There is as yet, no builtin HMAC policy in Apigee.
There is an existing HMAC callout (a custom policy) that works nicely.
https://github.com/apigee/iloveapis2015-hmac-httpsignature
I recommend one of two options.
option 1: to using that callout to produce the HMAC, along with a small set of other policies like AssignMessage/AssignVariable and JavaScript, to produce the constituent pieces for the signature, and to assemble those pieces.
Option 2: write your own custom policy that produces SAS signatures. It would do all the necessary things including assembly of the pieces. Just one policy needed.
----
For option 1, what I mean by setting up the constituent pieces... you will need "seconds since epoch" for the expiry. Apigee has a context variable that provides milliseconds since epoch, but not one for seconds since epoch. Also you will want to add some time (24 hours? 7 days?) to the current time to get the expiry time. And then you need to encode the URI and concatenate all that together to get the signature base. You would best be able to do that in a JavaScript policy like this:
var now = Math.floor((new Date()).valueOf() / 1000);
var sevenDaysInSeconds = 7 * 86400;
context.setVariable('sas_expiry', String(now + sevenDaysInSeconds));
var encoded = encodeURIComponent(uri);
context.setVariable('sas_encodedURI', encoded);
var signatureBase = encoded + '\n' + ttl;
context.setVariable('sas_signatureBase', signatureBase);
policy to get the HMAC
<JavaCallout name='Java-CalcHmac-2'>
<Properties>
<Property name="key">{private.sas_key}</Property>
<Property name="algorithm">SHA-256</Property>
<Property name="string-to-sign">{sas_signatureBase}</Property>
<Property name="debug">true</Property>
</Properties>
<ClassName>com.apigee.callout.hmac.HmacCreatorCallout</ClassName>
<ResourceURL>java://apigee-hmac-edge-callout-1.0.4.jar</ResourceURL>
</JavaCallout>
JavaScript to encode the result of that HMAC (available in variable hmac.signature.b64)
var hmac = context.getVariable('hmac.signature.b64');
var encoded = encodeURIComponent(hmac);
context.setVariable('sas_encoded_sig', encoded);policy to assemble the components.
<AssignMessage>
<AssignVariable>
<Name>sas_token</Name>
<Template>SharedAccessSignature sr={sas_encodedURI}&sig={sas_encoded_sig}&se={sas_expiry}&skn={saName}</Template>
</AssignVariable>
</AssignMessage>That will work; you'd want to put them all in a SharedFlow to make it simpler to use.
Option 2 would do all of that stuff in Java. Not much more complicated than the original HMAC policy. You could start from that and extend it. Microsoft even provides some helpful Java code. I prefer this option because it's cleaner.
EDIT:
try this?
https://github.com/DinoChiesa/Apigee-Java-AzureEventHubs-SasToken
LinkedIn
Twitter
