OAuth2 Data Connector with PKCE -SHA256 hashing, is it possible?

[Anonymous]

Hi,

I am trying to implement OAuth2 in custom connector. I should pass code_challenge_method with a value plain or  SHA256. Does Power Query has an function to do the hashing? Because how I understand pass plain value, not suggested.

"Method used to generate the challenge (e.g., S256). The PKCE spec defines two methods, S256 and plain, the former is used in this example and is the only one supported by Auth0 since the latter is discouraged."

https://auth0.com/docs/flows/call-your-api-using-the-authorization-code-flow-with-pkce#javascript-sa... 

@artemus 

[artemus · Accepted solution]

You should be able to find what you need in the CryptoAlgorithm.* library. Note this library is only avialable to connectors.

E.g.

Binary.ToText(Crypto.CreateHash(CryptoAlgorithm.SHA256, Text.ToBinary(str, TextEncoding.Ascii)), BinaryEncoding.Base64)

[artemus · Accepted solution]

You should be able to find what you need in the CryptoAlgorithm.* library. Note this library is only avialable to connectors.

E.g.

Binary.ToText(Crypto.CreateHash(CryptoAlgorithm.SHA256, Text.ToBinary(str, TextEncoding.Ascii)), BinaryEncoding.Base64)

[Anonymous]

thanks...@artemus and how generate, before hashing, high-entropy random string called code_verifier-

This is a cryptographically random string using the characters A-Z, a-z, 0-9, and the punctuation characters -._~ (hyphen, period, underscore, and tilde), between 43 and 128 characters long.

[artemus · Accepted solution]

Actually see if this works:

Base64UrlEncodeWithoutPadding = (hash as binary) as text =>
    let
        base64Encoded = Binary.ToText(hash, BinaryEncoding.Base64),
        base64UrlEncoded = Text.Replace(Text.Replace(base64Encoded, "+", "-"), "/", "_"),
        withoutPadding = Text.TrimEnd(base64UrlEncoded, "=")
    in 
        withoutPadding;

MyConnector.StartLogin = (resourceUrl, state, display) =>
    let
        baseUri = ..., //Generate uri from resourceUrl
        codeVerifier = Text.NewGuid() & Text.NewGuid(),
        codeChallenge = Base64UrlEncodeWithoutPadding(Crypto.CreateHash(CryptoAlgorithm.SHA256, Text.ToBinary(codeVerifier, TextEncoding.Ascii))),
        authorizeUrl = baseUri & "/oauth2/authorize?" & Uri.BuildQueryString([
            client_id = clientId,
            scope = tokenScope,
            state = state,
            code_challenge_method = "S256",
            code_challenge = codeChallenge,
            redirect_uri = redirectUri,
            response_type = "code"])
    in
        [
            LoginUri = authorizeUrl,
            CallbackUri = redirectUri,
            WindowHeight = 720,
            WindowWidth = 1024,
            Context = [BaseUri = baseUri, CodeVerifier = codeVerifier]
        ];