Azure AD-B2C 错误：IDX10501：签名验证失败。无法匹配键：孩子："[PII 已隐藏]"，令牌："[PII 已隐藏]"

Question

我正在使用 Swagger 进行 API 调用，为了进行身份验证，我可以生成持有者令牌，但之后我得到 401 作为响应。检查日志后，以下是错误：

Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match keys: 
kid: '[PII is hidden]', 
token: '[PII is hidden]'

我的配置身份验证方法如下：

private static void ConfigureAuth(IAppBuilder app)
{
var metadataEndpoint = string.Format(
configProvider.GetConfigValue<string>("ida:AadInstance", "AuthConfig"),
configProvider.GetConfigValue<string>("ida:Tenant", "AuthConfig"),
configProvider.GetConfigValue<string>("ida:SignInPolicy", "AuthConfig"));
string[] validAudiences = configProvider.GetConfigValue<string>("ida:Audiences", "AuthConfig").Split(',');
TokenValidationParameters tvps = new TokenValidationParameters
{
ValidAudiences = validAudiences,
AuthenticationType = configProvider.GetConfigValue<string>("ida:SignInPolicy", "AuthConfig"),
ValidateAudience = true,
ValidateIssuer = configProvider.GetConfigValue<bool>("validateIssuer", "AuthConfig"),
ValidateLifetime = true,
ValidAudience = configProvider.GetConfigValue<string>("Swagger:ClientId", "AuthConfig"),
//NameClaimType = "http://schemas.microsoft.com/identity/claims/objectidentifier",
};
//SecurityToken securityToken;
//JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
app.UseOAuthBearerAuthentication(
new OAuthBearerAuthenticationOptions
{
AccessTokenFormat = new JwtFormat(tvps, new OpenIdConnectCachingSecurityTokenProvider(metadataEndpoint)),
Provider = new OAuthBearerAuthenticationProvider()
{
OnRequestToken = (context) =>
{
if (!string.IsNullOrEmpty(context.Token))
{
}
return Task.FromResult<int>(0);
},
OnValidateIdentity = (context) =>
{
////TO DO
//// Steps to perform after identity validation
return Task.FromResult<int>(0);
}
}
});
}

Answer 1

我必须将我的 OpenIdConnectAuthenticationOptions.MetadataAddress 更新为 https://login.microsoftonline.com/tfp/{tenantId}/{policyId}/v2.0/.well-known/openid-configuration.

Answer 2

我能够通过传递正确的元数据端点来验证令牌。 *

https://login.microsoftonline.com/tfp/{0}/{1}/v2.0/.well-known/openid-configuration

*

Answer 3

事实证明，这与颁发者使用 RSA 以外的算法对令牌进行签名时将报告的消息相同。 显然，ECDSA将很快推出： https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/487