amazon-web-services - 通过AWS EC2上的Docker容器发布时，Auth0 OWIN API无法验证JWT token

Question

我在EC2上托管的OWIN Web.API 2无法授权JWT token 。我已经在本地测试了功能，没有问题，但是一旦将其发布到EC2上托管的docker容器中，它就会响应401。我使用的是默认的RS256算法和以下设置:

var domain = Environment.GetEnvironmentVariable("AUTH0_DOMAIN");
var audience = Environment.GetEnvironmentVariable("AUTH0_CLIENT_IDS");
var keyResolver = new OpenIdConnectSigningKeyResolver(domain);
appBuilder.UseJwtBearerAuthentication(
                new JwtBearerAuthenticationOptions
                {
                    AuthenticationMode = AuthenticationMode.Active,
                    AllowedAudiences = new[] { audience },
                    TokenValidationParameters = new TokenValidationParameters()
                    {
                        ValidAudience = audience,
                        ValidIssuer = domain,
                        IssuerSigningKeyResolver = (token, securityToken, identifier, parameters) => keyResolver.GetSigningKey(identifier)
                    }
                });

我的端点仅说明您是否已通过身份验证。

[Authorize]
        [Route("secure")]
        public HttpResponseMessage GetSecured()
        {
            var userId = ClaimsPrincipal.Current.Identity.GetUserId();
            return Request.CreateResponse($"Hello, {userId}! You are currently authenticated.");
        }

这是我的启动配置:

public void Configuration(IAppBuilder appBuilder)
        {
            appBuilder.UseCors(CorsOptions.AllowAll); //must be first
            Auth0Config.Register(appBuilder);
            var httpConfiguration = new HttpConfiguration();
            httpConfiguration.MapHttpAttributeRoutes();
            UnityConfig.Register(httpConfiguration);
            appBuilder.UseWebApi(httpConfiguration);
        }

Answer 1

我不再使用OWIN管道，而是从上一个项目开始，这里是我配置它的方式。看来您正在使用OpenID，但我没有。不确定是否有帮助。

var issuer = AppSettings.Auth0Domain;
            var audience = AppSettings.Auth0ClientID;
            var secret = TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings["Auth0ClientSecret"]);

            app.UseJwtBearerAuthentication(
                new JwtBearerAuthenticationOptions
                {
                    AuthenticationMode = AuthenticationMode.Active,
                    AllowedAudiences = new[] {audience},
                    IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
                    {
                        new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret)
                    },
                    Provider = new Auth0AuthenticationProvider()
                });

编辑添加了Auth0AuthenticationProvider

public class Auth0AuthenticationProvider : IOAuthBearerAuthenticationProvider
{
    private string token;

    public Task ApplyChallenge(OAuthChallengeContext context)
    {
        return Task.FromResult<object>(null);
    }

    public Task RequestToken(OAuthRequestTokenContext context)
    {
        token = context.Token;
        return Task.FromResult<object>(null);
    }

    public Task ValidateIdentity(OAuthValidateIdentityContext context)
    {
        if (string.IsNullOrEmpty(token))
            return Task.FromResult<object>(null);

        var notPadded = token.Split('.')[1];
        var padded = notPadded.PadRight(notPadded.Length + (4 - notPadded.Length % 4) % 4, '=');
        var urlUnescaped = padded.Replace('-', '+').Replace('_', '/');
        var claimsPart = Convert.FromBase64String(urlUnescaped);

        var obj = JObject.Parse(Encoding.UTF8.GetString(claimsPart, 0, claimsPart.Length));

        // simple, not handling specific types, arrays, etc.
        foreach (var prop in obj.Properties().AsJEnumerable())
        {
            switch (prop.Name)
            {
                case "app_metadata":
                    SetAppMetadataClaims(context, prop.Value.ToString());
                    break;
            }
        }

        return Task.FromResult<object>(null);
    }

    private static void SetAppMetadataClaims(OAuthValidateIdentityContext context, string jsonString)
    {
        var appMetadata = JsonConvert.DeserializeObject<Auth0AppMetaDataModel>(jsonString);

        if(!context.Ticket.Identity.HasClaim("AccountId", appMetadata.accountId.ToString()))
            context.Ticket.Identity.AddClaim(new Claim("AccountId", appMetadata.accountId.ToString()));
        if (!context.Ticket.Identity.HasClaim("ClientId", appMetadata.clientId.ToString()))
            context.Ticket.Identity.AddClaim(new Claim("ClientId", appMetadata.clientId.ToString()));
        if (!context.Ticket.Identity.HasClaim("IsActive", appMetadata.isActive.ToString()))
            context.Ticket.Identity.AddClaim(new Claim("IsActive", appMetadata.isActive.ToString()));

        if (appMetadata.roles == null)
            return;

        foreach (var role in appMetadata.roles)
        {
            if (context.Ticket.Identity.HasClaim(ClaimTypes.Role, role))
                continue;

            context.Ticket.Identity.AddClaim(new Claim(ClaimTypes.Role, role));
        }
    }
}