如何验证Skype Bot Connector JWT令牌?

时间:2016-09-23 14:37:05

标签: python skype botframework pyjwt microsoft-skype-bot

我正在尝试根据documentation验证来自Microsoft Bot Framework Channel Emulator的授权令牌。

我从https://api.aps.skype.com/v1/.well-known/openidconfiguration检索OpenId元数据文档,并从https://api.aps.skype.com/v1/keys下载密钥。

当我从Emulator向我的机器人发送消息时,我收到 / api / messages 的请求,其中包含 Authorization 标头,其中包含JWT令牌。令牌标头包含此信息

{
  'alg': 'RS256',
  'kid': 'YbRAQRYcE_motWVJKHrwLBbd_9s',
  'x5t': 'YbRAQRYcE_motWVJKHrwLBbd_9s',
  'typ': 'JWT'
}

根据 kid 值,我选择了这个JWK键

{
  "kty": "RSA",
  "use": "sig",
  "kid": "YbRAQRYcE_motWVJKHrwLBbd_9s",
  "x5t": "YbRAQRYcE_motWVJKHrwLBbd_9s",
  "n": "vbcFrj193Gm6zeo5e2_y54Jx49sIgScv-2JO-n6NxNqQaKVnMkHcz-S1j2FfpFngotwGMzZIKVCY1SK8SKZMFfRTU3wvToZITwf3W1Qq6n-h-abqpyJTaqIcfhA0d6kEAM5NsQAKhfvw7fre1QicmU9LWVWUYAayLmiRX6o3tktJq6H58pUzTtx_D0Dprnx6z5sW-uiMipLXbrgYmOez7htokJVgDg8w-yDFCxZNo7KVueUkLkxhNjYGkGfnt18s7ZW036WoTmdaQmW4CChf_o4TLE5VyGpYWm7I_-nV95BBvwlzokVVKzveKf3l5UU3c6PkGy-BB3E_ChqFm6sPWw",
  "e": "AQAB",
  "x5c": ["MIIC4jCCAcqgAwIBAgIQfQ29fkGSsb1J8n2KueDFtDANBgkqhkiG9w0BAQsFADAtMSswKQYDVQQDEyJhY2NvdW50cy5hY2Nlc3Njb250cm9sLndpbmRvd3MubmV0MB4XDTE2MDQxNzAwMDAwMFoXDTE4MDQxNzAwMDAwMFowLTErMCkGA1UEAxMiYWNjb3VudHMuYWNjZXNzY29udHJvbC53aW5kb3dzLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL23Ba49fdxpus3qOXtv8ueCcePbCIEnL/tiTvp+jcTakGilZzJB3M/ktY9hX6RZ4KLcBjM2SClQmNUivEimTBX0U1N8L06GSE8H91tUKup/ofmm6qciU2qiHH4QNHepBADOTbEACoX78O363tUInJlPS1lVlGAGsi5okV+qN7ZLSauh+fKVM07cfw9A6a58es+bFvrojIqS1264GJjns+4baJCVYA4PMPsgxQsWTaOylbnlJC5MYTY2BpBn57dfLO2VtN+lqE5nWkJluAgoX/6OEyxOVchqWFpuyP/p1feQQb8Jc6JFVSs73in95eVFN3Oj5BsvgQdxPwoahZurD1sCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAe5RxtMLU2i4/vN1YacncR3GkOlbRv82rll9cd5mtVmokAw7kwbFBFNo2vIVkun+n+VdJf+QRzmHGm3ABtKwz3DPr78y0qdVFA3h9P60hd3wqu2k5/Q8s9j1Kq3u9TIEoHlGJqNzjqO7khX6VcJ6BRLzoefBYavqoDSgJ3mkkYCNqTV2ZxDNks3obPg4yUkh5flULH14TqlFIOhXbsd775aPuMT+/tyqcc6xohU5NyYA63KtWG1BLDuF4LEF84oNPcY9i0n6IphEGgz20H7YcLRNjU55pDbWGdjE4X8ANb23kAc75RZn9EY4qYCiqeIAg3qEVKLnLUx0fNKMHmuedjg=="],
  "issuer": "https://login.microsoftonline.com/{tenantid}/v2.0"
}

对于令牌验证,我使用pyjwt。在这里,我不知道jwt.decode()函数中用于令牌验证的密钥。

jwt.decode(token, key=key_from_skype_com)

对于 n x5c 字段,我尝试了以下选项:

  • 绝望地传递它们
  • base64url-decode them
  • base64url-解码它们并使用cryptography包中的load_der_public_key()函数加载

加密代码

from cryptography.hazmat import backends
from cryptography.hazmat.primitives import serialization
serialization.load_der_public_key(decoded_key, backend=backends.default_backend())

似乎JWK的 n 字段是base64-urlsafe编码而 x5c 只是base64编码。所以我对它们进行了适当的解码。

我不是加密专家。我尝试搜索MS文档,其中主要包含使用SDK for Node.js和C#的示例。我读了RFC 7517RFC 7515,但没有找到具体的信息。

0 个答案:

没有答案