我正在尝试根据documentation验证来自Microsoft Bot Framework Channel Emulator的授权令牌。
我从https://api.aps.skype.com/v1/.well-known/openidconfiguration检索OpenId元数据文档,并从https://api.aps.skype.com/v1/keys下载密钥。
当我从Emulator向我的机器人发送消息时,我收到 / api / messages 的请求,其中包含 Authorization 标头,其中包含JWT令牌。令牌标头包含此信息
{
'alg': 'RS256',
'kid': 'YbRAQRYcE_motWVJKHrwLBbd_9s',
'x5t': 'YbRAQRYcE_motWVJKHrwLBbd_9s',
'typ': 'JWT'
}
根据 kid 值,我选择了这个JWK键
{
"kty": "RSA",
"use": "sig",
"kid": "YbRAQRYcE_motWVJKHrwLBbd_9s",
"x5t": "YbRAQRYcE_motWVJKHrwLBbd_9s",
"n": "vbcFrj193Gm6zeo5e2_y54Jx49sIgScv-2JO-n6NxNqQaKVnMkHcz-S1j2FfpFngotwGMzZIKVCY1SK8SKZMFfRTU3wvToZITwf3W1Qq6n-h-abqpyJTaqIcfhA0d6kEAM5NsQAKhfvw7fre1QicmU9LWVWUYAayLmiRX6o3tktJq6H58pUzTtx_D0Dprnx6z5sW-uiMipLXbrgYmOez7htokJVgDg8w-yDFCxZNo7KVueUkLkxhNjYGkGfnt18s7ZW036WoTmdaQmW4CChf_o4TLE5VyGpYWm7I_-nV95BBvwlzokVVKzveKf3l5UU3c6PkGy-BB3E_ChqFm6sPWw",
"e": "AQAB",
"x5c": ["MIIC4jCCAcqgAwIBAgIQfQ29fkGSsb1J8n2KueDFtDANBgkqhkiG9w0BAQsFADAtMSswKQYDVQQDEyJhY2NvdW50cy5hY2Nlc3Njb250cm9sLndpbmRvd3MubmV0MB4XDTE2MDQxNzAwMDAwMFoXDTE4MDQxNzAwMDAwMFowLTErMCkGA1UEAxMiYWNjb3VudHMuYWNjZXNzY29udHJvbC53aW5kb3dzLm5ldDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL23Ba49fdxpus3qOXtv8ueCcePbCIEnL/tiTvp+jcTakGilZzJB3M/ktY9hX6RZ4KLcBjM2SClQmNUivEimTBX0U1N8L06GSE8H91tUKup/ofmm6qciU2qiHH4QNHepBADOTbEACoX78O363tUInJlPS1lVlGAGsi5okV+qN7ZLSauh+fKVM07cfw9A6a58es+bFvrojIqS1264GJjns+4baJCVYA4PMPsgxQsWTaOylbnlJC5MYTY2BpBn57dfLO2VtN+lqE5nWkJluAgoX/6OEyxOVchqWFpuyP/p1feQQb8Jc6JFVSs73in95eVFN3Oj5BsvgQdxPwoahZurD1sCAwEAATANBgkqhkiG9w0BAQsFAAOCAQEAe5RxtMLU2i4/vN1YacncR3GkOlbRv82rll9cd5mtVmokAw7kwbFBFNo2vIVkun+n+VdJf+QRzmHGm3ABtKwz3DPr78y0qdVFA3h9P60hd3wqu2k5/Q8s9j1Kq3u9TIEoHlGJqNzjqO7khX6VcJ6BRLzoefBYavqoDSgJ3mkkYCNqTV2ZxDNks3obPg4yUkh5flULH14TqlFIOhXbsd775aPuMT+/tyqcc6xohU5NyYA63KtWG1BLDuF4LEF84oNPcY9i0n6IphEGgz20H7YcLRNjU55pDbWGdjE4X8ANb23kAc75RZn9EY4qYCiqeIAg3qEVKLnLUx0fNKMHmuedjg=="],
"issuer": "https://login.microsoftonline.com/{tenantid}/v2.0"
}
对于令牌验证,我使用pyjwt。在这里,我不知道jwt.decode()函数中用于令牌验证的密钥。
jwt.decode(token, key=key_from_skype_com)
对于 n 和 x5c 字段,我尝试了以下选项:
加密代码
from cryptography.hazmat import backends
from cryptography.hazmat.primitives import serialization
serialization.load_der_public_key(decoded_key, backend=backends.default_backend())
似乎JWK的 n 字段是base64-urlsafe编码而 x5c 只是base64编码。所以我对它们进行了适当的解码。
我不是加密专家。我尝试搜索MS文档,其中主要包含使用SDK for Node.js和C#的示例。我读了RFC 7517和RFC 7515,但没有找到具体的信息。