JWT Kid Authentication

from cryptography import x509
import hashlib

# Load your client certificate
with open("client-cert.crt", "rb") as f:
    cert_data = f.read()

certificate = x509.load_pem_x509_certificate(cert_data)

# Calculate SHA-1 fingerprint of DER encoding
der_bytes = certificate.public_bytes(encoding=x509.Encoding.DER)
kid = hashlib.sha1(der_bytes).hexdigest()

# Optional: Format for display (with colons)
formatted_fingerprint = ':'.join(kid[i:i+2] for i in range(0, len(kid), 2)).upper()
print(f"Certificate fingerprint: {formatted_fingerprint}")
print(f"Kid for JWT: {kid}")

# Create the license payload with ccId, aiMessaging, aiAudioServices, ehrEmrIntegrationSeats, and sipCredentials objects
license_payload = {
    "ccId": {
        "resellerId": "RESELLER001",
        "resellerName": "Acme Distribution",
        "tenantId": "TENANT456",
        "tenantName": "West Coast Sales"
    },
    "aiMessaging": {
        "standardBundles": 5,
        "advancedBundles": 0
    },
    "aiAudioServices": {
        "additionalHours": 25
    },
    "ehrEmrIntegrationSeats": 1,
    "digitalOnlySeats": 15,
    "essentialSeats": 0,
    "professionalSeats": 25,
    "eliteSeats": 10,
    "workforceOptimizationSeats": 10,
    "speechAnalyticsSeats": 5,
    "dialerSeats": 0,
    "sipCredentials": {
        "username": "user123",
        "password": "secret",
        "sipPort": 5061,
        "sipServer": "sip_server.example.com",
        "transport": "udp",
        "outboundProxy": "outbound.example.com"
    }
}

import json
import hashlib

# Serialize JSON with specific parameters
payload_string = json.dumps(license_payload, sort_keys=False, separators=(',', ':')).encode('utf-8')

# Calculate SHA-256 hash
payload_hash = hashlib.sha256(payload_string).hexdigest()

import base64
import uuid
import time

# Generate a unique JTI
jti = str(uuid.uuid4())

# Set timestamps
current_time = int(time.time())
expiration_time = current_time + (30 * 60)  # 30 minutes in the future

# JWT Header with certificate fingerprint
jwt_header = {
    "alg": "RS256",
    "typ": "JWT",
    "kid": kid  # Certificate fingerprint from Step 1
}

# JWT Payload with RFC 7519 standard claims
jwt_payload = {
    "iss": "xima-ccaas",           # Issuer (required)
    "sub": kid,                    # Subject - certificate fingerprint
    "aud": "xima-ccaas",           # Audience (required)
    "payload_hash": payload_hash,   # Request body hash
    "jti": jti,                    # JWT ID - unique identifier
    "exp": expiration_time,        # Expiration time
    "iat": current_time            # Issued at time
}

# Base64URL encoding function
def base64url_encode(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).rstrip(b'=').decode('utf-8')

# Encode header and payload
header_encoded = base64url_encode(json.dumps(jwt_header).encode('utf-8'))
payload_encoded = base64url_encode(json.dumps(jwt_payload).encode('utf-8'))

from cryptography.hazmat.primitives.asymmetric import padding
from cryptography.hazmat.primitives import hashes

# Load your private key (matching the certificate)
from cryptography.hazmat.primitives.serialization import load_pem_private_key
with open("client-key.pem", "rb") as f:
    private_key = load_pem_private_key(f.read(), password=None)

# Create message to sign
message = f"{header_encoded}.{payload_encoded}".encode('utf-8')

# Sign with RS256 (PKCS#1 v1.5 padding + SHA-256)
signature = private_key.sign(
    message,
    padding.PKCS1v15(),
    hashes.SHA256()
)

# Encode the signature
signature_encoded = base64url_encode(signature)

# Combine to form complete JWT
jwt = f"{header_encoded}.{payload_encoded}.{signature_encoded}"

import requests

# API endpoint
api_url = "https://api.ximadev.cloud/v1/licensing/update"

# Headers with JWT Bearer token (RFC 6750)
headers = {
    "Authorization": f"Bearer {jwt}",
    "Content-Type": "application/json"
}

# Send request with serialized payload
response = requests.post(
    api_url,
    headers=headers,
    data=payload_string  # This is the serialized license payload
)

# Process response
if response.status_code == 200:
    print("Success!")
    print(response.json())
else:
    print(f"Error: {response.status_code}")
    print(response.text)