linux - .Net Core 2.2 jwt 验证在容器上失败并显示 401

Question

在 .net core 2.2 中，当我将应用程序容器化时，我得到 Bearer error="invalid_token", error_description="The signature is invalid"

当我使用 IIS/IIS express 在 Windows 上托管它时，它工作正常。

我的代码—— token 生成器是 IBM API Connect，它使用 RSA 256 算法生成 key

 var rsa = new RSACryptoServiceProvider();
 string exponentvalue = "AQAB";
 var e = Base64UrlEncoder.DecodeBytes(exponentvalue);
 var N = "public key  put your value here"
 var modulus = Base64UrlEncoder.DecodeBytes(N);
 rsa.ImportParameters(
     new RSAParameters()
     {
             Modulus = modulus,
             Exponent = e
    });
  var signingKey = new RsaSecurityKey(rsa);

var tokenValidationParameters = new TokenValidationParameters
          {
              // The signing key must match!
              ValidateIssuerSigningKey = true,
              IssuerSigningKey = signingKey,

              // Validate the JWT Issuer (iss) claim
              ValidateIssuer = false,
              ValidIssuer = issuer,

              // Validate the JWT Audience (aud) claim
              ValidateAudience = false,
              ValidAudience = audience,

              // Validate the token expiry
              //ValidateLifetime = true,

              // If you want to allow a certain amount of clock drift, set that here:
              //ClockSkew = TimeSpan.FromMinutes(1)
          };

知道为什么它不能在本地托管在 docker 或 AKS 上的容器上运行吗？

Answer 1

经过几天的研究和尝试不同的事情终于解决了我的问题。

第一期正如@bartonjs 在此处提到的 implement RSA in .NET core我不得不使用 RSA.Create() 而不是 RSACryptoServiceProvider()。

第二个问题如上面帖子中所推荐的那样，我使用(使用)在 Linux 中不起作用的语句来实现它。来自@bartonjs 对这篇文章的评论 https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/994看起来像是引入了一个错误“我们可能不小心引入了一个错误，其中后处理与新创建的相同，它认为它只需要在第一次(下一次，在这种情况下)使用时组成一个键。”

可在 Linux 和 Windows 上运行的最终代码

public class JwtConfiguration : IDisposable
    {
        /// <summary>
        /// Configures the JWT Token Validation parameters.
        /// </summary>
        /// <param name="Configuration">
        /// ASP.NET Core Configuration object instance.
        /// </param>
        /// <returns>
        /// A TokenValidationParameters object instance.
        /// </returns>
        private RSA _publicRsa;
        private SecurityKey _issuerSigningKey;

        public TokenValidationParameters GetTokenValidationParameters(IConfiguration Configuration)
        {

            var issuer = Configuration["Jwt:Issuer"];
            if (string.IsNullOrWhiteSpace(issuer))
            {
                throw new MissingJwtTokenParameterException("Missing Jwt:Issuer value.");
            }

            var audience = Configuration["Jwt:Audience"];
            if (string.IsNullOrWhiteSpace(audience))
            {
                throw new MissingJwtTokenParameterException("Missing Jwt:Audience value.");
            }

            var secretKey = Configuration["Jwt:Key"];
            if (string.IsNullOrWhiteSpace(secretKey))
            {
                throw new MissingJwtTokenParameterException("Missing Jwt:Key value.");
            }

            string exponentvalue = "AQAB";
            var e = Base64UrlEncoder.DecodeBytes(exponentvalue);
            var modulus = Base64UrlEncoder.DecodeBytes(secretKey);
            _publicRsa = RSA.Create();
            _publicRsa.KeySize = 3072;
            _publicRsa.ImportParameters(
            new RSAParameters()
            {
                Modulus = modulus,
                Exponent = e
            });

            _issuerSigningKey = new RsaSecurityKey(_publicRsa);

            var tokenValidationParameters = new TokenValidationParameters
            {
                // The signing key must match!
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = _issuerSigningKey,

                // Validate the JWT Issuer (iss) claim
                ValidateIssuer = true,
                ValidIssuer = issuer,

                // Validate the JWT Audience (aud) claim
                ValidateAudience = true,
                ValidAudience = audience,

                //Validate the token expiry
                ValidateLifetime = true,

                // If you want to allow a certain amount of clock drift, set that here:
                ClockSkew = TimeSpan.FromMinutes(1)
            };

            return tokenValidationParameters;

        }



        #region IDisposable Support
        private bool disposedValue = false; // To detect redundant calls

        protected virtual void Dispose(bool disposing)
        {
            if (!disposedValue)
            {
                if (disposing)
                {
                    // TODO: dispose managed state (managed objects).
                    _publicRsa?.Dispose();
                }

                // TODO: free unmanaged resources (unmanaged objects) and override a finalizer below.
                // TODO: set large fields to null.

                disposedValue = true;
            }
        }

        // TODO: override a finalizer only if Dispose(bool disposing) above has code to free unmanaged resources.
         ~JwtConfiguration() {
           // Do not change this code. Put cleanup code in Dispose(bool disposing) above.
           Dispose(false);
         }

        // This code added to correctly implement the disposable pattern.
        public void Dispose()
        {
            // Do not change this code. Put cleanup code in Dispose(bool disposing) above.
            Dispose(true);
            // TODO: uncomment the following line if the finalizer is overridden above.
            GC.SuppressFinalize(this);
        }
        #endregion

    }