Azure IoT Hub 設備注冊通過 POSTMAN 導致未經授權

Question

I want to create a sas token for registration of device in Azure IoT hub,using postman.The sas token will be created with pre-requested script.

    var resourceUri = "scopeId/registrations/deviceId" // The resource uri
    var deviceId = "deviceId";
    
    resourceUri = encodeURIComponent(resourceUri.toLowerCase()); // Encode the url
    
    var expires = Math.ceil((Date.now() / 1000) + 10 * 60); // Expire the token 60 minutes from now
    
    var toSign = resourceUri + "\n" + expires; // this is the string format to gen signature from
    
 var crypted = CryptoJS.HmacSHA256(deviceId, CryptoJS.enc.Base64.parse("symmetrickKeyOfEnrollmentGroup"));

var signature = CryptoJS.HmacSHA256(toSign, crypted); // The signature generated from the decodedKey
var encodedUri = encodeURIComponent(CryptoJS.enc.Base64.stringify(signature)); // The url encoded version of the Base64 signature
    

// Construct authorization string (shared access signature)
var iotHubSasToken = "SharedAccessSignature sr=" + resourceUri + "&sig=" + encodedUri + "&se=" + expires +"&skn=registration";

console.log(iotHubSasToken);
postman.setGlobalVariable("token", iotHubSasToken);

這是我創建的，但我收到 Unauthorized.Some 想法我錯了，我認為我在簽名的某個地方，因為“sr”和“se”沒問題

上面拋出未經授權的代碼的 Output：

SharedAccessSignature sr=0ne002ee24e%2Fregistrations%2Fcxdlx3f3zv9xx3f3zq&sig=Ukz%2FPyyLaweLYmFq4gHUP%2BhiO7X%2FyQAE9noAaw4nuLU%3D&se=1659940252&skn=registration

參考：

關於 SAS： https://docs.microsoft.com/en-us/azure/iot-dps/how-to-control-access

關於 REST API： https://docs.microsoft.com/en-us/rest/api/iot-dps/device/runtime-detailsregisters/

關於 DPS sas 令牌： https://docs.microsoft.com/en-us/azure/iot-dps/how-to-control-access

錯誤：

Answer 1

問題在於簽名。

 var crypted = CryptoJS.HmacSHA256(deviceId, CryptoJS.enc.Base64.parse("symmetrickKeyOfEnrollmentGroup"));

var signature = CryptoJS.HmacSHA256(toSign, crypted); // The signature generated from the decodedKey
var encodedUri = encodeURIComponent(CryptoJS.enc.Base64.stringify(signature)); // The url encoded version of the Base64 signature

這是創建它的正確方法。