[英]How to validate jwt token from different issuer
我正在使用可操作的消息(使用Outlook Web应用程序)来调用逻辑应用程序。 因此我在请求中获得了一个Bearer令牌:
“行动授权”:“持票人eyJ0eXAi ......”
Callstack: Outlook web app -> Logic App -> my endpoint hosted in azure
现在我尝试使用jwt.io验证令牌,但遇到Signature无效的问题。 所以我尝试使用JwtSecurityTokenHandler
在c#中验证它。
我试图将https://substrate.office.com/sts/
添加到发行者列表中,但似乎验证甚至没有到达那里。
我正在使用以下代码来验证office.com发布的jwt令牌:
bool IsAuthorized(HttpActionContext actionContext)
{
var valid = base.IsAuthorized(actionContext);
// Custom handle for Bearer token, when invalid from base-class
if (!valid && actionContext.Request.Headers.Authorization.Scheme == "Bearer")
{
var jwt = actionContext.Request.Headers.Authorization.Parameter;
var th = new JwtSecurityTokenHandler();
var sjwt = th.ReadToken(jwt) as JwtSecurityToken;
var validationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = false,
//IssuerSigningToken = sjwt,
ValidateActor = false,
ValidateAudience = false,
ValidateIssuer = true,
ValidateLifetime = true,
ValidIssuers = new[] { "https://substrate.office.com/sts/" },
ValidAudiences = new[] {"https://XXX.logic.azure.com"}
};
SecurityToken validatedToken;
try
{
th.ValidateToken(jwt, validationParameters, out validatedToken);
}
catch (Exception ex)
{
return false;
}
}
return valid;
}
这是我的JWT令牌:
我得到了例外:
IDX10500: Signature validation failed. Unable to resolve SecurityKeyIdentifier: 'SecurityKeyIdentifier
(
IsReadOnly = False,
Count = 2,
Clause[0] = X509ThumbprintKeyIdentifierClause(Hash = 0x818...),
Clause[1] = System.IdentityModel.Tokens.NamedKeySecurityKeyIdentifierClause
)
', ...
即使我设置了ValidateIssuerSigningKey = false
。
有没有办法接受https://substrate.office.com/sts/
作为有效的发行人?
例外情况说“签名验证失败”。 要解决此问题,我们不能只将想要的有效发行者添加到ValidIssuers
,我们需要验证令牌是从发行者本身发出的。
特别是对于这种情况下,与office.com是发行人,我发现与期望的密钥(JWK - JSON网络密钥)这里: https://substrate.office.com/sts/common/discovery/keys (也https://开头基板。 office.com/sts/common/.well-known/openid-configuration )
这是工作代码:
bool IsAuthorized(HttpActionContext actionContext)
{
var valid = base.IsAuthorized(actionContext);
// Custom handle for Bearer token, when invalid from base-class
if (!valid && actionContext.Request.Headers.Authorization.Scheme == "Bearer")
{
var jwt = actionContext.Request.Headers.Authorization.Parameter;
var th = new JwtSecurityTokenHandler();
var validationParameters = new TokenValidationParameters
{
ValidateAudience = false,
ValidateLifetime = true,
ValidateIssuer = true,
ValidateIssuerSigningKey = true,
IssuerSigningKey = new JsonWebKey(GetJWK()),
ValidIssuers = new[] { "https://substrate.office.com/sts/" }
};
Microsoft.IdentityModel.Tokens.SecurityToken validatedToken;
try
{
var claims = th.ValidateToken(jwt, validationParameters, out validatedToken);
valid = true;
}
catch (Exception ex)
{
valid = false;
}
}
return valid;
}
// Get the token from configuration
private string GetJWK()
{
return ConfigurationManager.AppSettings["ida:jwks_json"];
}
在appsettings我把网站上的RSA密钥用于验证令牌,它看起来像:
{"kty":"RSA","use":"sig","kid":"gY...","x5t":"gY...","n":"2w...","e":"AQAB","x5c":["MII..."]}
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.