java - 为什么通过刷新 token 获取 Azure AD token 没有签名算法？

Question

当我通过授权代码 (authContext.acquireTokenByAuthorizationCode) 获取 token 时，我会得到一个已签名且具有正确 header 的 JWT (idToken):

{
  "typ": "JWT",
  "alg": "RS256",
  "x5t": "wLLmYfsqdQuWtV_-hnVtDJJZM3Q",
  "kid": "wLLmYfsqdQuWtV_-hnVtDJJZM3Q"
}

但是当我使用刷新 token 获取新 token (authContext.acquireTokenByRefreshToken(...))时，它返回一个未签名的 JWT:

{
  "typ": "JWT",
  "alg": "none"
}

我如何让它给我一个签名的 JWT？

返回 authContext.acquireTokenByRefreshToken(
刷新 token ，
新的客户凭证(
客户端ID,
客户 secret
),
无效的
)；


Answer 1

我没有重现您的问题。我关注了这个tutorial使用以下代码成功获取身份验证代码并获取访问 token 和刷新 token 。请引用一下。

import com.microsoft.aad.adal4j.AuthenticationContext;
import com.microsoft.aad.adal4j.AuthenticationResult;
import com.microsoft.aad.adal4j.ClientCredential;

import java.net.URI;
import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;

public class GetTokenByAuthenticationCode {

    private static final String APP_ID = "***";
    private static final String APP_SECRET = "***";
    private static final String REDIRECT_URI = "http://localhost:8080";
    private static final String tenant = "***";

    public static void main(String[] args) throws Exception {

        String authority = "https://login.microsoftonline.com/" + tenant + "/oauth2/authorize";
        ExecutorService service = Executors.newFixedThreadPool(1);

        String code = "***";

        AuthenticationContext context = new AuthenticationContext(authority, true, service);

        URI url = new URI(REDIRECT_URI);

        Future<AuthenticationResult> result = context.acquireTokenByAuthorizationCode(
                code,
                url,
                new ClientCredential(APP_ID, APP_SECRET),
                null
        );
        String token = result.get().getAccessToken();
        System.out.println(token);
        String refreshToken = result.get().getRefreshToken();
        System.out.println(refreshToken);


        Future<AuthenticationResult> result1 = context.acquireTokenByRefreshToken(
                refreshToken,
                new ClientCredential(APP_ID, APP_SECRET),
                null
        );

        String tokenNew = result1.get().getAccessToken();
        String refreshTokenNew = result1.get().getRefreshToken();
        System.out.println(tokenNew);
        System.out.println(refreshTokenNew);
    }
}

解码:

<小时/>

更新答案:

首先，对错误表示歉意。我把getIdToken替换为getAccessToken，结果和你一样。然后我在Authorize access to Azure Active Directory web applications using the OAuth 2.0 code grant flow中查找响应参数，可以找到id_token参数的声明。

An unsigned JSON Web Token (JWT) representing an ID token. The app can base64Url decode the segments of this token to request information about the user who signed in. The app can cache the values and display them, but it should not rely on them for any authorization or security boundaries.

因此，id token 只是一个不可靠的段。如果您想获取完整的id token，请引用openId flow 。