.net - 尝试通过 Docker 容器上的 JWT token 对用户进行身份验证时缺少 'libSystem.Security.Cryptography.Native.OpenSsl' - .net core 3.1

Question

我正在使用 Angular 10 客户端和 .net core 3.1 后端。身份验证由 Azure Active Directory 解析。

我的本​​地环境中的一切都运行良好，但是当我将其发布到 kubernetes 托管的 docker 镜像中时。冒险开始了……

当我尝试从受 [Authorize] 保护的 Controller 获取信息时，我得到如下响应:

承载错误=“invalid_token”，error_description=“签名无效”，代码为401

当我获取更多详细信息时，日志会显示:

Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: IDX10511: Signature validation failed. Keys tried: 'Microsoft.IdentityModel.Tokens.X509SecurityKey, KeyId: 'HIDE', InternalId: 'HIDE'. , KeyId: HIDE '. kid: 'HIDE'. Exceptions caught: 'System.TypeInitializationException: The type initializer for 'Crypto' threw an exception. ---> System.TypeInitializationException: The type initializer for 'CryptoInitializer' threw an exception. ---> System.DllNotFoundException: Unable to load shared library 'libSystem.Security.Cryptography.Native.OpenSsl' or one of its dependencies. In order to help diagnose loading problems, consider setting the LD_DEBUG environment variable: liblibSystem.Security.Cryptography.Native.OpenSsl: cannot open shared object file: No such file or directory at Interop.CryptoInitializer.EnsureOpenSslInitialized(
 at Interop.CryptoInitializer..cctor()
   --- End of inner exception stack trace --- at Interop.CryptoInitializer.Initialize(
 at Interop.Crypto..cctor()
   --- End of inner exception stack trace --- at Interop.Crypto.DecodeRsaPublicKey(ReadOnlySpan`1 buf
 at System.Security.Cryptography.RSAOpenSsl.ImportRSAPublicKey(ReadOnlySpan`1 source, Int32& bytesRead
 at Internal.Cryptography.Pal.OpenSslX509Encoder.BuildRsaPublicKey(Byte[] encodedData
 at Internal.Cryptography.Pal.OpenSslX509Encoder.DecodePublicKey(Oid oid, Byte[] encodedKeyValue, Byte[] encodedParameters, ICertificatePal certificatePal
 at Internal.Cryptography.Pal.CertificateExtensionsCommon.GetPublicKey[T](X509Certificate2 certificate, Predicate`1 matchesConstraints
 at System.Security.Cryptography.X509Certificates.RSACertificateExtensions.GetRSAPublicKey(X509Certificate2 certificate
 at Microsoft.IdentityModel.Tokens.X509SecurityKey.get_PublicKey(
 at Microsoft.IdentityModel.Tokens.SupportedAlgorithms.IsSupportedAlgorithm(String algorithm, SecurityKey key
 at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.IsSupportedAlgorithm(String algorithm, SecurityKey key
 at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateSignatureProvider(SecurityKey key, String algorithm, Boolean willCreateSignatures, Boolean cacheProvider
 at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateForVerifying(SecurityKey key, String algorithm, Boolean cacheProvider
 at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateForVerifying(SecurityKey key, String algorithm
 at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(Byte[] encodedBytes, Byte[] signature, SecurityKey key, String algorithm, SecurityToken securityToken, TokenValidationParameters validationParameters
 at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters) '. token: 'HIDED'. at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters
 at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken
 at Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler.HandleAuthenticateAsync()    

一些代码:

docker 镜像(我也尝试过仿生):

FROM mcr.microsoft.com/dotnet/core/aspnet:3.1
WORKDIR /app
COPY . ./
EXPOSE 80
ENTRYPOINT ["dotnet", "MyApp.dll"]

启动类

          services.AddAuthentication()
                .AddMicrosoftIdentityWebApi(
                    options =>
                    {
                        options.Authority = GetKeyOrDefault("AD:Instance") + GetKeyOrDefault("AD:TenantId");
                        options.Audience = "api://" +  GetKeyOrDefault("AD:ClientId");

                        options.TokenValidationParameters.ValidateIssuer = false;
                     

                        options.TokenValidationParameters.ValidAudiences = new[]
                        {
                            options.Audience
                            
                        };
                        options.RequireHttpsMetadata = false;
                        
                        options.Events = new JwtBearerEvents();
                        
                        options.Events.OnAuthenticationFailed += context =>
                        {
                            _logger.Error(context.Exception?.ToString());
                            _logger.Error(context.Principal?.ToString());
                            _logger.Error(context.Scheme?.ToString());

                            return Task.CompletedTask;
                        };
                        
                        options.Events.OnMessageReceived += context =>
                        {
                            _logger.Error(context.Token?.ToString());

                            return Task.CompletedTask;
                        };
                        
                        options.Events.OnTokenValidated += context =>
                        {
                            _logger.Error(context.Properties?.ToString());
                            _logger.Error(context.Options?.ClaimsIssuer?.ToString());
                            _logger.Error(context.Options?.ForwardAuthenticate?.ToString());

                            return Task.CompletedTask;
                        };
                        
                        _logger.Information($"JWT | {options.Authority} | {options.Audience} | {options.ClaimsIssuer}");
                    },
                    options =>
                    {
                        options.TenantId = GetKeyOrDefault("AD:TenantId");
                        options.ClientId = GetKeyOrDefault("AD:ClientId");
                        options.Instance = GetKeyOrDefault("AD:Instance");
                        options.Authority = "api://" +  GetKeyOrDefault("AD:ClientId");
                        options.RequireHttpsMetadata = false;
                        
                        _logger.Information($"JWT | {options.Authority} | {options.TenantId} | { options.ClientId } | {options.Instance} |  | {options.ClaimsIssuer}");

                        options.Events.OnAuthenticationFailed += context =>
                        {
                            _logger.Error(context.Exception.ToString());

                            return Task.CompletedTask;
                        };
                        
                        options.Events.OnMessageReceived += context =>
                        {
                            _logger.Error(context.Token.ToString());

                            return Task.CompletedTask;
                        };
                        
                        options.Events.OnAccessDenied += context =>
                        {
                            _logger.Error(context.Properties.ToString());
                            _logger.Error(context.Options.ClaimsIssuer.ToString());
                            _logger.Error(context.Options.ForwardAuthenticate.ToString());
                            _logger.Error(context.Options.AccessDeniedPath.ToString());

                            return Task.CompletedTask;
                        };

                    })
                .EnableTokenAcquisitionToCallDownstreamApi(
                    options =>
                    {
                        options.ClientSecret = GetKeyOrDefault("AD:ClientSecret");
                        options.ClientId = GetKeyOrDefault("AD:ClientId");
                        options.Instance = GetKeyOrDefault("AD:Instance");
                        options.TenantId =  GetKeyOrDefault("AD:TenantId");
                    })
                .AddMicrosoftGraph(_configuration.GetSection("PayAdmin:DownstreamAP"))
                .AddInMemoryTokenCaches();

隐藏 - 加密文件

Answer 1

好的，我明白了:-)。

这是由 System.Security.Cryptography.OpenSsl 库版本引起的。就我而言，paket 管理器自动(用于依赖项引用)将我的库升级到 System.Security.Cryptography.OpenSsl 5.0.0 版本，因此我的 docker 镜像没有正确版本的 SDK，因此与使用 openssl 相关的所有操作都是失败。

在我的例子中，解决方案恢复为 System.Security.Cryptography.OpenSsl 4.7.0(我必须将此信息放入数据包依赖项中)