java - key 长度为 4096 的 JJWT 错误

Question

我有以下测试 key ，我正在使用 JJWT 对其执行 JWT 验证:

-----BEGIN RSA PRIVATE KEY-----
MIIJKAIBAAKCAgEAyzAnJJCV/ihJGhutqA1147elFKtDQ4pNpQjhIwNPc1YkHYqa
nThHbyejv5Nsfn4yC9wpuEnpnsmD1yrfsFuVnl8MymOKmL7FoLkT9vALDpPhnMtH
d9b4ffI6kZTrVpQBmd5yNud6buVPTjH+N3o7Y9yZhAMChc9X+6SyllnE55gBXR57
r1e0b+s0BKqswE/iUuvSNHUN+JyuJnF+TrUIE6pqQJpkyXQOgjGgKuE+/HZzY7XT
54PnUbZRH+CIReS2nJ9TholG4UtRnxCl2hPge21KcjFG0bYPFJfpS/+Js+XS1p2g
7ttPTLlPMdg5GZYa9cUbJvIu1CatudWvb7Kuc/FeNI5QKIe2nOKiTh+4CL9ENWsN
9e6IVXNPFwGGOOgklnL8tCy00lZTMoTkpD20eK830ZXRMHQ6E4D/fgbttL4CJYY3
BNwNRcuQEZGOuUS85kiDGVyqdrqK2oVUlfQ6ezU6qWRyrPuZJK2Kpmaq572VFJtZ
0yZYkQ/7mtLzcHhavKvnqeYV5nhqkmRHG+/qoqMLdrzhL04HGaWmPRe2kSrZnCAX
XD+qED7noDcbGdv521ioxrnBbv6LweGSoHoHogEU+ReQrst2nJijfxgGS5tHLct5
dRkztxcLXdt5WM0xydobqhp/sf1mLaXqRhwqhWevTP4OD4NFAqDi2IDFHZ0CAwEA
AQKCAgBaNT6rlSWCeRA7bx5iBdfZCadYzdBHJBfktVR+3vFfG1ddZjPOqTXNu6OP
YjxAzHYbndtH3kjCHmVSGc7F1WNPtJNRJ3BY8Bl9ia27bEb8ads4aWeJZP9dqzUl
fSAeiAdN8Nx0U8Cfi17yMG/U4YeMhlwBp/Ruw+cj6bL/3Ur2Jx4z4Vy4NA//wESP
7dZUayLn/ZqNf4p8XdNTbf/NocG8OWSC2gj1B3mJg87AOtBj9ZK1KfyyRHVmabMK
m/zkSu5oCrRifn/hdjb+j72SXFDFe3gZypbOdC2tzuPcwc6498frUIAqi2NhhMQM
NRrkqSe/BYtQdyUjOyjV4HDK/mFEfcd/O4yVBaSmrsWOf3dtUbVrEkmP7dVbyoYI
9iostAi9WN7FW4h0AivKkf22E3hd0+5zCMoZRV+vxrdLWqn1bPb75WZZdM/1tJSL
47XO7teyXdbXw10ad/D1Dqn4prWSp1v0Lt59ZouBzRfWTF0ZUUQOrbDjSTPSqptx
j23Wj0pMnTr1jSCEmzitYeE6NK+8FiitCfrVw+EQGg8EkqAnnxmj7QrU4an7Sbn2
Ko4zXezBzQV3VzlhOqCNt6Gvn37mIj8C2ElOSoPUWHnt94or1iRzH2+9R60rlNz5
AtooWxfTf6rUQye1POwgXgWq7GvD3eGpHUyFZ2fPRgRRzN3TYQKCAQEA6hyJCR1Y
gr6pul0ooBNoyoHiaf7zWLbQH53sFUDAuRpfeTgf7Yc2SYrL5BxKpKALr+J6fyr+
1ENN9vN7JXPshoRUc+FPdBJxYWFTNK1cTb8XIYjzr79NZNdwhLlL0ZC9HTobZwA8
Pr/qNHLFUCYZdSNtlba0yW38KjJbNxVZPN3lsEHEfLxnECPNLQ+r4sux1fTSpoQ4
Pw1RaxqY6BXYfYz+opfO98y5txqo/NoCQWxNyQUABq6+Qvr5bsmr2V4DF4pWW7su
NO8uV0muyslF+Ah/+8S4a0bvtyNb5JhrV1oEvF7YTrc1A19YO5wmO/oJ+AOAehAJ
PvHpcghWrD3WIwKCAQEA3i93RA5qyEeXM2yociWadLMmGXFAdhjzNABkvqHvA5AU
eLYGQSsUY8ikBo+L6i4bGUTO5R8aDLRZyi2javdsXsyksFXcBWyx4oaVUxTdGZBY
gBPKFOilhk7/TEgq8pqY4rsfCMGEwP5R1iGiH9m2t635pEt6M1M2zZbide8SZqC0
ASRbu4JOqoj/94cmp77ayc8HT4Tgi7aG4adQ1SNXVlwA46RG/ofYAtzNzMNT48FK
U0Dp2iG/1K2jkEhdJJUEnMYRh7XpJoYIb9JmxxQG1N2aa6jw14CieT2wLOiSVRxp
DbQymMmcZjNXrxdaxZgpI3aGNRvGUgEbvHEjbgwZPwKCAQEAuXCw+49LNQVh3EU+
kM3PC9mmRt+0Umk8ok6tWohYIEdLqPFUGQopbkeLCb1/QrejikaTUXf1Mp29fAeR
XDFfAY6AdunZzc9uD/zPs8I+gzcCU4XvwR5/Z4lfj0JXVECaDDSi0AvXrLzH/5OJ
x9rl/2t4ukZnHccJH0OUDSXT8eqyrdLqmQODf71cIH1xYcyHqTqsQUoqY4dhHr2K
sQvc2FZ+vLwTLSX1VZzAjskBUGFBnCFhy+lOvC+gtKj6fsuBF3x0u2ShTTzIMEwl
MGwOCFJzTjKdAhzGdQKFH6W8IQ0lAzD9lhx42ZsEgPNHNerxSos7kXRyXnGwwKrq
PLUekQKCAQAcAbWx8XNKXaPUipzNDqpijXZ+/ISYnlqBso8AbJ8ZPt8lvCQbsNd4
IIF0hkGnujoWPFMsFHiPI2iyEICp6hhR9s/HnnsGgAYIPNizyUx5fXV6Z4QwkIbU
4D5UGkC3pf8hjV7DFsmqHiSorkKmayYaDycJq63yrEmbLqrLHOCf6R/niPK7Nxi9
bFl/lRytRmSDzcHpJyG62r4z0Yhh5XuL2jsOdtWwHeV/rt+OMQzxB5tb1THlGh35
LA4TENwU0WfsbxckmSyTe4+ysL3d2EtoJ6rgaUI6l+9jAwCjGInhipw/avh5w+gg
BdbGrlX11FFTNAyEw0SDb7pUTZqes423AoIBABvffrM+TIKc3cIjQGlVw+RmYKBm
O+SyU80/eh2tEyZLZOg50R6CaIgWCKmEWODdlYiix/YdD0WgR5MBM3V8nb+BmV7m
FCZIqyH7flYCd9/FVLTpl6tCZ0YUHefSL+V09FvX9eLmnoXmwjNwR1kaZj3Ks6va
EqSxhtTxVs1aiffJ7vBvBUbXdNvnUcwoXwouJtFptSAApmnvfKMfnPN7e9zwSK6N
CLlFm24orAq0rH5x8xml/OzdMjiat3y0ZZRA2Bpuo1yfn015hkI2wrB+TQewU976
Tb2h49XJOwIv6npX6VhX6rVi4oHk+5DvNCYnYfGz3cyeV2mIVb9IVjAyJjw=
-----END RSA PRIVATE KEY-----
-----BEGIN PUBLIC KEY-----
MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAyzAnJJCV/ihJGhutqA11
47elFKtDQ4pNpQjhIwNPc1YkHYqanThHbyejv5Nsfn4yC9wpuEnpnsmD1yrfsFuV
nl8MymOKmL7FoLkT9vALDpPhnMtHd9b4ffI6kZTrVpQBmd5yNud6buVPTjH+N3o7
Y9yZhAMChc9X+6SyllnE55gBXR57r1e0b+s0BKqswE/iUuvSNHUN+JyuJnF+TrUI
E6pqQJpkyXQOgjGgKuE+/HZzY7XT54PnUbZRH+CIReS2nJ9TholG4UtRnxCl2hPg
e21KcjFG0bYPFJfpS/+Js+XS1p2g7ttPTLlPMdg5GZYa9cUbJvIu1CatudWvb7Ku
c/FeNI5QKIe2nOKiTh+4CL9ENWsN9e6IVXNPFwGGOOgklnL8tCy00lZTMoTkpD20
eK830ZXRMHQ6E4D/fgbttL4CJYY3BNwNRcuQEZGOuUS85kiDGVyqdrqK2oVUlfQ6
ezU6qWRyrPuZJK2Kpmaq572VFJtZ0yZYkQ/7mtLzcHhavKvnqeYV5nhqkmRHG+/q
oqMLdrzhL04HGaWmPRe2kSrZnCAXXD+qED7noDcbGdv521ioxrnBbv6LweGSoHoH
ogEU+ReQrst2nJijfxgGS5tHLct5dRkztxcLXdt5WM0xydobqhp/sf1mLaXqRhwq
hWevTP4OD4NFAqDi2IDFHZ0CAwEAAQ==
-----END PUBLIC KEY-----

