1E SDK

namespace ExternalIntegrationUsingJwt
{
    using System;
    using System.Net;
    using System.Net.Http;
    using System.Security.Cryptography;
    using System.Security.Cryptography.X509Certificates;
    using System.Text;
    using System.Threading;
    using System.Web.Script.Serialization;

    internal class Program
    {
        private const string TachyonConsumer = "your consumer name here"; // Your registered Consumer should go here
        private const int ExpirationSeconds = 3600;

        // Configure the following values:
        private const string ApplicationId = "8983091d-fc2f-40b5-8aca-940e4cf5f9b5";
        private const string MetadataEndpoint = "https://login.microsoftonline.com/89f2b2d5-56db-4d75-86d1-b64974bd35bd/v2.0/.well-known/openid-configuration";
        private const string TachyonServer = "https://your.tachyon.server";
        private const string CertificateThumbprint = "998c12e4de7c5f39b90244d0766fa5b2965d1523";

        static void Main(string[] args)
        {
            // This is the code that obtains a Tachyon Token
            string signedJwt = GetSignedJwt();
            //string tachyonAuthEndpoint = TachyonServer + "/Tachyon/api/Authentication"; // for versions earlier than 24.1
            string tachyonAuthEndpoint = TachyonServer + "/api/Authentication";
            string tachyonToken = PostPayloadToTachyonAuthEndPoint(Quotify(signedJwt), tachyonAuthEndpoint);
            Console.WriteLine($"Got TachyonToken: {tachyonToken}");

            // This is an example for how we would use the token to invoke a Tachyon API
            //string exampleApi = TachyonServer + "/Tachyon/api/Permissions/WhoAmI"; // for versions earlier than 24.1
            string exampleApi = TachyonServer + "/api/Permissions/WhoAmI";
            string response = GetFromApi(exampleApi, tachyonToken);
            Console.WriteLine($"\nResponse from API: {response}");
        }

        private static string GetSignedJwt()
        {
            X509Certificate2 cert = GetCertFromLocalStore(CertificateThumbprint);
            string upn = null; // This version is not currently adding the UPN to the JWT
            string tokenEndpoint = GetTokenEndpoint();
            return GetAuthToken(cert, upn, tokenEndpoint, ApplicationId);
        }

        private static string GetAuthToken(X509Certificate2 cert, string upn, string tokenEndpoint, string appId)
        {
            var token = GetJwt(tokenEndpoint, appId, appId, upn);
            var signedToken = GetSignedClientAssertion(token, cert);
            return signedToken;
        }

        private static string GetSignedClientAssertion(string jwtJson, X509Certificate2 certificate)
        {
            var jwtHdrJson = GetJwtHdr(ToBase64Url(certificate.GetCertHash()));
            var jwtHdrBytesEncoded = ToBase64UrlString(jwtHdrJson);

            var jwtBytesEncoded = ToBase64UrlString(jwtJson);

            var token = jwtHdrBytesEncoded + "." + jwtBytesEncoded;

            return GetSignedAssertion(token, certificate);
        }

        private static string GetSignedAssertion(string assertion, X509Certificate2 certificate)
        {
            var rsa = RSACertificateExtensions.GetRSAPrivateKey(certificate);
            var assertionBytes = System.Text.Encoding.UTF8.GetBytes(assertion);
            var signature = rsa.SignData(assertionBytes, HashAlgorithmName.SHA256, RSASignaturePadding.Pkcs1);
            var signatureEncoded = ToBase64Url(signature);
            var signedClientAssertion = assertion + "." + signatureEncoded;
            return signedClientAssertion;
        }

        private static string GetJwtHdr(string thumbprint)
        {
            string jwtHdr = "{" + $"\"alg\":\"RS256\",\"typ\":\"JWT\",\"x5t\":\"{thumbprint}\",\"kid\":\"{thumbprint}\"" + "}";
            return jwtHdr;
        }

        private static string GetJwt(string audience, string issuer, string subject, string upn)
        {
            var timestamp = (ToUnixTimestamp(DateTime.UtcNow));
            var exptimestamp = timestamp + ExpirationSeconds;
            string jwtBody = "{" + $"\"aud\":\"{audience}\",\"iat\":\"{timestamp}\",\"exp\":\"{exptimestamp}\",\"iss\":\"{issuer}\",\"sub\":\"{subject}\",\"jti\":\"{Guid.NewGuid()}\"" + "}";
            // Add "Tachyon.upn" if using a single certificate for multiple users
            return jwtBody;
        }

