oauth-2.0 - Azure AD-B2C 错误 : IDX10501: Signature validation failed. 无法匹配 key : kid: '[PII is hidden]' , token : '[PII is hidden]'

Question

我正在使用 Swagger 进行 API 调用，为了进行身份验证，我能够生成不记名 token ，但之后我收到 401 响应。检查日志后，错误如下:

Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match keys: 
kid: '[PII is hidden]', 
token: '[PII is hidden]'

我的 ConfigureAuth 方法如下:

private static void ConfigureAuth(IAppBuilder app)
{
    var metadataEndpoint = string.Format(
        configProvider.GetConfigValue<string>("ida:AadInstance", "AuthConfig"),
        configProvider.GetConfigValue<string>("ida:Tenant", "AuthConfig"),
        configProvider.GetConfigValue<string>("ida:SignInPolicy", "AuthConfig"));

    string[] validAudiences = configProvider.GetConfigValue<string>("ida:Audiences", "AuthConfig").Split(',');
    TokenValidationParameters tvps = new TokenValidationParameters
    {
        ValidAudiences = validAudiences,
        AuthenticationType = configProvider.GetConfigValue<string>("ida:SignInPolicy", "AuthConfig"),
        ValidateAudience = true,
        ValidateIssuer = configProvider.GetConfigValue<bool>("validateIssuer", "AuthConfig"),
        ValidateLifetime = true,
        ValidAudience = configProvider.GetConfigValue<string>("Swagger:ClientId", "AuthConfig"),
        //NameClaimType = "http://schemas.microsoft.com/identity/claims/objectidentifier",
    };

    //SecurityToken securityToken;
    //JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
    app.UseOAuthBearerAuthentication(
        new OAuthBearerAuthenticationOptions
         {
            AccessTokenFormat = new JwtFormat(tvps, new OpenIdConnectCachingSecurityTokenProvider(metadataEndpoint)),
            Provider = new OAuthBearerAuthenticationProvider()
            {
                OnRequestToken = (context) =>
                {
                    if (!string.IsNullOrEmpty(context.Token))
                    {
                    }

                    return Task.FromResult<int>(0);
                },
                OnValidateIdentity = (context) =>
                    {
                        ////TO DO
                        //// Steps to perform after identity validation

                        return Task.FromResult<int>(0);
                    }
            }
        });
}

Answer 1

我不得不将我的 OpenIdConnectAuthenticationOptions.MetadataAddress 更新为
https://login.microsoftonline.com/tfp/ {tenantId}/{policyId}/v2.0/.well-known/openid-configuration。