这是我对 JWT 的请求:

curl -k -H "Authorization: Bearer eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9.eyJuYW1lIjoiYWRtaW4iLCJpYXQiOjE1MTYyMzkwMjIsImV4cCI6MTY1NjcyMzg3Mywic3ViIjoiYWRtaW4iLCJyb2xlcyI6ImFkbWluIn0.E0p_41R2qzm7UNioF8vW3Lt_OwGoCwo187c6Lt-LNSG8cnKNZTrEEkUCTV2iO-1BpWrekUY7v5WiTm0hV55YZqg62cHl5T_KVrQvTjO1ozLAfMiZnVeTCEI7EgR1xc_nKqmknhU6ogtVOrnGWBixU2lyPEGePa31niU98lyX4cWKtr2Ti4xNWrbeSwSXjqspEwG7-tmArUorgS5rJ20KtxAOj8FAXZhVPL1aC-VUTo9caXSgEl6-ktFKoDfm-lX7Snnsx5sPdX90zIugmllVPq_mUD75m5HiOhMlG4OkFVTc8aQ2WhrJqTOV4MFPYCSyz50RcTelqwG-MMKDrXzguUApyM4yVOynKhghdaEGDJBh6FIi8AOS8mHWxXwzd6VnZeLNmAFDw5Jm-IdI2T_tVeDc24BFJCG6zODiY3DAmOwLKpKSYeEU29sgeLA7M5-Q1BU4jF4LhelaE0E5kwtOO8MRWFAIsyoFCCuFqoP6W50achMQQi95h-KWtlHNKmrJs6Z2tCk7GwkyTgFPc76wAAioIhJnfXGNE_RQq0RRmtR6Kuzd-DPr4exrX6tmuUb2B3fGYkEeFXOWmXa1bg-DDLTWpVlkH3_Zsw3XS7wNwIMNzZQsDpXv5fzFtD3sajANPUjs0zsqE4asLBjMbSM4ohOrth6IV2JkBhrpuNYIHdU" https://localhost:9200

使用 jwt.io 检查时， key 和 JWT token 均有效，但 JWT 在运行时会引发此错误。

java.lang.IllegalArgumentException: Key bytes can only be specified for HMAC signatures. Please specify a PublicKey or PrivateKey instance.
    at io.jsonwebtoken.lang.Assert.isTrue(Assert.java:38) ~[jjwt-0.8.0.jar:0.8.0]
    at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:324) ~[jjwt-0.8.0.jar:0.8.0]
    at io.jsonwebtoken.impl.DefaultJwtParser.parse(DefaultJwtParser.java:481) ~[jjwt-0.8.0.jar:0.8.0]
    at io.jsonwebtoken.impl.DefaultJwtParser.parseClaimsJws(DefaultJwtParser.java:541) ~[jjwt-0.8.0.jar:0.8.0]

在我的代码中，我有这个函数来获取公钥:

private static PublicKey getPublicKey(final byte[] keyBytes, final String algo) throws NoSuchAlgorithmException, InvalidKeySpecException {
        X509EncodedKeySpec spec = new X509EncodedKeySpec(keyBytes);
        KeyFactory kf = KeyFactory.getInstance(algo);
        return kf.generatePublic(spec);
    }

完整的代码可以在这里查看:https://github.com/floragunncom/search-guard-authbackend-jwt/blob/master/src/main/java/com/floragunn/dlic/auth/http/jwt/HTTPJwtAuthenticator.java

Answer 1

您没有在问题中提供源代码，这是解决您的问题所必需的。但我可以推断你可能在某个地方使用

jwtParser.setSigningKey(byte[] key)

当您需要提供 RSA 公钥时，它是为 HMAC key 保留的。使用:

jwtParser.setSigningKey(Key key);

其中 key 是 PublicKey。