        private static string ToBase64Url(byte[] buf)
        {
            var base64buf = Convert.ToBase64String(buf);
            base64buf = base64buf.Replace("=", "");
            base64buf = base64buf.Replace("+", "-");
            base64buf = base64buf.Replace("/", "_");
            return base64buf;
        }

        private static string ToBase64UrlString(string buf)
        {
            var bufBytes = Encoding.UTF8.GetBytes(buf);
            return ToBase64Url(bufBytes);
        }

        private static long ToUnixTimestamp(DateTime datetime)
        {
            var epoch = new DateTime(1970, 1, 1, 0, 0, 0);
            var seconds = Math.Truncate(datetime.ToUniversalTime().Subtract(epoch).TotalSeconds);
            return Convert.ToInt64(seconds);
        }

        private static string Quotify(string s)
        {
            return $"\"{s.Replace("\\", "\\\\").Replace("\"", "\\\"")}\"";
        }

        private static string PostPayloadToTachyonAuthEndPoint(string payload, string tachyonAuthEndpoint)
        {
            using (HttpClient client = new HttpClient())
            {
                client.DefaultRequestHeaders.Add("X-Tachyon-Consumer", TachyonConsumer);

                string endpoint = tachyonAuthEndpoint + "/RequestJwtAuthentication";
                var result = client.PostAsync(endpoint, new StringContent(payload, Encoding.UTF8, "application/json"), CancellationToken.None).Result;
                string response = result.Content.ReadAsStringAsync().Result;
                return response;
            }
        }

        private static X509Certificate2 GetCertFromLocalStore(string thumbprint)
        {
            X509Certificate2 cer = null;

            // Assume certs are always in Personal store of local machine
            using (var store = new X509Store("My", StoreLocation.LocalMachine))
            {
                store.Open(OpenFlags.ReadOnly);
                var cers = store.Certificates.Find(X509FindType.FindByThumbprint, thumbprint, false);
                if (cers.Count > 0)
                {
                    cer = cers[0];
                }
                else
                {
                    store.Close();
                    throw new Exception($"Could not find certificate with thumbprint={thumbprint}");
                }

                store.Close();
            }

            return cer;
        }

        private static string GetFromApi(string endpoint, string tachyonToken)
        {
            using (HttpClient client = new HttpClient())
            {
                client.DefaultRequestHeaders.Add("X-Tachyon-Consumer", TachyonConsumer);
                client.DefaultRequestHeaders.Add("X-Tachyon-Authenticate", tachyonToken);

                var result = client.GetAsync(endpoint, CancellationToken.None).Result;
                string response = result.Content.ReadAsStringAsync().Result;
                return response;
            }
        }

        private static string GetTokenEndpoint()
        {
            var wc = new WebClient();
            string metadata = wc.DownloadString(MetadataEndpoint);
            JavaScriptSerializer js = new JavaScriptSerializer();
            MetaData deserialized = js.Deserialize<MetaData>(metadata);

            return deserialized.token_endpoint;
        }

        private class MetaData
        {
            public string token_endpoint { get; set; }
        }
    }
}

import jwt
import datetime
import base64
import hashlib
import uuid
from cryptography.hazmat.primitives.serialization import pkcs12
import json
from cryptography import x509
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives import hashes, serialization
from cryptography.hazmat.primitives.asymmetric import padding
import requests

import warnings
warnings.filterwarnings("ignore")  # this is just to suppress the warnings about overriding SSL trust for a lab platform where Python's cert store doesn't have a CA root cert imported.


TrustPlatformServer = False #allows us to call a platform server (e.g in a lab) where the Python cert store doesn't have a CA root cert establishing an SSL trust chain. Otherwise set to True

# This just loads the cert from a local Pfx file. Alternatively you can load the cert from the Azure Key Vault

def LoadCertFromPfx(pfx, password):
	with open(pfx, "rb") as pfxFile:
		pfxBinData = pfxFile.read()
		return pkcs12.load_key_and_certificates(pfxBinData, password)

# convert to URL-safe encoding

def toBase64Url(input):
    return base64.urlsafe_b64encode(input).rstrip(b'=')

# get certificate thumbprint (which we will then convert to a key identifier (kid) for the JWT later by base 64 url-safe encoding it)

def calculateThumbprint(certificate):
    der = certificate.public_bytes(serialization.Encoding.DER)
    digest = hashes.Hash(hashes.SHA1(), backend=default_backend())
    digest.update(der)
    thumbprint = digest.finalize()
    return thumbprint

# get the configured metadata endpoint for the identity provider from the platform

def getMetadataEndpoint(platformMetadataEndpoint):
    return requests.get(platformMetadataEndpoint, verify=TrustPlatformServer).json()


