Question

我正在尝试验证每次请求时从Azure AD获取的IdToken，但我一直收到错误消息，表示令牌上没有签名。当我验证访问令牌它工作，但我宁愿使用Id令牌，因为它包含用户声明。反正有没有让Azure发回带有签名的Id令牌？

public JwtSecurityToken ValidateJwtToken(string jwtToken)
    {
        string stsDiscoveryEndpoint = $"{_authority}/.well-known/openid-configuration";

       ConfigurationManager<OpenIdConnectConfiguration> configManager =
            new ConfigurationManager<OpenIdConnectConfiguration>(stsDiscoveryEndpoint, new OpenIdConnectConfigurationRetriever());

       OpenIdConnectConfiguration config = configManager.GetConfigurationAsync().Result;

       TokenValidationParameters validationParameters = new TokenValidationParameters
        {
            ValidateAudience = false,
            ValidateIssuer = false,
            ValidateLifetime = false,
            IssuerSigningKeys = config.SigningKeys
        };

       JwtSecurityTokenHandler tokendHandler = new JwtSecurityTokenHandler();

       try
        {
            SecurityToken token;
            tokendHandler.ValidateToken(jwtToken, validationParameters, out token);

           return token as JwtSecurityToken;
        }
        catch (Exception ex)
        {
            loggingService.LogError("Could not validate azure ad token", nameof(AzureSecurityService), ex);
            return null;
        }
    }

   public async Task<string> GenerateToken(string code)
    {
        AuthenticationContext authenticationContext = new AuthenticationContext(_authority);

       try
        {
            string baseUrl = HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Authority);
            AuthenticationResult result =
                await authenticationContext.AcquireTokenByAuthorizationCodeAsync(code, new Uri(baseUrl), new ClientCredential(_clientId, _clientSecret));

           return result.IdToken;
        }
        catch (AdalException adalex)
        {
            loggingService.LogError("Could not get authorization request url", nameof(AzureSecurityService), adalex);
            return null;
        }
        catch (Exception ex)
        {
            loggingService.LogError("Could not get authorization request url", nameof(AzureSecurityService), ex);
            return null;
        }
    }

   public async Task<string> GetAuthUrl()
    {
        AuthenticationContext authenticationContext = new AuthenticationContext(_authority);

       // Config for OAuth client credentials  
       try
        {
            string baseUrl = HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Authority);
            var authUri =
                await authenticationContext.GetAuthorizationRequestUrlAsync("00000000-0000-0000-0000-000000000000", _clientId, new Uri(baseUrl), UserIdentifier.AnyUser, null);

           return authUri.ToString();
        }
        catch (AdalException adalex)
        {
            loggingService.LogError("Could not get authorization request url", nameof(AzureSecurityService), adalex);
            return null;
        }
        catch (Exception ex)
        {
            loggingService.LogError("Could not get authorization request url", nameof(AzureSecurityService), ex);
            return null;
        }
    }

更新

所以无论出于什么原因，即使没有提供范围，我也会收到索赔。我现在所做的只是将查询参数添加到范围的auth url并请求openid和profile：

var authUri =
                await authenticationContext.GetAuthorizationRequestUrlAsync("00000000-0000-0000-0000-000000000000", _clientId, new Uri(GetBaseUrl()), UserIdentifier.AnyUser, "scope=openid profile");

我的问题是，为什么默认范围不会返回带签名的id_token？