[英]Can I register an IDP with multiple certificates on AWS IAM
What I have is:我所拥有的是:
What I did:我做了什么:
Problem:问题:
I tried to set the "kid" claim in the tokens each with the corresponding kid of the certificate and it didn't work :(.我试图在令牌中设置“kid”声明,每个令牌都带有证书的相应孩子,但它不起作用:(。
Note:笔记:
Sample of how my certs endpoint looks like:我的证书端点的示例:
{
"keys": [
{
"kid": "kid",
"kty": "kty",
"use": "use",
"alg": "alg",
"n": "nValue",
"e": "eValue",
"x5c": [
"cert1"
],
"x5t": "x5t=",
"x5t#S256": "x5t#S256"
},
{
"kid": "kid1",
"kty": "kty",
"use": "use",
"alg": "alg",
"n": "nValue",
"e": "eValue",
"x5c": [
"cert2"
],
"x5t": "x5t=",
"x5t#S256": "x5t#S256"
}
]
}
So the problem was that I tried to set the kid in the "claims" of the JWT.所以问题是我试图在 JWT 的“声明”中设置孩子。
However it turned out that ,in order for AWS to distinguish that this JWT was signed with this key (from the jwks response), it checks in the headers of the JWT.然而事实证明,为了让 AWS 区分这个 JWT 是用这个密钥签名的(来自 jwks 响应),它检查了 JWT 的标头。 If a kid is found in the header then it looks in the jwk response for the certificate with the corresponding kid.
如果在标头中找到了孩子,那么它会在 jwk 响应中查找具有相应孩子的证书。
So to solve the issue I just had to set the kid of in the "headers" of the JWT.所以为了解决这个问题,我只需要在 JWT 的“标题”中设置孩子。
So if you are in java :所以如果你在 java 中:
public String buildToken(Key key) {
Map<String, Object> claims = new HashMap();
Map<String, Object> headers = new HashMap();
claims.put(claimName, someClaim);
...
headers.put(KID, KID_OF_THIS_TOKENS_CERTIFICATE);
...
return Jwts.builder().setClaims(claims).setHeader(headers).signWith(SignatureAlgorithm.RS256, key).compact();
}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.