身份服务器4如何实现Json Web令牌

Question

I am very confused about the difference between oauth2 tokens and json web tokens. I have searched about these technologies and the result is ;

Open Id is a protocol and It uses JSON Web tokens to ensure the requests are coming from a trusted user.

A Json web token contains a few user information ( claims ) as encrypted with a private key of sts.

Oauth2 is a framework and we can manage the login operations between our users , clients and resources and third-party applications.

Identity Framework 4 is an Open Id connect implementations .net MVC library. The library has written with oauth2 specs and it implements Open Id.

This is the point I didn't understand. The Oauth2 framework already has its token implementation.

Where is the place of JSON web tokens in this scenario? For example, we have a simple web application and a server which implements identity server 4.

When a user requested a page from web application user will be redirected to our identity server to login operation. After successful login Identity server adds a cookie to our response and these cookıe contains a token. We wıll use that token when requests the other secure resources .

These steps are clear for me. Where is the Jason Web token in this schenio ? How can I use JSON web tokens in my client app? Where can I reach my user claims?

Answer 1

The reason for JWT is given in the specs of OAuth2

Since OAuth 2.0 does not define a protocol for the resource server to learn meta-information about a token that it has received from an
authorization server, several different approaches have been
developed to bridge this gap. These include using structured token
formats such as JWT [RFC7519] or proprietary inter-service
communication mechanisms (such as shared databases and protected
enterprise service buses) that convey token information.

Being an open-standard JWT has been largely adopted in security-related technology and protocols. It defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed

Let's explain some concepts of this definition further.

• Compact : Because of their smaller size, JWTs can be sent through a URL, POST parameter, or inside an HTTP header. Additionally, the smaller size means transmission is fast.

• Self-contained : The payload contains all the required information about the user, avoiding the need to query the database more than once.

There are a lot of sites explaining these things as well as numerous technology providers.

• https://jwt.io/introduction/ for providing tutorials and free e-book
• https://oauth.net/2/ for in-depth stuff
• https://openid.net/connect/ for the new kid on the block

To answer your IdentityServer related questions. Authentication & authorization related information are usually encoded

• access token
• identity token

The application-specific information/payload in these tokens is encoded using JWT. JWT is mostly transparent to application developers if good libraries are provided - as is the case for IdentityServer. You will find answers to your questions in the excellent documentation for IdentityServer . How to extract user claims is covered as well. The project provides numerous client examples that cover typical AuthX setups out there. It takes time and commitment to get through it.

Answer 2

JSON Web Token (JWT) ( RFC 7519 ) itself is independent of OAuth 2.0 and OpenID Connect. You can use JWT wherever you like.

OAuth 2.0 is a specification as to how to request and issue access tokens . The specification does not say anything about how access tokens should be represented. Therefore, access tokens may be random strings or may be JWTs. Some authorization server implementations generate random strings and issue them as access tokens, and other implementations generate JWTs and issue them as access tokens. See “7. Access Token” in “ Full-Scratch Implementor of OAuth and OpenID Connect Talks About Findings ” for further discussion.

OpenID Connect is a specification as to how to request and issue ID tokens . The specification says an ID token is a kind of JWT. In addition, JWT is used in other places in the specification. Responses from UserInfo Endpoint are either plain JSON or JWT. Request Objects are JWT.

In normal cases, a server which supports OpenID Connect can issue both ID tokens (which are JWTs) and access tokens (which are either random strings or JWTs) . This may be making you confused. Reading the following articles may be of help.

1. Diagrams of All The OpenID Connect Flows
2. Diagrams And Movies Of All The OAuth 2.0 Flows