Question

使用单个asp.net（4.6.1）Web项目，显然我无法验证在同一台服务器上生成的jwt令牌。
的 Startup.cs ：

        var secret = Encoding.UTF8.GetBytes("12341234123412341234");
        var jwtFormatter = new CustomJwtFormat("Any", "local", secret);

        // This part checks the tokens
        app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ExternalBearer,
            AuthenticationMode = AuthenticationMode.Active, // Block requests
            AllowedAudiences = new []{"Any"},
            TokenValidationParameters = new TokenValidationParameters
            {
                IssuerSigningKey = new InMemorySymmetricSecurityKey(secret),
                ValidAudience = "Any",
                ValidIssuer = "local"
            }
        });

        // This part issues tokens
        app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
        {
            AllowInsecureHttp = false,
            TokenEndpointPath = new PathString("/auth"),
            AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30),
            Provider = new CustomOAuthProvider(),
            AccessTokenFormat = jwtFormatter,
            RefreshTokenFormat = jwtFormatter

        });

        app.UseWebApi(config);

生成令牌的类看起来像

public class CustomJwtFormat : ISecureDataFormat<AuthenticationTicket>
{
    private readonly string _allowedAudience;
    private readonly string _issuer;
    private readonly byte[] _jwtTokenSignKey;

    public CustomJwtFormat(string allowedAudience, string issuer, byte[] jwtTokenSignKey)
    {
        _allowedAudience = allowedAudience;
        _issuer = issuer;
        _jwtTokenSignKey = jwtTokenSignKey;
    }

    public string Protect(AuthenticationTicket data)
    {
        if (data == null) throw new ArgumentNullException(nameof(data));

        var signingCredentials = new SigningCredentials
        (
            new InMemorySymmetricSecurityKey(_jwtTokenSignKey),
            "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256",
            "http://www.w3.org/2001/04/xmlenc#sha256"
        );

        return new JwtSecurityTokenHandler().WriteToken(new JwtSecurityToken(
            _issuer, 
            _allowedAudience, 
            data.Identity.Claims, 
            DateTime.UtcNow, DateTime.UtcNow.AddMinutes(10), 
            signingCredentials
        ));

    }

    public AuthenticationTicket Unprotect(string protectedText)
    {
        throw new NotImplementedException();
    }
}

我从/auth收到的令牌看起来有效并在jwt.io上传递调试器（没有标记base64用于签名） image http://image.prntscr.com/image/cc16a2705c67494fa09f9df6850d7c54.png

但是UseJwtBearerAuthentication拒绝验证令牌。 image http://image.prntscr.com/image/f0bbe31829fa47e98ddbd03fc22e86b5.png

可能的原因是什么？

此外，我已经尝试在没有[Authorize]的控制器中手动验证相同的令牌，并且它将完全验证：

        var t = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpZCI6IjEiLCJpc3MiOiJsb2NhbCIsImF1ZCI6IkFueSIsImV4cCI6MTQ3MjkxMDcwMSwibmJmIjoxNDcyOTEwMTAxfQ.ipSrRSGmje7wfzERsd-M1IDFJnN99AIC4Hs7YX4FIeI";
        var TokenHandler = new JwtSecurityTokenHandler();;
        var key = Encoding.UTF8.GetBytes("12341234123412341234");
        SecurityToken validatedToken;
        TokenValidationParameters paras = new TokenValidationParameters()
        {
            IssuerSigningKey = new InMemorySymmetricSecurityKey(key),
            ValidAudience = "Any",
            ValidIssuer = "local"
        };
        TokenHandler.ValidateToken(t, paras, out validatedToken);

Owin 3.0.1.0 System.IdentityModel.Tokens.Jwt 4.0.3.308261200

Answer 1

问题不在于令牌验证，而是声明没有传递给Thread.CurrentPrincipal属性正在读取的[Authorize]。

在webapi配置中

config.SuppressDefaultHostAuthentication();
config.Filters.Add(new HostAuthenticationFilter(DefaultAuthenticationTypes.ExternalBearer));

在启动配置中

app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ExternalBearer,
    ...
});

app.UseJwtBearerAuthentication1(new JwtBearerAuthenticationOptions()
{
    AuthenticationType = DefaultAuthenticationTypes.ExternalBearer,
    ..
});

在OAuthAuthorizationServerProvider的GrantResourceOwnerCredentials中：
使用相同的身份验证类型，您可以从context.Options

中读取该类型

var identity = new ClaimsIdentity(youClaimsList, context.Options.AuthenticationType);
context.Validated(identity);

确保所有四个位置与AuthenticationType具有相同的字符串。如果HostAuthenticationFilter输入的authenticationType不同，则不会将owin的声明传递给webapi。

无法在UseJwtBearerAuthentication中验证令牌。授权被拒绝

1 个答案: