c# - 将 Bot Framework Bot 作为 Azure Web 应用程序工作，突然没有配置更改，出现 SecurityTokenSignatureKeyNotFoundException : IDX10501

Question

我一直在训练自己构建一个与 MS Teams 集成的机器人。

我已按照教程构建了一个简单的 echo 机器人，并进一步使用了 .Net Core 3.1 之上的 Bot Framework 版本 4 的 Visual Studio 2019 插件。

一周前，我有两个工作机器人使用该框架并执行非常简单的任务。

Bot 机器人被部署为 Azure Web Apps - 我可以在 Teams Chat 中输入一些内容，机器人就会做出响应。一切都好。

今天，在离开我的项目大约 24 小时后，使用相同网络应用程序在相同团队实例中进行相同聊天尝试，并且传递相同凭据(应用程序 ID 和应用程序密码)，他们刚刚停止工作。从日志中，我可以看到名为 Microsoft.AspNetCore.Server.IIS.Core.IISHttpServer 的类别已检测到未处理的异常，事件 ID ApplicationError 和日志消息 连接ID“15924728283992716557”，请求ID“8000750e-0000-dd00-b63f-84710c7967bb”:应用程序引发了未处理的异常。

异常本身如下:

Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match key: 
kid: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
Exceptions caught:
 '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. 
token: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'.
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
   at Microsoft.Bot.Connector.Authentication.JwtTokenExtractor.ValidateTokenAsync(String jwtToken, String channelId, String[] requiredEndorsements)
   at Microsoft.Bot.Connector.Authentication.JwtTokenExtractor.GetIdentityAsync(String scheme, String parameter, String channelId, String[] requiredEndorsements)
   at Microsoft.Bot.Connector.Authentication.JwtTokenExtractor.GetIdentityAsync(String authorizationHeader, String channelId, String[] requiredEndorsements)
   at Microsoft.Bot.Connector.Authentication.ChannelValidation.AuthenticateChannelToken(String authHeader, ICredentialProvider credentials, HttpClient httpClient, String channelId, AuthenticationConfiguration authConfig)
   at Microsoft.Bot.Connector.Authentication.ChannelValidation.AuthenticateChannelToken(String authHeader, ICredentialProvider credentials, String serviceUrl, HttpClient httpClient, String channelId, AuthenticationConfiguration authConfig)
   at Microsoft.Bot.Connector.Authentication.JwtTokenValidation.AuthenticateTokenAsync(String authHeader, ICredentialProvider credentials, IChannelProvider channelProvider, String channelId, AuthenticationConfiguration authConfig, String serviceUrl, HttpClient httpClient)
   at Microsoft.Bot.Connector.Authentication.JwtTokenValidation.ValidateAuthHeader(String authHeader, ICredentialProvider credentials, IChannelProvider channelProvider, String channelId, AuthenticationConfiguration authConfig, String serviceUrl, HttpClient httpClient)
   at Microsoft.Bot.Connector.Authentication.JwtTokenValidation.AuthenticateRequest(IActivity activity, String authHeader, ICredentialProvider credentials, IChannelProvider provider, AuthenticationConfiguration authConfig, HttpClient httpClient)
   at Microsoft.Bot.Builder.BotFrameworkAdapter.ProcessActivityAsync(String authHeader, Activity activity, BotCallbackHandler callback, CancellationToken cancellationToken)
   at Microsoft.Bot.Builder.Integration.AspNet.Core.BotFrameworkHttpAdapter.ProcessAsync(HttpRequest httpRequest, HttpResponse httpResponse, IBot bot, CancellationToken cancellationToken)
   at EchoBot1.Controllers.BotController.PostAsync() in C:\Ops\Development\Users\Stephan\EchoBot1\EchoBot1\Controllers\BotController.cs:line 34
   at lambda_method(Closure , Object )
   at Microsoft.Extensions.Internal.ObjectMethodExecutorAwaitable.Awaiter.GetResult()
   at Microsoft.AspNetCore.Mvc.Infrastructure.ActionMethodExecutor.AwaitableResultExecutor.Execute(IActionResultTypeMapper mapper, ObjectMethodExecutor executor, Object controller, Object[] arguments)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeActionMethodAsync>g__Awaited|12_0(ControllerActionInvoker invoker, ValueTask`1 actionResultValueTask)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeNextActionFilterAsync>g__Awaited|10_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Rethrow(ActionExecutedContextSealed context)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.Next(State& next, Scope& scope, Object& state, Boolean& isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ControllerActionInvoker.<InvokeInnerFilterAsync>g__Awaited|13_0(ControllerActionInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeFilterPipelineAsync>g__Awaited|19_0(ResourceInvoker invoker, Task lastTask, State next, Scope scope, Object state, Boolean isCompleted)
   at Microsoft.AspNetCore.Mvc.Infrastructure.ResourceInvoker.<InvokeAsync>g__Logged|17_1(ResourceInvoker invoker)
   at Microsoft.AspNetCore.Routing.EndpointMiddleware.<Invoke>g__AwaitRequestTask|6_0(Endpoint endpoint, Task requestTask, ILogger logger)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Server.IIS.Core.IISHttpContextOfT`1.ProcessRequestAsync()

