javascript - 通过 POSTMAN 注册 Azure IoT 中心设备会导致未经授权

Question

我想使用 postman 创建一个 sas token ，用于在 Azure IoT 中心注册设备。该 sas token 将使用预先请求的脚本创建。

    var resourceUri = "scopeId/registrations/deviceId" // The resource uri
    var deviceId = "deviceId";
    
    resourceUri = encodeURIComponent(resourceUri.toLowerCase()); // Encode the url
    
    var expires = Math.ceil((Date.now() / 1000) + 10 * 60); // Expire the token 60 minutes from now
    
    var toSign = resourceUri + "\n" + expires; // this is the string format to gen signature from
    
 var crypted = CryptoJS.HmacSHA256(deviceId, CryptoJS.enc.Base64.parse("symmetrickKeyOfEnrollmentGroup"));

var signature = CryptoJS.HmacSHA256(toSign, crypted); // The signature generated from the decodedKey
var encodedUri = encodeURIComponent(CryptoJS.enc.Base64.stringify(signature)); // The url encoded version of the Base64 signature
    

// Construct authorization string (shared access signature)
var iotHubSasToken = "SharedAccessSignature sr=" + resourceUri + "&sig=" + encodedUri + "&se=" + expires +"&skn=registration";

console.log(iotHubSasToken);
postman.setGlobalVariable("token", iotHubSasToken);

这是我创建的，但我收到未经授权的消息。一些我错误的想法，我认为我在签名中的某个地方，因为“sr”和“se”没问题

上面抛出 Unauthorized 的代码的输出:

SharedAccessSignature sr=0ne002ee24e%2Fregistrations%2Fcxdlx3f3zv9xx3f3zq&sig=Ukz%2FPyyLaweLYmFq4gHUP%2BhiO7X%2FyQAE9noAaw4nuLU%3D&se=1659940252&skn=registration

引用文献:

关于 SAS:https://learn.microsoft.com/en-us/azure/iot-dps/how-to-control-access

关于 REST API:https://learn.microsoft.com/en-us/rest/api/iot-dps/device/runtime-registration/register-device#provisioningserviceerrordetails

关于DPS sas代币:https://learn.microsoft.com/en-us/azure/iot-dps/how-to-control-access

错误:

Answer 1

问题出在签名中。

 var crypted = CryptoJS.HmacSHA256(deviceId, CryptoJS.enc.Base64.parse("symmetrickKeyOfEnrollmentGroup"));

var signature = CryptoJS.HmacSHA256(toSign, crypted); // The signature generated from the decodedKey
var encodedUri = encodeURIComponent(CryptoJS.enc.Base64.stringify(signature)); // The url encoded version of the Base64 signature

这是创建它的正确方法。