azure - 使用 Azure AD 租户 ID - 以及为 'app registration' 颁发的有效 token 。签名验证失败

Question

我正在编写一些 java 代码并遇到了问题。我们希望在 Java 应用程序中验证 Azure AD 颁发的 JWT token 。

除了签名验证之外，这个示例大部分工作正常。一定有什么东西丢失了，但我看不出那可能是什么。

--

获取测试 token

import adal
import requests
import pprint

# Bas snowflake test
tenant_id = "tenant-id-12312-123-123-123"
client_id = "valid-client-id-123-123-123"

resource = "https://graph.microsoft.com"  # the resource you want to access

# Create an instance of ADAL authentication context
authority_url = "https://login.microsoftonline.com/" + tenant_id
context = adal.AuthenticationContext(authority_url)

# Obtain an authorization code with the user's credentials
authorization_code = context.acquire_user_code(resource, client_id)

# Print the message and ask the user to perform 2FA verification
print(authorization_code['message'])

# Ok
token = context.acquire_token_with_device_code(resource, authorization_code, client_id)

pprint.pprint(token)

pom.xml

    <dependency>
        <groupId>com.microsoft.azure</groupId>
        <artifactId>azure-storage</artifactId>
        <version>8.6.6</version>
    </dependency>
    <dependency>
        <groupId>com.auth0</groupId>
        <artifactId>java-jwt</artifactId>
        <version>4.3.0</version>
    </dependency>
    <dependency>
        <groupId>com.auth0</groupId>
        <artifactId>jwks-rsa</artifactId>
        <version>0.22.0</version>
    </dependency>

实现

    boolean validated = false;
    try {
        log.info(String.format("tokenBody.token: %s", tokenBody.token));
        DecodedJWT jwt = JWT.decode(tokenBody.token);
        log.info(String.format("jwt.getKeyId(): %s", jwt.getKeyId()));
        JwkProvider provider = new UrlJwkProvider(new URL("https://login.microsoftonline.com/tenant-id-12312-123-123-123/discovery/v2.0/keys"));
        Jwk jwk = provider.get(jwt.getKeyId());
        log.info(String.format("jwk.getPublicKey(): %s", jwk.getPublicKey()));
        Algorithm algorithm = Algorithm.RSA256((RSAPublicKey) jwk.getPublicKey(), null);

        List<Algorithm> algorithms = List.of(
                Algorithm.RSA256((RSAPublicKey) jwk.getPublicKey(), null),
                Algorithm.RSA512((RSAPublicKey) jwk.getPublicKey(), null),
                Algorithm.RSA384((RSAPublicKey) jwk.getPublicKey(), null),
                Algorithm.RSA256((RSAPublicKey) jwk.getPublicKey()),
                Algorithm.RSA512((RSAPublicKey) jwk.getPublicKey()),
                Algorithm.RSA384((RSAPublicKey) jwk.getPublicKey())
        );

        algorithms.forEach(a -> {
            try {
                log.info("Verifying JWT ...");
                a.verify(jwt);
                log.info("JWT verified!");
            } catch (Exception ignored) {
                log.info("JWT verification failed");
            } finally {
                log.info("----");
            }
        });


        log.info(String.format("jwt.getSignature(): %s", jwt.getSignature()));
        algorithm.verify(jwt);
        validated = true;
    } catch (MalformedURLException e) {
        log.error("malformed url exception", e);
    } catch (JwkException e) {
        log.error("jwk exception", e);
    } catch (SignatureVerificationException e) {
        log.error("signature verification", e);
    } catch (Exception e) {
        log.error("other error", e);
    }

但继续观察

signature verification
com.auth0.jwt.exceptions.SignatureVerificationException: The Token's Signature resulted invalid when verified using the Algorithm: SHA256withRSA

Answer 1

Note that: The access token generated for Microsoft Graph API cannot be validated as the token is not meant for the application.

我创建了一个 Azure AD 应用程序并使用以下端点生成了身份验证代码:

https://login.microsoftonline.com/TenantID/oauth2/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=https://graph.microsoft.com/.default
&state=12345

现在，我使用以下参数生成了访问 token :

https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

client_id:ClientID
grant_type:authorization_code
scope:https://graph.microsoft.com/.default
code:code
redirect_uri:https://jwt.ms
client_secret:ClientSecret

当我解码访问 token 时，我得到了如下相同的错误:

aud 是 https://graph.microsoft.com 并使用 RSA256 算法

要解决该错误，请尝试以下操作:

在 Azure AD 应用程序中公开 API 并添加范围:

通过在 API 权限中添加范围来授予管理员同意:

Note that: Make use of the scope api://ClientID/access_as_user to resolve the issue.

我使用以下端点生成了身份验证代码:

https://login.microsoftonline.com/TenantID/oauth2/authorize?
&client_id=ClientID
&response_type=code
&redirect_uri=https://jwt.ms
&response_mode=query
&scope=api://ClientID/access_as_user
&state=12345

我通过使用范围作为 api://ClientID/access_as_user 生成了访问 token ，如下所示:

当我解码上述访问 token 时，签名已成功验证，如下所示:

引用文献:

spring security - Verify Signature with Azure AD - Stack Overflow通过 junnas

java - Validation of Azure AD token signature is invalid - Stack Overflow作者:卡尔·赵