# get the identity provider token issuing endpoint from its openId metadata endpoint
# Note that the identity provider will always present a trusted SSL cert that Python's cert store can resolve to a trust chain, so we don't need to have an override for this
    
def getTokenEndpoint(identityProviderMetadataEndpoint):
    return requests.get(identityProviderMetadataEndpoint).json()["token_endpoint"]


# create a signed JWT using the pfx file with the certificate (this could be retrieved from the Azure Key Vault instead), the pfx password, the client assertion audience and the configured IdP application Id that will verify the JWT
# (this must have the public key of this cert uploaded to it)

def generateSignedJwt(pfx, password, clientAssertionAudience, idpAppServiceClientId):
    privateKey, certificate, _ = LoadCertFromPfx(pfx,password)
    kid = toBase64Url(calculateThumbprint(certificate)).decode()
   
    now = datetime.datetime.utcnow()
    expirationTime = now + datetime.timedelta(seconds=3600)

    header = {
        'alg': 'RS256',
        'typ': 'JWT',
        'x5t': kid,
        'kid': kid
    }

# You do not need a claim for the servicePrincipalName unless the platform kid->upn mapping table has multiple entries for the same kid (i.e certificate thumbprint)
# Otherwise the mapping is implied to a specific principal.

    body = {
        'aud': clientAssertionAudience,
        'iat': now,
        'exp': expirationTime,
        'iss': idpAppServiceClientId,
        'sub': idpAppServiceClientId,
        'jti': str(uuid.uuid4()) #,
#        'Tachyon.upn' : servicePrincipleName    # this is a custom claim allowing one certificate to map to multiple principals on the platform
    }
    signedJwt = jwt.encode(body, key=privateKey, algorithm='RS256', headers=header)
    return signedJwt

# make a request to the platform to get a token (base-64 encoded)

def requestJwtAuthentication(platformConsumer, platformAuthEndpoint, payload):
    headers = {"X-Tachyon-Consumer": platformConsumer}
    endpoint = platformAuthEndpoint + "/RequestJwtAuthentication"
    response = requests.post(endpoint, headers=headers, json=payload, verify=TrustPlatformServer)
    responseContent = response.text
    return responseContent


# Example API call

def getFromApi(platformServer, platformConsumer, path, token):
    headers = {"X-Tachyon-Consumer": platformConsumer, "X-Tachyon-Authenticate": token}
    endpoint = platformServer + path
    response = requests.get(endpoint, headers=headers,verify=TrustPlatformServer)
    return response.json()


# Main code here. 

platformServer = "https://your.platform.server"
platformConsumer = "your registered consumer"
platformAuthEndpoint = platformServer + "/api/Authentication"
platformMetadataEndpoint = platformAuthEndpoint + "/metadataendpoint"

# This is the application Id of the app that is set up for external integration. Your certificate's public key must have been uploaded to that app

idpAppServiceClientId = "0c830a1d-fc2f-40b5-8aca-940e4cf5f9b5"


# Get the configured identity provider's metadata endpoint from the platform

metadataEndpoint = getMetadataEndpoint(platformMetadataEndpoint)
print(metadataEndpoint)

# call the openId metadata endpoint on the identity provider to get the identity provider's token issuing endpoint

tokenEndpoint = getTokenEndpoint(metadataEndpoint)
print(tokenEndpoint)


# Make a signed JWT using the example PFX file. 
signedJwt = generateSignedJwt("integrate.pfx",b'Password', tokenEndpoint, idpAppServiceClientId)


# Request an internal token from the platform. This will have a life of one hour. When it expires, you repeat the above step to get a fresh signed Jwt and then request a fresh token

internalAccessToken = requestJwtAuthentication(platformConsumer, platformAuthEndpoint, signedJwt)

print("Response:", internalAccessToken)

# Call an API, passing the token (in this case, getting a list of connected devices)
apiResult = getFromApi(platformServer, platformConsumer, "/consumer/devices", internalAccessToken)
print(apiResult)

# Install the required libraries
!pip install azure-keyvault-secrets azure-identity

# Import the necessary modules
from azure.identity import ClientSecretCredential
from azure.keyvault.secrets import SecretClient

# Create a secret client with client secret authentication
credential = ClientSecretCredential(tenant_id, client_id, client_secret)
secret_client = SecretClient(vault_url=key_vault_url, credential=credential)

# Retrieve the secret value
cert_base64 = secret_client.get_secret(secret_name).value

# Use the secret value in your code
print("Retrieved secret value:", cert_base64)