该堆栈跟踪中的每个条目都是 Asp .Net Core 框架或 Bot 框架的一部分。唯一的异常(exception)是条目:

at EchoBot1.Controllers.BotController.PostAsync() in C:\Ops\Development\Users\Stephan\EchoBot1\EchoBot1\Controllers\BotController.cs:line 34

毫不奇怪，我的 Controller 中第 34 行的代码是:

    [HttpPost, HttpGet]
    public async Task PostAsync()
    {
        // Delegate the processing of the HTTP POST to the adapter.
        // The adapter will invoke the bot.
        await Adapter.ProcessAsync(Request, Response, Bot);  // LINE 34 - EXCEPTION HERE
    }

此代码与使用 Bot Framework v4 时由 Visual Studio 搭建的支架完全相同。

这有点令人失望，因为我的理解是，Bot 框架的主要好处之一是它提供了必要的安全握手，但是当它不起作用时，我完全不知道如何开始调试这个。

我将不胜感激有关发现问题的过程的任何见解或遇到此问题的其他人的任何经验。谢谢。

============编辑-添加最初模糊的附加信息=============

在我在最初的问题中引用的异常(exception)情况中，根据 Microsoft 的 GDPR 政策，各种元素都被掩盖了。我按照以下说明“隐藏”它们:https://aka.ms/IdentityModel/PII

这样，我得到了这些附加信息，这些信息表明除了无法将安全 key 与哈希值匹配之外，处理过程中没有任何异常。 (我已经确认这是正确的)。

这是附加信息，只是我手动模糊了一点:

Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match key: 
kid: 'KeyIHaveObsuredPresumablyFailsToMatchHash'.
Exceptions caught:
 ''. 
token: '{"alg":"RS256","kid":"KeyIHaveObsuredPresumablyFailsToMatchHash","typ":"JWT","x5t":"KeyIHaveObsuredPresumablyFailsToMatchHash"}.{"serviceurl":"https://smba.trafficmanager.net/amer/","nbf":1628123535,"exp":1628127135,"iss":"https://api.botframework.com","aud":"CorrectAppIdGuid"}'.

.... And Stack Trace as before ....

Answer 1

来自 MICROSOFT 的额外更新 2021 年 8 月 20 日这不是一个非常令人满意的答案，但我怀疑这就是我能得到的全部:

The issue occurred because of a configuration change which was made internally pertaining to the endpoints which has the public keys. This caused the keys to be missing from the well-known keys storage. But this has been fixed now and proper steps have been taken to ensure that the existing keys remain un-impacted.

另外...

Normally outage information regarding azure resources are published in the status link I have shared earlier. So in future, if in general some major issue happens owing to which resources are down we can expect it to be updated there.

终于写到了防御性编程:

Pertaining to this specific error, any exception handling might not solve the issue , max it can identify the issue. Reason is this was for some configuration change in the storage.

微软 2021 年 8 月 9 日更新:微软承认这是他们的基础设施错误，因为安全 key 缺失。他们仍在进行根本原因分析。我索要了一份副本，还询问了一些有关频率、期望、状态和防御性编程的其他问题。如果我得到它，我会发布更多值得注意的内容。

原始答案 2021 年 8 月 5 日:根据之前的回答和对最初帖子的善意评论，今天问题自行消失了。这已经影响了我的两个应用程序/机器人 - 其中一个完全自行清除，另一个在我(再次)重新启动应用程序服务后清除。需要明确的是，在大约 14 小时前首先发布这个问题之前，我已经重新启动了应用程序服务几次(甚至重新部署)。但现在一切又恢复正常了。