SQL Server

SSH Keyboard-Interactive Authentication

Demonstrates keyboard-interactive authentication with an SSH server. StartKeyboardAuth returns XML describing the server's prompts, and ContinueKeyboardAuth submits each response. Authentication is complete when the returned XML contains either a success or an error node.

Background: Keyboard-interactive is SSH's flexible, prompt-driven method: rather than assuming a single password, the server asks one or more questions — a password, a one-time code, a security question — and the client answers each. This is how SSH supports two-factor and other challenge-response schemes. The prompt XML also indicates whether each response should be echoed, so a client knows when to mask input. A server may issue several rounds, so a robust implementation loops until it sees success or error rather than assuming one exchange is enough.

Chilkat SQL Server Downloads

Download Chilkat for SQL Server

SQL Server

-- Important: See this note about string length limitations for strings returned by sp_OAMethod calls.
--
CREATE PROCEDURE ChilkatSample
AS
BEGIN
    DECLARE @hr int
    DECLARE @iTmp0 int
    DECLARE @sTmp0 nvarchar(4000)
    DECLARE @success int
    SELECT @success = 0

    --  This example requires the Chilkat API to have been previously unlocked.
    --  See Global Unlock Sample for sample code.

    --  Demonstrates keyboard-interactive authentication with an SSH server.  The server sends one or
    --  more prompts as XML, and the application answers each with ContinueKeyboardAuth.

    DECLARE @ssh int
    EXEC @hr = sp_OACreate 'Chilkat.Ssh', @ssh OUT
    IF @hr <> 0
    BEGIN
        PRINT 'Failed to create ActiveX component'
        RETURN
    END

    EXEC sp_OASetProperty @ssh, 'ConnectTimeoutMs', 5000
    EXEC sp_OASetProperty @ssh, 'ReadTimeoutMs', 15000

    DECLARE @hostname nvarchar(4000)
    SELECT @hostname = 'ssh.example.com'
    DECLARE @port int
    SELECT @port = 22
    EXEC sp_OAMethod @ssh, 'Connect', @success OUT, @hostname, @port
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        RETURN
      END

    --  Begin keyboard-interactive authentication.  The returned XML describes the server's prompts.
    DECLARE @xmlResponse nvarchar(4000)
    EXEC sp_OAMethod @ssh, 'StartKeyboardAuth', @xmlResponse OUT, 'mySshLogin'
    EXEC sp_OAGetProperty @ssh, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        RETURN
      END

    --  If the server sent a user authentication banner, an application may display it before
    --  prompting.

    EXEC sp_OAGetProperty @ssh, 'UserAuthBanner', @sTmp0 OUT
    PRINT 'UserAuthBanner: ' + @sTmp0

    DECLARE @xml int
    EXEC @hr = sp_OACreate 'Chilkat.Xml', @xml OUT

    EXEC sp_OAMethod @xml, 'LoadXml', @success OUT, @xmlResponse
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @xml, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @xml
        RETURN
      END

    --  Authentication is complete when the XML contains either a "success" or an "error" node.
    EXEC sp_OAMethod @xml, 'HasChildWithTag', @iTmp0 OUT, 'success'
    IF @iTmp0
      BEGIN

        PRINT 'No password required, already authenticated.'
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @xml
        RETURN
      END

    EXEC sp_OAMethod @xml, 'HasChildWithTag', @iTmp0 OUT, 'error'
    IF @iTmp0
      BEGIN

        PRINT 'Authentication failed.'
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @xml
        RETURN
      END

    --  Normally you would not hard-code the password in source.  You should instead obtain it
    --  from an interactive prompt, environment variable, or a secrets vault.
    DECLARE @password nvarchar(4000)
    SELECT @password = 'mySshPassword'

    --  Answer the prompt.  Typically one call is enough, but a server may issue several rounds of
    --  prompts, so a robust client loops until it sees "success" or "error".
    EXEC sp_OAMethod @ssh, 'ContinueKeyboardAuth', @xmlResponse OUT, @password
    EXEC sp_OAGetProperty @ssh, 'LastMethodSuccess', @iTmp0 OUT
    IF @iTmp0 = 0
      BEGIN
        EXEC sp_OAGetProperty @ssh, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @xml
        RETURN
      END

    EXEC sp_OAMethod @xml, 'LoadXml', @success OUT, @xmlResponse
    IF @success = 0
      BEGIN
        EXEC sp_OAGetProperty @xml, 'LastErrorText', @sTmp0 OUT
        PRINT @sTmp0
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @xml
        RETURN
      END

    EXEC sp_OAMethod @xml, 'HasChildWithTag', @iTmp0 OUT, 'success'
    IF @iTmp0
      BEGIN

        PRINT 'SSH keyboard-interactive authentication successful.'
        EXEC @hr = sp_OADestroy @ssh
        EXEC @hr = sp_OADestroy @xml
        RETURN
      END

    EXEC sp_OAMethod @xml, 'HasChildWithTag', @iTmp0 OUT, 'error'
    IF @iTmp0
      BEGIN

        PRINT 'Authentication failed.'
      END

    EXEC @hr = sp_OADestroy @ssh
    EXEC @hr = sp_OADestroy @xml


END
GO