如何验证来自不同颁发者jwt令牌
我正在使用可操作消息(使用Outlook web应用程序)呼叫逻辑应用程序。因此，我在请求中获得了一个持有者令牌：
"Action-Authorization"：“持有者eyJ0eXAi...”
调用堆栈：Outlook web app -> Logic App -> my endpoint hosted in azure
现在，我尝试使用jwt.io验证令牌，但得到一个签名无效的问题。所以我试着用JwtSecurityTokenHandler在c#中验证它。
我试图将https://substrate.office.com/sts/添加到颁发者列表中，但似乎验证甚至没有到达那里。
我使用以下代码来验证office.com发出的jwt令牌：
bool IsAuthorized(HttpActionContext actionContext)
{
var valid = base.IsAuthorized(actionContext);
// Custom handle for Bearer token, when invalid from base-class
if (!valid && actionContext.Request.Headers.Authorization.Scheme == "Bearer")
{
var jwt = actionContext.Request.Headers.Authorization.Parameter;
var th = new JwtSecurityTokenHandler();
var sjwt = th.ReadToken(jwt) as JwtSecurityToken;
var validationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = false,
//IssuerSigningToken = sjwt,
ValidateActor = false,
ValidateAudience = false,
ValidateIssuer = true,
ValidateLifetime = true,
ValidIssuers = new[] { "https://substrate.office.com/sts/" },
ValidAudiences = new[] {"https://XXX.logic.azure.com"}
};
SecurityToken validatedToken;
try
{
th.ValidateToken(jwt, validationParameters, out validatedToken);
}
catch (Exception ex)
{
return false;
}
}
return valid;
}这是我的JWT令牌：
我得到了一个异常：
IDX10500: Signature validation failed. Unable to resolve SecurityKeyIdentifier: 'SecurityKeyIdentifier
(
IsReadOnly = False,
Count = 2,
Clause[0] = X509ThumbprintKeyIdentifierClause(Hash = 0x818...),
Clause[1] = System.IdentityModel.Tokens.NamedKeySecurityKeyIdentifierClause
)
', ...即使我设置了ValidateIssuerSigningKey = false。
有没有办法接受https://substrate.office.com/sts/作为有效的发行者？
回答 1
Stack Overflow用户
发布于 2019-05-07 19:28:27
异常显示“签名验证失败”。要解决此问题，我们不能只将所需的有效颁发者添加到ValidIssuers中，我们需要验证令牌是否由颁发者本身颁发。
特别是对于office.com是颁发者的这种情况，我在这里找到了预期的密钥(JWK - JSON Web密钥)：https://substrate.office.com/sts/common/discovery/keys (也是https://substrate.office.com/sts/common/.well-known/openid-configuration)
以下是工作代码：
bool IsAuthorized(HttpActionContext actionContext)
{
var valid = base.IsAuthorized(actionContext);
// Custom handle for Bearer token, when invalid from base-class
if (!valid && actionContext.Request.Headers.Authorization.Scheme == "Bearer")
{
var jwt = actionContext.Request.Headers.Authorization.Parameter;
var th = new JwtSecurityTokenHandler();
var validationParameters = new TokenValidationParameters
{
ValidateAudience = false,
ValidateLifetime = true,
ValidateIssuer = true,
ValidateIssuerSigningKey = true,
IssuerSigningKey = new JsonWebKey(GetJWK()),
ValidIssuers = new[] { "https://substrate.office.com/sts/" }
};
Microsoft.IdentityModel.Tokens.SecurityToken validatedToken;
try
{
var claims = th.ValidateToken(jwt, validationParameters, out validatedToken);
valid = true;
}
catch (Exception ex)
{
valid = false;
}
}
return valid;
}
// Get the token from configuration
private string GetJWK()
{
return ConfigurationManager.AppSettings["ida:jwks_json"];
}在应用程序设置中，我将来自网站的RSA密钥放入以验证令牌，如下所示：
{"kty":"RSA","use":"sig","kid":"gY...","x5t":"gY...","n":"2w...","e":"AQAB","x5c":["MII..."]}https://stackoverflow.com/questions/56017333
复制相似问题
腾讯云开发者
