Programmatically regenerate keys for group enrollments in Azure Device provisioning Service (DPS)

Question

I want to programmatically regenerate the symmetric key (primary and secondary keys) in group enrollments of Azure DPS, there is an API provided by azure in the link. I used this github repo and was able to run it.

I used the API but it retured 404 not found. I used the mentioned github repo and was able to get the instance of an enrollment group. Now I want a way to regenerate the keys for current group but there is seem to have no function that would allow that thing. A way is to change the redo attestation that in return will change the symmetric keys but I have not find a way yet.

If anyone could help me, that would be great.

Answer 1

There's no API specifically for regenerating group enrollment keys. However, you can use the CreateOrUpdateEnrollmentGroupAsync method to update an existing enrollment group, passing in a new set of keys. See: https://learn.microsoft.com/en-us/dotnet/api/microsoft.azure.devices.provisioning.service.provisioningserviceclient.createorupdateenrollmentgroupasync?view=azure-dotnet&viewFallbackFrom=azure-dotnet-preview You will need to generate your new symmetric keys to pass in as part of the EnrollmentGroup parameter.

The following sample shows an example of using this method with an enrollment group that uses X.509 certs, but you should be able to easily modify it to use symmetric keys instead: https://github.com/Azure/azure-iot-sdk-csharp/tree/main/provisioning/service/samples/getting%20started/EnrollmentGroupSample

To generate a suitable key in Python, you could use the following:

from hashlib import sha256
from base64 import b64encode
s = 'mysecretkeyfordps'
h = sha256()
h.update(s.encode())
b64bytes = b64encode(h.digest())
print(b64bytes.decode())