Spring 安全性 OAuth 2 资源服务器:转换 jwk 以进行 jwt 验证，不支持 use==enc

Question

我正在尝试实现一个履行资源服务器的OAuth角色的服务(API(。我们有一个实现隐式流的 Angular 客户端应用程序。我们使用GLUU作为我们的OpenID提供商。客户端应用程序能够成功地从授权服务器获取id_token(JWT(。但是，当它调用 API(将该令牌作为授权标头中的持有者令牌传递(时，资源服务器尝试验证它失败。我收到一条JwkException消息：enc (use) is currently not supported.

我正在使用我的 GLUU 服务器提供的端点(https://[my-gluu-server-host]/oxauth/restv1/jwks(在我的application.yml中配置security.oauth2.resource.jwk.key-set-uri

资源服务器中的故障发生在此方法中：org.springframework.security.oauth2.provider.token.store.jwk.JwkSetConverter.createRsaJwkDefinition(Map<String, String>)

具体来说，它发生在以下块中，它从/oxauth/restv1/jwks端点解析文档：

// use
JwkDefinition.PublicKeyUse publicKeyUse = JwkDefinition.PublicKeyUse.fromValue(attributes.get(PUBLIC_KEY_USE));
if (!JwkDefinition.PublicKeyUse.SIG.equals(publicKeyUse)) {
throw new JwkException((publicKeyUse != null ? publicKeyUse.value() : "unknown") + " (" + PUBLIC_KEY_USE + ") is currently not supported.");
}

来自 GLUU 服务器的 jwks 文档包括以下内容：

{
"kid": "2f2963f5-2e69-448d-8d4b-a0c573a0ae12",
"kty": "RSA",
"use": "sig",
"alg": "RS256",
"exp": 1561073429125,
"n": "1i27yldjaqy1E43560by_mWC9weI9jilYGIHIYc_1nSM0QdVMg3OU-NVBfAcDZhw0ghJ4uZIyjnVVUBp-QqZfvQ9nMVPcYDb3Fycbag3jQ2zYJfU_lAVOoSQquq_Tk8pa4NlJWIbiEFCpkLlNZVZdP8950aZVJX5Z5AzZq6CognrnItuyjNxyA25r244dZyDiShvQ7AC3nX8u04AKTSu-bVBMuZEtJVb7wH3KDxUzgPSj-xZ2ddA9Af9I-GNKpIj5lM7KVun3GMKoVh_NsLVODAbBsJZpG_wKcN0IuHdtoJG3pCD95JmpaSUIlYbvnHH9y19tC45v5dHXUEyv1x8bw",
"e": "AQAB",
"x5c": [
"MIIDBDCCAeygAwIBAgIhALFTvUWtPFdT9hBmo/5AlANq9RBZggZYbYW/2adHb50XMA0GCSqGSIb3DQEBCwUAMCExHzAdBgNVBAMMFm94QXV0aCBDQSBDZXJ0aWZpY2F0ZXMwHhcNMTgwNjIwMjMzMDE5WhcNMTkwNjIwMjMzMDI5WjAhMR8wHQYDVQQDDBZveEF1dGggQ0EgQ2VydGlmaWNhdGVzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA1i27yldjaqy1E43560by/mWC9weI9jilYGIHIYc/1nSM0QdVMg3OU+NVBfAcDZhw0ghJ4uZIyjnVVUBp+QqZfvQ9nMVPcYDb3Fycbag3jQ2zYJfU/lAVOoSQquq/Tk8pa4NlJWIbiEFCpkLlNZVZdP8950aZVJX5Z5AzZq6CognrnItuyjNxyA25r244dZyDiShvQ7AC3nX8u04AKTSu+bVBMuZEtJVb7wH3KDxUzgPSj+xZ2ddA9Af9I+GNKpIj5lM7KVun3GMKoVh/NsLVODAbBsJZpG/wKcN0IuHdtoJG3pCD95JmpaSUIlYbvnHH9y19tC45v5dHXUEyv1x8bwIDAQABoycwJTAjBgNVHSUEHDAaBggrBgEFBQcDAQYIKwYBBQUHAwIGBFUdJQAwDQYJKoZIhvcNAQELBQADggEBAGvDX4s66Vd6Ca7yVZrRwprICYfD2+UWHhXzWZ1cDxH0nM74tHlKn2F5j5M7lDkr9nNkMGwWRzdUpRSmqBW6b3E4Z4JeZqdlOp3GOwV+FK7R1SL0HY4XVUlBh2WJ+WjPubK9G7PUVhKqFYb7yHHPjZsvTtxxr11J0w3xnUvnBdTmPu4ByawpzhEMwWfREMhKFuTdB1eqg72he5C4cYJy48mAs/OJ25hmG58UDgTcT/qSnKsstsaTbhpnf0ky/TuoT05bjHg4yl8sOlJyPmorScj+PCHmfysrp5GKZ682jL/ffuZUSpv5pwVtzI5pG0Be0DbVmUUcMXWOie0uvGIEWI4="
]
}

和

{
"kid": "4e40e28f-3c23-4703-a4e5-256701729b9d",
"kty": "RSA",
"use": "enc",
"alg": "RS256",
"exp": 1561073429125,
"n": "rVyl3F36BIXhSNK2ed4BtuptJNc2VC-PbTBp1_EvzKdOZH6hoYAS7aOlZyzSGBJ653jH1omFwwB2m3bABrSrkJWwW2bw4z-20ZuuZTXkhjGTVJF971jXAz7WWu5x2JGNx_Y6xPeE1ikZD81JYKwSYFGJBKxW7P_H_CsmufPbXUty6LAt49BqJTOApP-pInmoJAwEwexoKwZ5lg9pid6bOFAQb_38yX4wlFJ5sIm9xi1zhvOJfLti2-T9Kfldi3hyTTLbt8p2nWZpNydWTlu4Eo6tixl5TdWY2izTNOooll5ix-Y0weV648jAz5nZ61HC0QZzP9phce7D4rVozz-1Qw",
"e": "AQAB",
"x5c": [
"MIIDBDCCAeygAwIBAgIhAI4ioYhsQvP+TfanCQ5cBFIMgWTgw1Zz6ZRdKXyaKtx8MA0GCSqGSIb3DQEBCwUAMCExHzAdBgNVBAMMFm94QXV0aCBDQSBDZXJ0aWZpY2F0ZXMwHhcNMTgwNjIwMjMzMDIwWhcNMTkwNjIwMjMzMDI5WjAhMR8wHQYDVQQDDBZveEF1dGggQ0EgQ2VydGlmaWNhdGVzMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArVyl3F36BIXhSNK2ed4BtuptJNc2VC+PbTBp1/EvzKdOZH6hoYAS7aOlZyzSGBJ653jH1omFwwB2m3bABrSrkJWwW2bw4z+20ZuuZTXkhjGTVJF971jXAz7WWu5x2JGNx/Y6xPeE1ikZD81JYKwSYFGJBKxW7P/H/CsmufPbXUty6LAt49BqJTOApP+pInmoJAwEwexoKwZ5lg9pid6bOFAQb/38yX4wlFJ5sIm9xi1zhvOJfLti2+T9Kfldi3hyTTLbt8p2nWZpNydWTlu4Eo6tixl5TdWY2izTNOooll5ix+Y0weV648jAz5nZ61HC0QZzP9phce7D4rVozz+1QwIDAQABoycwJTAjBgNVHSUEHDAaBggrBgEFBQcDAQYIKwYBBQUHAwIGBFUdJQAwDQYJKoZIhvcNAQELBQADggEBABhoycn6/mX07QTWcJ5G9neSjwur7iJxzcI2I3oXvewHQ+Hd5WI5YDh0zIBK5wAmaveUGWVTLHQayh1eOape0u+cHjaK1uoyB9j/PmRXgvVihpxG+oRHR6vWIb2BUzSNZ9zZLlDFhov3ZLeT4qtetj3Zp5WYd4mnTbmqZDHoXOu/ApXvIqCR0wnMZs90fK9ye/gImur2eLi145yyp2t1Q7HP6MqFhyX6lBXETyzJrgIxekJr0gOBrtAx4/DC8gODMsfDJI94QSso/l0EBp5Gmb1auwVT8g8B1yesOJmavcmnDADsqc3GjZTUt4DfDBl5sIulX4lcwEuYAyJV8BhgkNs="
]
}

所以我的问题是，为什么每当org.springframework.security.oauth2.provider.token.store.jwk.JwkSetConverter看到签名密钥以外的密钥时都会抛出异常？在我看来，集合中是否有加密密钥并不重要。

我可能会告诉 GLUU 不要包含这些密钥，但我似乎找不到任何支持这项工作的文档。

任何想法如何解决这个问题？

Answer 1

您可以直接在持久性中编辑 jwk。您可以删除所有enc键，但是这不是很好的遵循方式：

• 它禁用使用加密令牌的功能
• 在下一次 JWKS 重新生成期间，持久性将再次自动填充enc密钥(如果关闭服务器上的自动密钥重新生成，则可以避免这种情况(。

您可能想就 https://support.gluu.org 提问