How to get the sasKey or connectionString when developing a module? - azure-iot-edge

Question

I am attempting to write a module where I cannot use the current ModuleClient.CreateFromEnvironmentAsync() and would like to get the module connection string (or SASKey) so I can generate a SAS token and authenticate.
I know that at one time (and in the IoTEdgeDev container) the environment variable EdgeHubConnectionString existed and was later removed. How can I derive the sasKey in code in a module? Imaging if I needed/wanted to use Paho in the module instead of the MSFT provided SDK.
Update
So I guess I have to sign the URI to create a connection string, similar to manually creating a connection string.
I have tried the code below, but the signature does not match what I get with Azure IoT Explorer. Any help would be appreciated. Reference: https://github.com/Azure/iotedge/blob/d2c331d605a846911019364a31a7d098e1e2fc45/edgelet/workload/docs/WorkloadApi.md
# expecting curl, base64 and jq to be installed
epoch=$(printf '%(%s)T\n' -1)
epoch=$(($epoch+86400))
dataToSign=$IOTEDGE_IOTHUBHOSTNAME"%2Fdevices%2F"$IOTEDGE_DEVICEID"%2Fmodules%2F"$IOTEDGE_MODULEID
signedData=$(echo -n $dataToSign'\n'$epoch | base64 -w 0)
signature=$(curl --unix-socket /var/run/iotedge/workload.sock http://127.0.0.1/modules/$IOTEDGE_MODULEID/genid/$IOTEDGE_MODULEGENERATIONID/sign?api-version=$IOTEDGE_APIVERSION \
--header "Content-Type: application/json" --request POST --data '{"data": "'$signedData'", "keyId": "", "algo": "HMAC-SHA256"}' \
| jq -r ".digest")
SASToken="SharedAccessSignature=SharedAccessSignature sr=$dataToSign&sig=$signature&se=$epoch"
ConnectionString="HostName=$IOTEDGE_IOTHUBHOSTNAME;DeviceId=$IOTEDGE_DEVICEID;ModuleId=$IOTEDGE_MODULEID;$SASToken"

Answer 1

I took a look at the implementation of ModuleClient.CreateFromEnvironmentAsync() in the C# SDK. It uses the following environment variables to create the connection string:
- IOTEDGE_WORKLOADURI URI for iotedged's workload API
- IOTEDGE_DEVICEID Device identifier
- IOTEDGE_MODULEID Module identifier
- IOTEDGE_MODULEGENERATIONID Module generation identifier
- IOTEDGE_IOTHUBHOSTNAME IoT Hub host name
- IOTEDGE_AUTHSCHEME Authentication scheme to use; must be "sasToken"
It seems the SAS token is created in the ModuleAuthenticationWithHsm class, you might be able to base your code on this?

Answer 2

So after hours of iteration, here is how to call the sign API to get a SAS Token:
# expecting curl, base64 and jq to be installed in the Linux OS
epoch=$(printf '%(%s)T\n' -1)
epoch=$(($epoch+86400))
WORKLOADURI=$(echo $IOTEDGE_WORKLOADURI | sed "s|unix://|""|g")
uri=$(echo $IOTEDGE_IOTHUBHOSTNAME"/devices/"$IOTEDGE_DEVICEID"/modules/"$IOTEDGE_MODULEID | sed "s|/|%2F|g")
signedData=$(echo -n $uri$'\n'$epoch | base64 -w 0)
signature=$(curl --unix-socket $WORKLOADURI http://127.0.0.1/modules/$IOTEDGE_MODULEID/genid/$IOTEDGE_MODULEGENERATIONID/sign?api-version=$IOTEDGE_APIVERSION \
--request POST --data '{"data": "'$signedData'", "keyId": "", "algo": "HMAC-SHA256"}' \
| jq -r ".digest" | sed "s|=|%3D|g" | sed "s|+|%2B|g" | sed "s|/|%2F|g")
# here is our SAS Token
SASToken="SharedAccessSignature=SharedAccessSignature sr=$uri&sig=$signature&se=$epoch"
# here is a connection string with the SAS Token
ConnectionString="HostName=$IOTEDGE_IOTHUBHOSTNAME;DeviceId=$IOTEDGE_DEVICEID;ModuleId=$IOTEDGE_MODULEID;$SASToken"