php - 在 ColdFusion 中验证来自 Microsoft Teams 自定义机器人的 HMAC

Question

我正在尝试使用 ColdFusion 对 Microsoft Teams 自定义机器人进行身份验证，following the Microsoft instructions in C# .我也尝试关注 this PHP example .但我没有任何运气。知道我在这里缺少什么吗？

<cfset secretKey       = "MsVx7SpJKnSiycvsUyLMiD8lDIFkEUDhuYuFAT94hXY=">
<cfset httpRequestData = GetHttpRequestData()>
<cfset c               = httpRequestData.content>
<cfset calculated_hmac = toBase64(hmac(c, secretKey, "HMACSHA256"))>

我明白了...

calculated_hmac: NjE2RUY1RjREQTNEMzk1Q0RBNUJDMEE2NDhFNzk3RDIyNUMzRDJDMjk5NTYzMDgxODk0NkU3Njc3RTVEQTAyQQ==

虽然微软的 headers.authorization 是这样的...

HMAC 6N0WyOW7g+LqShKYsouWOrPjgh0PD1gazfwNeNwpuS8=

对于此特定示例，GetHttpRequestData().content 是...

{"type":"message","id":"1552059974228","timestamp":"2019-03-08T15:46:14.225Z","localTimestamp":"2019-03-08T09:46:14.225-06:00","serviceUrl":"https://smba.trafficmanager.net/amer/","channelId":"msteams","from":{"id":"29:1lY_4faAJwr1qSsIBSpFnI3nYpy3wv5hLp5qZk1_uuc_3ET_aW1Ttu_vN-evUZ0TXVKIBoy8wEBzPT7a1WgwOTQ","name":"Gordon Frobenius","aadObjectId":"be3510a6-204d-4b3f-b6c3-52bbddb303d5"},"conversation":{"isGroup":true,"id":"19:a69ef3b3162a43018edb05db74138636@thread.skype;messageid=1552059031619","name":null,"conversationType":"channel"},"recipient":null,"textFormat":"plain","attachmentLayout":null,"membersAdded":[],"membersRemoved":[],"topicName":null,"historyDisclosed":null,"locale":"en-US","text":"cmpro bot help\n","speak":null,"inputHint":null,"summary":null,"suggestedActions":null,"attachments":[{"contentType":"text/html","contentUrl":null,"content":"http://schema.skype.com/Mention\" itemid=\"0\">cmpro bot help\n","name":null,"thumbnailUrl":null}],"entities":[{"type":"clientInfo","locale":"en-US","country":"US","platform":"Windows"}],"channelData":{"teamsChannelId":"19:a69ef3b3162a43018edb05db74138636@thread.skype","teamsTeamId":"19:a69ef3b3162a43018edb05db74138636@thread.skype","channel":{"id":"19:a69ef3b3162a43018edb05db74138636@thread.skype"},"team":{"id":"19:a69ef3b3162a43018edb05db74138636@thread.skype"},"tenant":{"id":"0d78b7c2-75c2-4dad-966d-500250225e13"}},"action":null,"replyToId":null,"value":null,"name":null,"relatesTo":null,"code":null}

Answer 1

(请注意，我无法重现“calculated_hmac”，因为样本“content”字符串必须在某些方面与原始字符串不同——可能只是空白，但这足以完全改变结果……)。

无论如何，基于the instructions ，我猜主要问题是在散列中使用字符串而不是二进制:

1. Generate the hmac from the request body of the message.... You will need to convert the body to a byte array in UTF8.
2. To compute the hash, provide the byte array of the security token provided by Microsoft Teams when you registered the outgoing webhook.

首先尝试将正文解码成二进制

<cfset bodyBinary = charsetDecode(GetHttpRequestData().content, "utf-8")>

对 key 做同样的事情

<cfset secretKey  = "MsVx7SpJKnSiycvsUyLMiD8lDIFkEUDhuYuFAT94hXY=">
<cfset secretBinary = binaryDecode(secretKey, "base64")>

最后，不要忘记 HMAC() 返回一个十六进制字符串。如果您需要 base64，则必须自己动手:

<cfset hexHash = hmac(bodyBinary, secretBinary, "HMACSHA256")>
<cfset calculated_hmac = binaryEncode(binaryDecode(hexHash, "hex"), "base64")>