Question

我将aps.net核心与JWT身份验证结合使用，发现aws cognito返回错误的令牌。取而代之的是aud，它返回访问令牌中的client_id。我使用Nuget库

AWSSDK.Core
AWSSDK.CognitoIdentityProvider
Amazon.Extensions.CognitoAuthentication

结果相同。例如：访问令牌为：

{
  "sub": "9ed87b45-da04-4fda-bc74-XXXXXXXXXXXX",
  "event_id": "469880d0-8b17-417a-88d7-XXXXXXXXXXXX",
  "token_use": "access",
  "scope": "aws.cognito.signin.user.admin",
  "auth_time": 1583252488,
  "iss": "https://cognito-idp.us-east-2.amazonaws.com/us-east-2_XXXXXXXX",
  "exp": 1583256088,
  "iat": 1583252488,
  "jti": "c1ca9561-51ce-4b57-9f51-3355363fb4f6",
  "client_id": "AppClientIDXXXXXXXXXXXXX",
  "username": "testname"
}

毕竟，我发现id令牌返回'aud'

{
  "sub": "9ed87b45-da04-4fda-bc74-XXXXXXXXXXXX",
  "aud": "AppClientIDXXXXXXXXXXXXX",
  "email_verified": true,
  "event_id": "469880d0-8b17-417a-88d7-XXXXXXXXXXXX",
  "token_use": "id",
  "auth_time": 1583252488,
  "iss": "https://cognito-idp.us-east-2.amazonaws.com/us-east-2_XXXXXXXX",
  "cognito:username": "testname",
  "exp": 1583256088,
  "iat": 1583252488,
  "email": "testname@mail.no"
}

我使用两种方式添加jwt身份验证。它对我不起作用。范例1：

services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
     options.TokenValidationParameters = new TokenValidationParameters
     {
         ValidateIssuerSigningKey = true,
         IssuerSigningKeyResolver = (s, securityToken, identifier, parameters) =>
         {
             var json = new WebClient().DownloadString(parameters.ValidIssuer + "/.well-known/jwks.json");
             return JsonConvert.DeserializeObject<JsonWebKeySet>(json).Keys;
         },
         ValidateIssuer = true,
         ValidIssuer = $"https://cognito-idp.{region}.amazonaws.com/{poolId}",
         ValidateAudience = true,
         ValidAudience = appClientId,
     };
});

示例2：

services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
     options.Audience = appClientId;
     options.Authority = $"https://cognito-idp.{region}.amazonaws.com/{poolId}";
});

我的验证码

使用AWSSDK.CognitoIdentityProvider

var initiateAuthRequest = new InitiateAuthRequest()
    {
        ClientId = myClientId,
        AuthFlow = AuthFlowType.USER_PASSWORD_AUTH,
    };
initiateAuthRequest.AuthParameters.Add("USERNAME", user.Username);
initiateAuthRequest.AuthParameters.Add("PASSWORD", user.Password);
var authResponse = await _cognitoIdentityProvider.InitiateAuthAsync(initiateAuthRequest);

使用Amazon.Extensions.CognitoAuthentication

var provider = new AmazonCognitoIdentityProviderClient(new EnvironmentVariablesAWSCredentials(), myRegion);
var userPool = new CognitoUserPool(myPool, myClient, provider);
var usr = new CognitoUser(user.Username, myClient, userPool, provider);
AuthFlowResponse authResponse = await usr.StartWithSrpAuthAsync(
    new InitiateSrpAuthRequest(){Password = user.Password}).ConfigureAwait(false);

如何获取有效的JWT令牌？如何正确验证令牌？

已更新：在示例1中，如果将ValidateAudience设置为false并删除了ValidAudience，则会收到401错误

ValidateAudience = false,
//ValidAudience = appClientId

我的Startup.cs是

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public static IConfiguration Configuration { get; private set; }

    public void ConfigureServices(IServiceCollection services)
    {
        var region = Configuration[Resources.AWSRegion];
        var poolId = Configuration[Resources.AWSPoolId];
        var appClientId = Configuration[Resources.AWSClientId];

        services.AddSingleton<IAmazonCognitoIdentityProvider>(provider => new AmazonCognitoIdentityProviderClient(RegionEndpoint.USEast2)));

        services.AddControllers();
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddJwtBearer(options =>
        {
             options.TokenValidationParameters = new TokenValidationParameters
             {
                 ValidateIssuerSigningKey = true,
                 IssuerSigningKeyResolver = (s, securityToken, identifier, parameters) =>
                 {
                     var json = new WebClient().DownloadString(parameters.ValidIssuer + "/.well-known/jwks.json");
                     return JsonConvert.DeserializeObject<JsonWebKeySet>(json).Keys;
                 },
                 ValidateIssuer = true,
                 ValidIssuer = $"https://cognito-idp.{region}.amazonaws.com/{poolId}",
                 ValidateAudience = true,
                 ValidAudience = appClientId
             };
        });
        services.AddAuthorization();
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        app.UseRouting();
        app.UseAuthorization();
        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllers();
        });
        app.UseAuthentication();
    }
}

Answer 1

这对我来说很有效，我使用ID令牌代替了访问令牌

public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        }).AddJwtBearer(options =>
        {
            options.TokenValidationParameters = GetCognitoTokenValidationParams();
        });
    }

    private TokenValidationParameters GetCognitoTokenValidationParams()
    {
        var cognitoIssuer = $"https://cognito-idp.{Configuration["AWS:Region"]}.amazonaws.com/{Configuration["AWS:UserPoolId"]}";
        var jwtKeySetUrl = $"{cognitoIssuer}/.well-known/jwks.json";
        var cognitoAudience = Configuration["AWS:UserPoolClientId"];

        return new TokenValidationParameters
        {
            IssuerSigningKeyResolver = (s, securityToken, identifier, parameters) =>
            {
                // get JsonWebKeySet from AWS
                var json = new WebClient().DownloadString(jwtKeySetUrl);
                return JsonConvert.DeserializeObject<JsonWebKeySet>(json).Keys;
            },
            ValidIssuer = cognitoIssuer,
            ValidateIssuerSigningKey = true,
            ValidateIssuer = true,
            ValidateLifetime = true,
            ValidAudience = cognitoAudience
        };
    }

Answer 2

我遇到了同样的问题，但我只找到了一种解决方案。

如果您要使用访问令牌来验证用户身份，请设置

ValidateAudience = false,
//ValidAudience = appClientId

并将AuthenticationSchemes添加到授权过滤器，如下所示：

[HttpGet]
[Authorize(AuthenticationSchemes = "Bearer")]
public async Task<string> Test()
{
    return await Task.Run(() => "hello world");
}

我有非常相似的代码，它对我有用。希望对你也有帮助。

你也可以替换这个代码：

services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})

为了那个（只是为了简化）：

services.AddAuthentication("Bearer")

如何用空观众正确验证Cognito JWT并在之后进行身份验证？

2 个答案: