azure - 在 Api Management 的 validate-jwt 中验证 "scp"

Question

我正在尝试验证传入的 JWT token 是否具有范围“labresults.read”和“user_impersonation”。我执行了以下策略片段

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Invalid JWT Token" require-signed-tokens="true">
    <openid-config url="(snip)" />
    <audiences>
        <audience>(snip)</audience>
    </audiences>
    <required-claims>
        <claim name="scp" match="all">
            <value>labresults.read</value>
            <value>user_impersonation</value>
        </claim>
    </required-claims>
</validate-jwt>

我传入一个看起来像的 token

{
  "iss": "(snip)",
  "exp": 1522334650,
  "nbf": 1522331050,
  "aud": "(snip)",
  "sub": "(snip)",
  "email": "(snip)",
  "name": "Scott Chamberlain",
  "scp": "labresults.read user_impersonation",
  "azp": "(snip)",
  "ver": "1.0",
  "iat": 1522331050
}

当我从开发者门户进行“尝试”时，查看跟踪错误报告

validate-jwt (648 ms){
    "message": "JWT Validation Failed: Claim value mismatch: scp=labresults.read.."
}

我是否被迫使用单一声明

<claim name="scp">
    <value>labresults.read user_impersonation</value>
</claim>

我真的不想这样做，因为我不想强制这个 api 的使用者知道这两个作用域将是唯一按特定顺序传入的东西。

我需要做什么才能以正确的方式验证范围？

Answer 1

在 MSDN 论坛上从 Microsoft 人员那里得到了答案。

I would suggest you to specify “separator” attribute in policy statement to validate the JWT token and see if it helps. For more information, you might refer this document: https://learn.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#ValidateJWT.

Swikruti BoseMicrosoft-MSFT (MSFT CSG)

当我第一次查看文档时，我完全忽略了 seperator 属性。