Question

在.NET Core中，我知道我可以在Startup.cs中执行类似的操作（但在标准.NET框架中没有Startup.cs）：

services.AddAuthentication(options => {
            options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddJwtBearer(jwtOptions => {
            jwtOptions.Authority = "my_authority_url";

            jwtOptions.TokenValidationParameters.ValidateIssuer = true;
            jwtOptions.TokenValidationParameters.ValidIssuers = issuers;
            jwtOptions.TokenValidationParameters.ValidAudiences = audiences;

            jwtOptions.Audience = Configuration["AzureAdB2C:Audience"];
            jwtOptions.Events = new JwtBearerEvents
            {
                OnAuthenticationFailed = AuthenticationFailed
            };
        });

但是在标准.NET Framework中还有其他选择吗？我有一个使用4.5.2的旧项目，我想在内部实现类似的功能。

Answer 1

您可以在启动时配置OAuthBearerAuthentication。例如

using Microsoft.Owin;
using Owin;
using System.IdentityModel.Tokens;
using Microsoft.Owin.Security.OAuth;
using Microsoft.Owin.Security.Jwt;

app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
{
    AccessTokenFormat = new JwtFormat(new TokenValidationParameters
    {
        ValidateIssuerSigningKey = false,
        ValidAudience = Configuration["AzureAdB2C:Audience"],
        ValidateAudience = true,
        ValidIssuer = "my_authority_url",
        ValidateIssuer = true,
        ValidateLifetime = true,
        ClockSkew = System.TimeSpan.FromMinutes(5),
    })
});

在.NET Framework中是否在没有秘密/公钥的情况下验证/验证JWT令牌？

1 个答案: