使用C＃对PS256编码JWT的验证

Question

我一直被任命用于使用PS256算法编码的JWT令牌，并且在过去的两天中，我一直在遇到麻烦。我对这个主题缺乏知识，我一直在慢慢解决尝试不同的解决方案的问题。

// Encoded
eyJhbGciOiJQUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImtpZDEyMzQifQ.eyJpc3MiOiJmb28uYmFyLnRlc3Rpc3N1ZXIiLCJleHAiOjE1NTEyMDEwNjgsImF0X2hhc2giOiJqaFl3c1pyTnZ0dFNYQnR6QVMtWlNnIn0.yJePyxdJWyydG4HM97oQag6ulGKa5Afw-LHYYEXz7lVy8v0IJD0mSO9WtowlWJIeD2Vvthuj71XUfHsgz0LD9rK0VBucJbd_OiIXpbwPUqBcdj82DNLFXDJfCJnUC-Rv8QP7OUVBvLjvBQ6WYMrx1Qnq8xP6qeL_ohKwRmo6EDhZRkYBz9gFhfha1ZlKcnyR73nXdShwy7OmmyiRvVWPBf_GgSsfz8FNNoKySW1MA4tRa7cl3zPlyCnWyLaZ3kcQsmTqarHG--YXSDF5ozZ_Sx6TkunCxrOYzOFNcPyeIWqI84cemM6TgMBw9jhzMCk7Y4Fzxe5KEYJH4GlGA4s4zg
// Header
{
    "alg": "PS256",
    "typ": "JWT",
    "kid": "kid1234"
}
// Payload
{
    "iss": "foo.bar.testissuer",
    "exp": 1551201068,
    "at_hash": "jhYwsZrNvttSXBtzAS-ZSg"
}

我对RS256编码的JWT有一个工作实现，该JWT使用 JWTSecurityTokenHandler 在 Microsoft.InderityModel.tokens.tokens 和 system.Identitymodelitymodel.tokens.tokens.jwt 中提供/strong>。对于RS256实施，我有A issuerSigningKeyResolver 正在为孩子进行自定义检查并提供公共密钥

var tokenValidationParameters = new TokenValidationParameters
{
    ValidIssuer = issuer,
    ValidateLifetime = true,
    RequireSignedTokens = true,
    RequireExpirationTime = true,
    ValidateAudience = false,
    ValidateIssuer = true,
    IssuerSigningKeyResolver = (string token, SecurityToken securityToken, string kid, TokenValidationParameters validationParameters) =>
    {
        // Custom kid checks
        var rsa = RSA.Create();
        rsa.ImportParameters(new RSAParameters
        {
            Exponent = Base64UrlEncoder.DecodeBytes(matchingKid.E),
            Modulus = Base64UrlEncoder.DecodeBytes(matchingKid.N),
        });
        latestSecurityKeys.Add(matchingKid.Kid, new RsaSecurityKey(rsa));
        var securityKeys = new SecurityKey[1]
        {
            new RsaSecurityKey(rsa)
        };
        return securityKeys;
    }
};
var tokenHandler = new JwtSecurityTokenHandler();
try
{
    var principal = tokenHandler.ValidateToken(token, tokenValidationParameters, out SecurityToken validatedToken);
    return true;
}
catch (SecurityTokenException ex)
{
    // Do something with ex
    return false;
}

此实现不适用于PS256编码的JWT。我在 System.IdentityModel.tokens.tokens.jwt 中调试了 jwtsecuritytokenhandler ，但似乎即使PS256都在支持的算法中，验证列表验证列表。

我必须再次声明我对这个主题的了解是有限的。据我了解，RSA256和PS256在同一算法家族中？我会最好使用另一个库来创建PS256 JWT的自定义验证

在用Microsoft提出问题后，似乎现在 Microsoft.InderityModel.tokens不支持此类验证和 system.IndedModel.tokens.jwt 。详细信息可以在此处找到-https：//github.com/azuread/azure-activedirectory-indistitymodel-extensions-for-dotnet/issues/1117

最后，我使用 JOSE-JWT 和一些自定义检查验证了我的令牌。

private bool IsValid(string token, string issuer, string configId)
{
    var jwtSecurityTokenHandler = new JwtSecurityTokenHandler();
    var jwtSecurityToken = jwtSecurityTokenHandler.ReadToken(token) as JwtSecurityToken;
    // Extract the kid from token header
    var kidHeader = jwtSecurityToken.Header.Where(k => k.Key.ToLower() == "kid")?.FirstOrDefault();
    if (kidHeader?.Value == null) ThrowInvalidOperation($"Failed to find matching kid for Issuer: {issuer.ToLower() }");
    var kid = kidHeader?.Value as string;
    // Extract the expiration time from token payload
    var expirationTime = jwtSecurityToken.Payload?.Exp;
    if (expirationTime == null) ThrowInvalidOperation($"Failed to find matching expiration time for Issuer: {issuer.ToLower() }");
    // Decode to verify signature
    var verifiedToken = JWT.Decode(token, GetPublicKey(kid, issuer, providerId));
    if (verifiedToken != null)
    {
        var json = JsonConvert.DeserializeObject<dynamic>(verifiedToken);
        return IsValidIssuer(json, issuer) && IsValidExpirationTime(json, expirationTime);
    }
    else
    {
        return false;
    }
    void ThrowInvalidOperation(string msg) => throw new InvalidOperationException(msg);
}
private bool IsValidIssuer(dynamic json, string issuer)
{
    if (json != null && issuer != null)
    {
        if (json["iss"] == issuer)
        {
            return true;
        }
        else
        {
            return false;
        }
    }
    return false;
}
private bool IsValidExpirationTime(dynamic json, int? expTime)
{
    if (json != null && expTime != null)
    {
        if (json["exp"] == expTime)
        {
            return true;
        }
        else
        {
            return false;
        }
    }
    return false;
}
private RSA GetPublicKey(string kid, string validIssuer, string configId)
{
    var openIdConfig = openIdConfigurationProvider.GetOpenIdConfiguration(configId);
    var matchingKid = openIdConfig?.JsonWebKeySet?.Keys?.FirstOrDefault(x => x.Kid == kid);
    if (matchingKid == null)
    {
        throw new InvalidOperationException($"kid is null");
    }
    var rsa = RSA.Create();
    rsa.ImportParameters(new RSAParameters
    {
        Exponent = Base64UrlEncoder.DecodeBytes(matchingKid.E),
        Modulus = Base64UrlEncoder.DecodeBytes(matchingKid.N),
    });
    return rsa;
}