator();

    // This requires the Chilkat API to have been previously unlocked.
    // See Global Unlock Sample for sample code.

    // See Azure Key Vault Get Certificates for a more detailed explanation
    // for how Chilkat is automatically getting the OAuth2 access token for your application.

    // Provide information needed for Chilkat to automatically get an OAuth2 access token as needed.
    const json = try chilkat.JsonObject.init();
    defer json.deinit();
    json.updateString("client_id", "APP_ID") catch {};
    json.updateString("client_secret", "APP_PASSWORD") catch {};
    json.updateString("resource", "https://vault.azure.net") catch {};
    json.updateString("token_endpoint", "https://login.microsoftonline.com/TENANT_ID/oauth2/token") catch {};

    // In this example, we'll sign the SHA256 hash of the string "This is a test"
    const sb = try chilkat.StringBuilder.init();
    defer sb.deinit();
    const signed_string = "This is a test";
    sb.append(signed_string) catch {};
    const hash_base64url = try sb.getHash(alloc, "sha256", "base64url", "utf-8");

    // We're going to send a POST to the following URL:
    // POST {vaultBaseUrl}/keys/{key-or-cert-name}/{key-or-cert-version}/sign?api-version=7.4

    // For example:

    // POST https://VAULT_NAME.vault.azure.net/keys/CERT_NAME/CERT_VERSION/sign?api-version=7.4
    //
    // {
    //   "alg": "RS512",
    //   "value": "RUE3Nzg4NTQ4QjQ5RjFFN0U2NzAyQzhDNEMwMkJDOTA1MTYyOTUzNjI5NDhBNzZDQTlFOTM1NDA2M0ZGMjk2Mg"
    // }

    // The alg can be one of the following
    // ES256  ECDSA using P-256 and SHA-256
    // ES256K ECDSA using P-256K and SHA-256
    // ES384  ECDSA using P-384 and SHA-384
    // ES512  ECDSA using P-521 and SHA-512
    // PS256  RSASSA-PSS using SHA-256 and MGF1 with SHA-256
    // PS384  RSASSA-PSS using SHA-384 and MGF1 with SHA-384
    // PS512  RSASSA-PSS using SHA-512 and MGF1 with SHA-512
    // RS256  RSASSA-PKCS1-v1_5 using SHA-256
    // RS384  RSASSA-PKCS1-v1_5 using SHA-384
    // RS512  RSASSA-PKCS1-v1_5 using SHA-512

    // The sample POST above uses SHA512.  We'll instead sign a SHA256 hash..

    const json_body = try chilkat.JsonObject.init();
    defer json_body.deinit();
    json_body.updateString("alg", "RS256") catch {};
    json_body.updateString("value", hash_base64url) catch {};

    const http = try chilkat.Http.init();
    defer http.deinit();

    // Instead of providing an actual access token, we give Chilkat the information that allows it to
    // automatically fetch the access token using the OAuth2 client credentials flow.
    http.setAuthToken(try json.emit(alloc));

    http.setUrlVar("certName", "importCert01") catch {};
    http.setUrlVar("certVersion", "7140c8755ed14839b5d86a9f7e7f0497") catch {};
    // Note: Replace "VAULT_NAME" with the name of your Azure key vault.
    const url = "https://VAULT_NAME.vault.azure.net/keys/{$certName}/{$certVersion}/sign?api-version=7.4";
    const resp = try chilkat.HttpResponse.init();
    defer resp.deinit();
    http.httpJson("POST", url, json_body, "application/json", resp) catch {
        std.debug.print("{s}\n", .{try http.getLastErrorText(alloc)});
        return;
    };

    const status_code = resp.getStatusCode();

    const json_resp = try chilkat.JsonObject.init();
    defer json_resp.deinit();
    resp.getBodyJson(json_resp) catch {};

    json_resp.setEmitCompact(false);
    std.debug.print("{s}\n", .{try json_resp.emit(alloc)});

    if (status_code != 200) {
        std.debug.print("Failed.\n", .{});
        return;
    }

    // A successful response body contains JSON like this:
    // Note: Azure's documentation is not very clear, but base64url is the encoding, not "base64".
    // {
    //   "kid": "https://kvchilkat.vault.azure.net/keys/importCert01/7140c8755ed14839b5d86a9f7e7f0497",
    //   "value": "JzWd2YF21gjtW ... Em37hKOQ"
    // }

    // Let's validate the signature using the cert's public key.
    // This example will load the corresponding certificate from a local file and will verify the signature against the original data.
    //
    const cert = try chilkat.Cert.init();
    defer cert.deinit();
    cert.loadFromFile("qa_data/certs/chilkat_code_signing_2024.cer") catch {
        std.debug.print("{s}\n", .{try cert.getLastErrorText(alloc)});
        return;
    };

    const rsa = try chilkat.Rsa.init();
    defer rsa.deinit();
    // Tell the RSA object to use the cert's public key.
    rsa.setX509Cert(cert, false) catch {
        std.debug.print("{s}\n", .{try rsa.getLastErrorText(alloc)});
        return;
    };

    // Verify the signature using the cert's public key against the original string.
    rsa.setEncodingMode("base64url");
    const valid = if (rsa.verifyStringENC(signed_string, "sha-256", try json_resp.stringOf(alloc, "value"))) true else |_| false;
    std.debug.print("signature valid = {}\n", .{valid});
}