Azure IoT SAS Enrollment Group

Program.cs

using System;
using System.Security.Cryptography;
using System.Text;

namespace dps_group_sas
{
    class Program
    {

    public static string ComputeDerivedSymmetricKey(byte[] masterKey, string registrationId)
    {
        using (var hmac = new HMACSHA256(masterKey))
        {
            return Convert.ToBase64String(hmac.ComputeHash(Encoding.UTF8.GetBytes(registrationId)));
        }
    }

        static void Main(string[] args)
        {
            if (args.Length < 2)
            {
                Console.WriteLine("dps_group_sas <masterKey> <registrationID>");
                return;
            }

            Console.WriteLine(ComputeDerivedSymmetricKey(Convert.FromBase64String(args[0]), args[1]));

        }
    }
}

To deploy:

1. Install the .NET Core SDK (supported on Windows, Linux, OSX) from here: https://dotnet.microsoft.com/download
2. Create a new folder (e.g. dps_group_sas)
3. Run dotnet new within the folder.
4. Download Program.cs and replace it within the same folder

To create a device identity run

dotnet run "SharedAccessKey_From_Group_Enrollment" device-registration-id

E.g.

dotnet run "8abcdefghz.....==" my-sasgroup1-device1

where the first quoted string is one of the two keys available in the Provisioning portal:

The output can be used as the shared access key for DPS authentication and, after provisioning, for IoT Hub operations.

References:

https://docs.microsoft.com/azure/iot-dps/how-to-legacy-device-symm-key?tabs=linux
https://docs.microsoft.com/azure/iot-dps/concepts-symmetric-key-attestation#group-enrollments