Signed Access Signature (SaS) which NEVER expires

Question

We are working on a project where we need to use a proprietary library from Codesys to connect to the Azure HUB, and when using MQTT the way is to define SaS for the device.
Problem is that the SaS will have an expire data, (longest is 365days) and this means that we will need to update all the IoT devices once the SaS is expired.
Is there any way to create a SaS without expiry date or to renew a SaS?

There are possibly other ways to connect to the IoT HUB, but the MQTT was already implemented with AWS and this is from where the customer would like to migrate.

Answer 1

Hello @Telemation ,

I checked some documentation about IoTHub MQTT support and SAS tokens.

I do not see this 365 days limitation.

Expiry is "UTF8 strings for number of seconds since the epoch 00:00:00 UTC on 1 January 1970").

Can you try to communicate with a sas token which exceeds this 365 days?

Answer 2

Many thks for the reply as it is driving me insane that the library is sold claiming to save me time and then the supplier only has a paid service to help me. I generate the SAS for 24hrs that is just a temp one that should I hope be safe for publishing it here. The code below comes from their only example and it seems a no brainer to work. As mentioned I get NR to use just the symetrical key.

My problems:
the sendMessage is a no source compiled object and I have not found any methods to capture it's chatter to the cloud
I do not know how to diagnose on the IoT hub the incoming data before security to see what is happening...with NR I can see the transactions even with the IoT Explorer.
I have not found info how the sendMessage should build the object....it suspiciously sends the deviceid in the pwsData string again?

Considering I pay $50 per device use for this library their documentation/examples suck however pls see if you can glean anything from the manual in my OneDrive folder:
https://catimco-my.sharepoint.com/:b:/g/personal/martin_catim_co/Ef0notZawkpDm66Tifm-ImYBiT-P1c_DsPRHiuPylYWAuA?e=byZ1qG
The documentation is not clear if the sSubDomainName is the whole URL string or partial just the sub?
The SAS I am using as below I do not know if this is all of the SAS or do I leave the & at the end out?
Next line is the whole connect string inclusing the SAS lease time it seems at the end:
HostName=catimhub1.azure-devices.net;DeviceId=CODESYSDevice1;SharedAccessSignature=SharedAccessSignature sr=catimhub1.azure-devices.net%2Fdevices%2FCODESYSDevice1&sig=br%2BGBo5KPup1EnJXgGbtVG%2FvTQlbwP9O0ezGQaPUjuc%3D&se=1612225381

sSubDomainName : STRING(100) := 'catimhub1.azure-devices.net'; // The name of your Azure IoT Hub
sDeviceId : STRING(100) := 'CODESYSDevice1'; // The device id
wsDeviceSaS : WSTRING(255) := "br%2BGBo5KPup1EnJXgGbtVG%2FvTQlbwP9O0ezGQaPUjuc%3D&"; // Your device SaS token (needed for c2d and d2c messages)
wsSendMessage : WSTRING(255) := "{ $"messageId$" : 1, $"deviceId$" : $"CODESYSDevice1$", $"temperature$" : 26, $"humidity$" : 32 }";

IF rSendTrig.Q THEN
sendMessage.xExecute := TRUE;
END_IF
sendMessage(
udiTimeOut := 5000000,
sHubDomainName := sSubDomainName,
sDeviceId := sDeviceId,
wsSaS := wsDeviceSaS,
pwsData := ADR(wsSendMessage));
IF sendMessage.xDone THEN
sendMessage(xExecute := FALSE);
xSendError := FALSE;
xSendOk := TRUE;
ELSIF sendMessage.xError THEN
sendMessage(xExecute := FALSE);
xSendError := TRUE;
xSendOk := FALSE;
END_IF

So I am assuming the code/library should work and that I am simply missing something due to the poor documentation?