我正在尝试让我的 .Net Web API(使用 OWIN 的 Azure API 应用程序)接受用于 client_credentials 授予的 OAuth Bearer token ,但我不断收到 401 Unauthorized。
似乎所有 Microsoft 示例都已过时(不符合 Owin 的最新 nuget 包)。
JwtFormat 需要一个 IIssuerSecurityTokenProvider,但它不再存在 - 相反,JwtFormat 需要一个 IIssuerSecurityKeyProvider,但我无法理解如何使用它。
Azure OAuth 服务器正在运行
我已在 Azure Active Directory 中注册了两个应用程序(API 和客户端)。 由于这只是快速演示,我将向您提供所有 id 和 secret ;)
我可以从 Azure AD 获取 token ,请参阅 https://reqbin.com/817shtc2对于完整的请求,到目前为止一切顺利。
API
ClientId: 44cf7574-88a2-42d6-9497-bff43cc8dc09
Endpoint: https://apim-demo-mglentoft.azure-api.net/api/Values (GET)
客户端
ClientId: 5f7ee334-b8db-46d3-972f-09f52e186d1d
Secret: ggKp94]HZHWZ.c*5wUC?ToSVfknyqLB3
我按照 https://github.com/azureadquickstarts/appmodelv2-nativeclient-dotnet 上的示例进行操作,但它引用了 nuget v4.0.1.0 中不存在的 Microsoft.Owin.Security.Jwt.IIssuerSecurityTokenProvider。
我尝试仅注释掉 JwtFormat 的第二个参数,但这不起作用。有什么想法如何使用 Microsoft.Owin.Security.Jwt.IIssuerSecurityKeyProvider 来实现此功能吗?
下面是整个startup.cs
我可以使用 .Net Core 来实现此功能,但由于各种原因我必须坚持使用 .Net Framework 4.7.2
using System;
using System.Configuration;
using System.Threading.Tasks;
using System.Web.Http;
using DemoAPI.Middleware;
using Microsoft.IdentityModel.Tokens;
using Microsoft.Owin;
using Microsoft.Owin.Cors;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Jwt;
using Microsoft.Owin.Security.OAuth;
using Owin;
[assembly: OwinStartup(typeof(DemoAPI.App_Start.Startup))]
namespace DemoAPI.App_Start
{
public partial class Startup
{
public void Configuration(IAppBuilder app)
{
var config = new HttpConfiguration();
ConfigureAuth(app);
app.Use(typeof(CorrelationHandlerMiddleware));
app.UseCors(CorsOptions.AllowAll);
WebApiConfig.Register(config);
app.UseWebApi(config);
}
private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
public void ConfigureAuth(IAppBuilder app)
{
// NOTE: The usual WindowsAzureActiveDirectoryBearerAuthentication middleware uses a
// metadata endpoint which is not supported by the v2.0 endpoint. Instead, this
// OpenIdConnectSecurityTokenProvider implementation can be used to fetch & use the OpenIdConnect
// metadata document - which for the v2 endpoint is https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration
app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
{
AccessTokenFormat = new JwtFormat(
new TokenValidationParameters
{
// Check if the audience is intended to be this application
ValidAudiences = new[] { clientId, $"api://{clientId}" },`enter code here`
// Change below to 'true' if you want this Web API to accept tokens issued to one Azure AD tenant only (single-tenant)
// Note that this is a simplification for the quickstart here. You should validate the issuer. For details,
// see https://github.com/Azure-Samples/active-directory-dotnet-native-aspnetcore
ValidateIssuer = false,
}//,
//new OpenIdConnectSecurityKeyProvider("https://login.microsoftonline.com/common/v2.0/.well-known/openid-configuration")
//the OpenIdConnectSecurityKeyProvider implements IIssuerSecurityTokenProvider, which is not part of Microsoft.Owin.Security.Jwt 4.0
),
});
}
}
}
使用 Microsoft.Owin.diagnostics 时的实际错误
Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationMiddleware Error: 0 : Authentication failed Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match key: kid: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. Exceptions caught: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. token: '[PII is hidden. For more details, see https://aka.ms/IdentityModel/PII.]'. at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateToken(String token, TokenValidationParameters validationParameters, SecurityToken& validatedToken)
最佳答案
尝试将“ token ”重命名为“ key ”,也许会好起来。
所以,而不是
IssuerSecurityTokenProviders = new IIssuedSecurityTokenProvider[]
{
new symmetricKeyIssuerSecurityTokenProvider(issuer, audienceSecret)
}
你应该有类似的东西
IssuerSecurityKeyProviders= new IIssuerSecurityKeyProvider[]
{
new SymmetricKeyIssuerSecurityKeyProvider(issuer, audienceSecret)
}
了解更多信息:Issue Thread或Actual Github Repo
希望这对您有帮助...
关于azure - 验证 Oauth Bearer token ,Microsoft.Owin.Security.Jwt 4.x 中缺少 IIssuerSecurityTokenProvider,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/56884965/