如何使用.net Core验证KeyCloak提供的JWT ?

Question

我有一个ASP。我想验证我的访问令牌，但还没有成功。

为了更好地处理错误，我编写了一个中间件:

var token = context.Request.Headers["Authorization"].FirstOrDefault()?.Split(" ").Last();
var tokenHandler = new JwtSecurityTokenHandler();
var key = Encoding.ASCII.GetBytes(_configuration["Jwt:Kid"]); // Kid is copied from 'openid-connect/certs'
tokenHandler.ValidateToken(token, new TokenValidationParameters
{
ValidIssuer = _configuration["Jwt:Issuer"],
IssuerSigningKey = new SymmetricSecurityKey(key),
ValidateAudience = false,
ValidateIssuer = true,
ValidateIssuerSigningKey = true,
ValidateLifetime = false
}, out SecurityToken validatedToken);

和我的KeyCloak的钥匙在*/auth/realms/test/protocol/openid-connect/certs:

{
"keys": [
{
"kid": "O9cbi7dzidpxZGLV2eXlTvIECoKDB_YbUN2m73rp8",
"kty": "RSA",
"alg": "RS256",
"use": "sig",
"n": "qMaFN3tmQ0TaGWaWcanebanGDgh_bz7RzlTbbkiGtY707x...hF40ofv1Fxoy7hBUEKARUqCgjltj5_0TtWn850Eqak41lpa-P_PNsGdwBf18mqBCT8pFbzs8DeRZaD1Q",
"e": "AQAB",
"x5c": [
"MIIClzCCAX8CBgF3jSSr9TANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDAR0ZXN0MB4XDTIxMDIxMDE4MTAyNloXDTMxMDIxMDE4MTIwNlowDzENMAsGA1UEAwwEdGVzdDCCASIwDQYJKoZI...8tUe5h/7rg1+bHAGVbWg=="
],
"x5t": "G5NYmhm8yEwqHtyLwygxGw89A",
"x5t#S256": "nEnZWkJQyCG4czEJx04Nyszyzc3l8bsxZ3es2wDTw"
}
]
}

当我发出请求时，我总是得到以下异常:

{"IDX10501:签名验证失败。无法匹配key: nkid: 'System.String'。异常捕获:n 'System.Text.StringBuilder'。 ntoken:‘System.IdentityModel.Tokens.Jwt.JwtSecurityToken’!"}

你知道我做错了什么吗?

Answer 1

RSA不是对称算法。因此，不要使用SymmetricSecurityKey作为签名密钥，而是使用JsonWebKey来自动生成正确的密钥:

tokenHandler.ValidateToken(token, new TokenValidationParameters
{
ValidIssuer = _configuration["Jwt:Issuer"],
IssuerSigningKey = new JsonWebKey(jsonKeyString),
ValidateAudience = false,
ValidateIssuer = true,
ValidateIssuerSigningKey = true,
ValidateLifetime = false
}, out SecurityToken validatedToken);

其中jsonKeySting是一个字符串变量，它在提到的json中保存您的关键段

{
"kid": "O9cbi7dzidpxZGLV2eXlTvIECoKDB_YbUN2m73rp8",
"kty": "RSA",
"alg": "RS256",
"use": "sig",
"n": "qMaFN3tmQ0TaGWaWcanebanGDgh_bz7RzlTbbkiGtY707x...hF40ofv1Fxoy7hBUEKARUqCgjltj5_0TtWn850Eqak41lpa-P_PNsGdwBf18mqBCT8pFbzs8DeRZaD1Q",
"e": "AQAB",
"x5c": [
"MIIClzCCAX8CBgF3jSSr9TANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDAR0ZXN0MB4XDTIxMDIxMDE4MTAyNloXDTMxMDIxMDE4MTIwNlowDzENMAsGA1UEAwwEdGVzdDCCASIwDQYJKoZI...8tUe5h/7rg1+bHAGVbWg=="
],
"x5t": "G5NYmhm8yEwqHtyLwygxGw89A",
"x5t#S256": "nEnZWkJQyCG4czEJx04Nyszyzc3l8bsxZ3es2wDTw"
}