Question

下面的代码通过在每次验证this

> gDistance(Kinta.km,tin.01,byid=TRUE)
    59
1 661153.5
2 661152.6
3 661153.0
4 661152.7
5 661151.8
6 661152.9
7 661153.1
8 661153.3
9 661153.2

之后的每个请求时下载JWKS来验证JWT令牌。我的问题是如何从下面的示例链接缓存JWKS到避免每次都下载它，并且无需对JWKS进行硬编码，因为它会定期旋转。

https://demo.identityserver.io/.well-known/openid-configuration/jwks

https://openid-connect-eu.onelogin.com/oidc/certs

任何代码示例以及用于缓存和验证JWT的链接都将不胜感激。

以下内容似乎很相关，但并不完整。

https://docs.microsoft.com/en-us/azure/api-management/api-management-sample-cache-by-key

更新

请明确一点，我想缓存上述链接的JWKS中的内容，以提高性能。

Answer 1

如果有帮助，请查看以下示例referred from here！

<policies>
    <inbound>
        <!-- Add your wcf relay address as the base URL below -->
        <set-backend-service base-url="" />
        <!-- verify if there is a relaytoken key stored in cache -->
        <cache-lookup-value key="@("relaytoken")" variable-name="relaytoken" />
        <choose>
            <!-- If there is no key stored in cache -->
            <when condition="@(!context.Variables.ContainsKey("relaytoken"))">
                <set-variable name="resourceUri" value="@(context.Request.Url.ToString())" />
                <!-- Retrieve Shared Access Policy key from  Name Value store -->
                <set-variable name="accessKey" value="{{accessKey}}" />
                <!-- Retrieve Shared Access Policy key name from  Name Value store -->
                <set-variable name="keyName" value="{{accessKeyName}}" />
                <!-- Generate the relaytoken key -->
                <set-variable name="relaytoken" value="@{
                    TimeSpan sinceEpoch = DateTime.UtcNow - new DateTime(1970, 1, 1);
                    string expiry =  Convert.ToString((int)sinceEpoch.TotalSeconds + 3600);
                    string resourceUri = (string)context.Variables["resourceUri"];
                    string stringToSign = Uri.EscapeDataString (resourceUri) + "\n" + expiry;
                    HMACSHA256 hmac = new HMACSHA256(Encoding.UTF8.GetBytes((string)context.Variables["accessKey"]));
                    string signature = Convert.ToBase64String(hmac.ComputeHash(Encoding.UTF8.GetBytes(stringToSign)));
                    string sasToken = String.Format("SharedAccessSignature sr={0}&sig={1}&se={2}&skn={3}",
                    Uri.EscapeDataString(resourceUri), Uri.EscapeDataString(signature), expiry, context.Variables["keyName"]);
                    return sasToken;
                    }" />
                <!-- Store the relaytoken in the cache -->
                <cache-store-value key="relaytoken" value="@((string)context.Variables["relaytoken"])" duration="10" />
            </when>
        </choose>
        <!-- If the operation request uses json format, convert it to XML - Azure Relay expects XML format (based on WCF) -->
        <set-body template="liquid">
            <!-- set your body transformation here -->
        </set-body>
        <!-- Create the ServiceBusAuthorization header using the relaytoken as value -->
        <set-header name="ServiceBusAuthorization" exists-action="override">
            <value>@((string)context.Variables["relaytoken"])</value>
        </set-header>
        <!-- Set the content type to application/xml -->
        <set-header name="Content-Type" exists-action="override">
            <value>application/xml</value>
        </set-header>
        <base />
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
    <!-- If the operation responses uses json format, convert it from XML - Azure Relay will return XML format (based on WCF) -->
        <set-body template="liquid">
            <!-- set your body transformation here -->
        </set-body>
        <!-- Set the content type to application/json -->
        <set-header name="Content-Type" exists-action="override">
            <value>application/json</value>
        </set-header>
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

Answer 2

Azure API管理服务使用资源URL作为键（https://github.com/toddkitta/azure-content/blob/master/articles/api-management/api-management-sample-cache-by-key.md）对HTTP响应缓存进行了内置支持。您可以做的就是自己将openid-config url设置为操作和控件缓存。另一种方法可能是引入自己的缓存服务。

Answer 3

APIM不会为每个请求下载开放ID配置。如果我没记错的话，它会每小时下载，缓存并定期自动刷新。

使用Azure API管理从Identity Provider缓存JWKS以验证JWT

3 个答案: