时间戳

首页 > 解决方案 > Google 签名令牌 - 请求签名无效 (Postgresql)

postgresql - Google 签名令牌 - 请求签名无效 (Postgresql)

问题描述

尝试为谷歌云存储创建有效签名时，我总是得到：

我们计算的请求签名与您提供的签名不匹配。检查您的 Google 密钥和签名方法。

我能够验证规范请求哈希是否与 的规范请求哈希匹配 StringToSign。

所以我相信生成签名时存在错误。但一切似乎都是正确的（至少从谷歌文档告诉我的）

create or replace function qx.create_google_storage_signature(
  string_to_sign text,
  request_date text,
  request_location text,
  request_service text,
  request_type text
)
  returns text
  volatile
  language plpgsql
as $$
declare
  hmac_secret text;
  key_date text;
  key_region text;
  key_service text;
  signing_key text;
  message_digest text;
begin
  -- todo : we need to not store this in plain text
  hmac_secret = qx.current_setting('qx.google_storage_hmac_secret');

  -- https://cloud.google.com/storage/docs/authentication/signatures#derive-key
  key_date = hmac(request_date, concat('GOOG4', hmac_secret), 'sha256');
  key_region = hmac(request_location, key_date, 'sha256');
  key_service = hmac(request_service, key_region, 'sha256');
  signing_key = hmac(request_type, key_service, 'sha256');

  message_digest = hmac(string_to_sign, signing_key, 'sha256');

  -- https://cloud.google.com/storage/docs/authentication/signatures#after_signing
  return encode(message_digest::text::bytea, 'hex');
end
$$;

这是完整的 sql 代码： https ://gist.github.com/lukepolo/1bc4ee9e8133ab33484a8d8ec8ef9e17

标签： postgresqlgoogle-cloud-storage

解决方案

我搞砸了应该是 bytea 的类型

create or replace function qx.create_google_storage_signature(
  string_to_sign text,
  request_date text,
  request_location text,
  request_service text,
  request_type text
)
  returns text
  volatile
  language plpgsql
as $$
declare
  hmac_secret text;
  message_digest text;
begin
  -- todo : we need to not store this in plain text
  hmac_secret = qx.current_setting('qx.google_storage_hmac_secret');

  -- https://cloud.google.com/storage/docs/authentication/signatures#derive-key
  message_digest = hmac(string_to_sign::text::bytea, hmac(request_type::text::bytea, hmac(request_service::text::bytea, hmac(request_location::text::bytea, hmac(request_date, concat('GOOG4', hmac_secret), 'sha256'), 'sha256'), 'sha256'), 'sha256'), 'sha256');

  -- https://cloud.google.com/storage/docs/authentication/signatures#after_signing
  return encode(message_digest::text::bytea, 'hex');
end
$$;

推荐阅读