azure - 验证 Oauth Bearer token ，Microsoft.Owin.Security.Jwt 4.x 中缺少 IIssuerSecurityTokenProvider

Question

我正在尝试让我的 .Net Web API(使用 OWIN 的 Azure API 应用程序)接受用于 client_credentials 授予的 OAuth Bearer token ，但我不断收到 401 Unauthorized。

似乎所有 Microsoft 示例都已过时(不符合 Owin 的最新 nuget 包)。

JwtFormat 需要一个 IIssuerSecurityTokenProvider，但它不再存在 - 相反，JwtFormat 需要一个 IIssuerSecurityKeyProvider，但我无法理解如何使用它。

Azure OAuth 服务器正在运行

我已在 Azure Active Directory 中注册了两个应用程序(API 和客户端)。由于这只是快速演示，我将向您提供所有 id 和 secret ；)

我可以从 Azure AD 获取 token ，请参阅 https://reqbin.com/817shtc2对于完整的请求，到目前为止一切顺利。

API

ClientId: 44cf7574-88a2-42d6-9497-bff43cc8dc09

Endpoint: https://apim-demo-mglentoft.azure-api.net/api/Values (GET)

客户端

ClientId: 5f7ee334-b8db-46d3-972f-09f52e186d1d

Secret: ggKp94]HZHWZ.c*5wUC?ToSVfknyqLB3

我按照 https://github.com/azureadquickstarts/appmodelv2-nativeclient-dotnet 上的示例进行操作，但它引用了 nuget v4.0.1.0 中不存在的 Microsoft.Owin.Security.Jwt.IIssuerSecurityTokenProvider。

我尝试仅注释掉 JwtFormat 的第二个参数，但这不起作用。有什么想法如何使用 Microsoft.Owin.Security.Jwt.IIssuerSecurityKeyProvider 来实现此功能吗？

下面是整个startup.cs

我可以使用 .Net Core 来实现此功能，但由于各种原因我必须坚持使用 .Net Framework 4.7.2

using System;
using System.Configuration;
using System.Threading.Tasks;
using System.Web.Http;
using DemoAPI.Middleware;
using Microsoft.IdentityModel.Tokens;
using Microsoft.Owin;
using Microsoft.Owin.Cors;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Jwt;
using Microsoft.Owin.Security.OAuth;
using Owin;

[assembly: OwinStartup(typeof(DemoAPI.App_Start.Startup))]

namespace DemoAPI.App_Start
{
    public partial class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            var config = new HttpConfiguration();

            ConfigureAuth(app);
            app.Use(typeof(CorrelationHandlerMiddleware));


            app.UseCors(CorsOptions.AllowAll);
            WebApiConfig.Register(config);
            app.UseWebApi(config);
        }

        private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];

        public void ConfigureAuth(IAppBuilder app)
        {
            // NOTE: The usual WindowsAzureActiveDirectoryBearerAuthentication middleware uses a
            // metadata endpoint which is not supported by the v2.0 endpoint.  Instead, this 
            // OpenIdConnectSecurityTokenProvider implementation can be used to fetch & use the OpenIdConnect
            // metadata document - which for the v2 endpoint is https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration


            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
            {
                AccessTokenFormat = new JwtFormat(
                    new TokenValidationParameters
                    {
                        // Check if the audience is intended to be this application
                        ValidAudiences = new[] { clientId, $"api://{clientId}" },`enter code here`

                        // Change below to 'true' if you want this Web API to accept tokens issued to one Azure AD tenant only (single-tenant)
                        // Note that this is a simplification for the quickstart here. You should validate the issuer. For details, 
                        // see https://github.com/Azure-Samples/active-directory-dotnet-native-aspnetcore
                        ValidateIssuer = false,

                    }//,
                     //new OpenIdConnectSecurityKeyProvider("https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration")
                     //the OpenIdConnectSecurityKeyProvider implements IIssuerSecurityTokenProvider, which is not part of Microsoft.Owin.Security.Jwt 4.0
                ),
            });
        }
    }
}

使用 Microsoft.Owin.diagnostics 时的实际错误

Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationMiddleware Error: 0 : Authentication failed Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match key: kid: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. Exceptions caught: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. token: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)

Answer 1

尝试将“ token ”重命名为“ key ”，也许会好起来。

所以，而不是

    IssuerSecurityTokenProviders = new IIssuedSecurityTokenProvider[]
                                   {
                                       new symmetricKeyIssuerSecurityTokenProvider(issuer, audienceSecret)
                                   }

你应该有类似的东西

    IssuerSecurityKeyProviders= new IIssuerSecurityKeyProvider[]
                                   {
                                       new SymmetricKeyIssuerSecurityKeyProvider(issuer, audienceSecret)
                                   }

了解更多信息:Issue Thread或Actual Github Repo

希望这对您有帮助...