c# - SecurityTokenValidated 回调是否使用 Owin 中间件自动验证 token

Question

我正在使用 Azure Ad 并按如下方式设置我的 Startup.Auth.cs 文件我能够连接并使用 Azure、Google、MS 和 Linked in 来成功进行身份验证，并且我收到了返回的 id_token，但我希望能够验证从 Azure 收到的此 token ，但我我不确定如何做。引发的 SecurityTokenValidated 事件是否意味着该 token 已根据我定义的 TokenValidationParameters 进行了验证，并且我不需要验证该 token ？如果是这种情况，我应该在 TokenValidationParameters 中放入什么？

我收到的 id_token 不包含要验证的加密签名

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

            app.UseCookieAuthentication(new CookieAuthenticationOptions
                {
                    SlidingExpiration = true,
                    LoginPath = new PathString("/"),
                    CookieSecure = CookieSecureOption.Always,


                });

            var options = new OpenIdConnectAuthenticationOptions
            {

                Authority = "https://login.windows.net/common",
                ClientId = clientId,
                RedirectUri = redirectUri,
                PostLogoutRedirectUri = postLogoutRedirectUri,
                Notifications = new OpenIdConnectAuthenticationNotifications
                {

                    AuthenticationFailed = AuthenticationFailed,
                    RedirectToIdentityProvider = OnRedirectToIdentityProvider,
                    SecurityTokenReceived = OnSecurityTokenReceived,
                    AuthorizationCodeReceived = OnAuthorizationCodeReceived,
                    SecurityTokenValidated = OnSecurityTokenValidated,
                    MessageReceived = OnMessageReceived
                },
                Scope = "openid",
                ResponseType = "id_token",
                Description = new AuthenticationDescription
                {

                    AuthenticationType = "OpenIdConnect",
                                        },

                ConfigurationManager = new PolicyConfigurationManager(
                    string.Format(CultureInfo.InvariantCulture, aadInstance, tenant, "/v2.0", OidcMetadataSuffix),
                    new[] { SisuGoogle, SisuLinkedIn, SisuMicrosoft, SisuLocal, ResetPasswordLocalPolicyId }),


                TokenValidationParameters = new TokenValidationParameters
                {
                    ValidAudiences = new string[]
                    {
                     "http://localhost:44330/",


                    },
                    IssuerSigningKey = GetSecurityKey(),
                    // If you don't add this, you get IDX10205
                    //ValidateIssuer = false,
                },
            };

            app.UseOpenIdConnectAuthentication(options);



 private SecurityKey GetSecurityKey()
        {
            var securityKey = "secure key";
            var signingKey = new InMemorySymmetricSecurityKey(Encoding.UTF8.GetBytes(securityKey));
            var signingCredentials = new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha256Signature,SecurityAlgorithms.Sha256Digest);
            return signingCredentials.SigningKey;
        }


    private Task OnSecurityTokenValidated(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> arg)
            {


//do I need to validate the token here or has it already been validated??

//if I have to validate it then how do I? I've tried the following but does not work
                var tokenValidationParameters = new TokenValidationParameters
                {
                    IssuerSigningKey = GetSecurityKey()
                };

                SecurityToken validatedToken;
                var jwtHandler = new JwtSecurityTokenHandler();


    //crashes at this point
                jwtHandler.ValidateToken(arg.ProtocolMessage.IdToken, tokenValidationParameters, out validatedToken);



                return Task.FromResult(0);
            }

Answer 1

您可以按照以下示例操作:https://github.com/Azure/azure-content/blob/master/articles/active-directory-b2c/active-directory-b2c-devquickstarts-api-dotnet.md

或者看看这个类似的问题: https://social.msdn.microsoft.com/Forums/en-US/893a6142-1508-4aa2-9da3-dab3b1f1a6b9/b2c-jwt-token-signature-validation?forum=WindowsAzureAD

如果您在示例中使用类似的配置，那么 OWIN 将使用从元数据端点获取的 key 来处理 token 验证。