是否可以使用 Azure Key Vault 的密钥 API 创建 JSON Web 令牌？

Question

我目前正在使用 jsonwebtokens 包来生成带有 RSA 签名密钥的签名 JWT。我正在尝试看看如何迁移到 Azure Key Vault。我可以做的一种方法是将私钥和 public 密钥存储为 Vault Secrets。但我注意到还有一个 Vault Keys API，它在 Vault 中生成一个密钥并签署我提供的数据。

我一直在尝试 @azure/keyvault-keys 包，这是我得到的地方：

async signJsonWebToken(data: object, expiry: string): Promise<string> {
  const headerB64 = this.base64url(JSON.stringify(this.keyHeader), 'binary');
  const payloadB64 = this.base64url(this.getTokenData(data, expiry), 'utf8');
  const payload = `${headerB64}.${payloadB64}`;

  const key = await this.keyClient.getKey(this.KEY_NAME);
  const cryptClient = new CryptographyClient(key, new DefaultAzureCredential());

  const hash = crypto.createHash('sha256');
  const digest = hash.update(payload).digest();

  const signResult = await cryptClient.sign('RS256', digest);
  const signResultB64 = this.base64url(signResult.result.toString(), 'utf8');
  const result = `${payload}.${signResultB64}`;
  this.logger.log('Key: ' + key.key);
  this.logger.log('Sign result: ' + result);
  return result;
}

private base64url(data: string, encoding: string) {
  return SBuffer
    .from(data, encoding)
    .toString('base64')
    .replace(/=/g, '')
    .replace(/\+/g, '-')
    .replace(/\//g, '_');
}

private getTokenData(data: object, expiry: string): string {
  const now = Date.now();
  const expiresIn = new Date();
  if (expiry.endsWith('d')) {
    expiresIn.setDate(expiresIn.getDate() + parseInt(expiry));
  } else if (expiry.endsWith('h')) {
    expiresIn.setHours(expiresIn.getHours() + parseInt(expiry));
  } else if (expiry.endsWith('m')) {
    expiresIn.setMinutes(expiresIn.getMinutes() + parseInt(expiry));
  }
  const tokenData = Object.assign({
    iat: now,
    exp: expiresIn.getTime()
  }, data);
  return JSON.stringify(tokenData);
}

生成的签名看起来与我通常使用 jsonwebtoken 包获得的签名相去甚远。我的意图是我想用 Vault 签署我的令牌，但想用 jsonwebtoken.verify() 进行验证。这可能吗？我的代码哪里做错了？

Answer 1

既然你使用Azure kay vault对jwt进行签名，我们也可以使用Azure key vault来验证jwt

例如

 const key = await this.keyClient.getKey(this.KEY_NAME);
 const cryptClient = new CryptographyClient(key, new DefaultAzureCredential());
const util =require('util')
const base64 = require('base64url');
const JWT=""
    const jwtHeader = JWT.split('.')[0];
    const jwtPayload = JWT.split('.')[1];
    const jwtSignature = JWT.split('.')[2];
    const signature = base64.toBuffer(jwtSignature)
    const data = util.format('%s.%s', jwtHeader, jwtPayload);
    const hash = crypto.createHash('sha256');
    const digest = hash.update(data).digest()
const verified =await cryptClient.verify("RS256",digest,signature)

另外如果想使用jsonwebtoken包验证jet，请参考以下代码

const util =require('util')
const base64 = require('base64url');
const forge = require('node-forge');
const jwt = require('jsonwebtoken')
async Function test{
// gerenrate jwt
const headerObj = {
        alg: 'RS256',
        typ: 'JWT'
    };
    
    const payloadObj = {
        sub: '1234567890',
        name: 'John Doe'
       
    };
    
    const encodedHeader = base64(JSON.stringify(headerObj));
    const encodedPayload = base64(JSON.stringify(payloadObj));
    const data = util.format('%s.%s', encodedHeader, encodedPayload);

    const hash = crypto.createHash('sha256');
    const digest = hash.update(data).digest()
   
    
    const keyClient =new KeyClient("https://testsql.vault.azure.net/",new DefaultAzureCredential());
    const key =await keyClient.getKey("test");
    const cryptClient = new CryptographyClient(key.id, new DefaultAzureCredential());
    const signResult = await cryptClient.sign("RS256",digest)     
    const jwts =util.format('%s.%s.%s', encodedHeader, encodedPayload,base64(signResult.result));
    console.log(jwts)

// verify

// convert azure key vault ket to public key
var n =Buffer.from(key.key.n).toString("base64")   
    var e =Buffer.from(key.key.e).toString("base64")
    var publicKey = forge.pki.setRsaPublicKey(
        base64urlToBigInteger(n),
        base64urlToBigInteger(e)); 
// convert public key to pem file
     var pem = forge.pki.publicKeyToPem(publicKey);
    var d= jwt.decode(jwts,pem.toString())
    console.log(d)
}




function base64urlToBigInteger(str) {
   
    var bytes = forge.util.decode64(
      (str + '==='.slice((str.length + 3) % 4))
        .replace(/\-/g, '+')
        .replace(/_/g, '/'));
    return new forge.jsbn.BigInteger(forge.util.bytesToHex(bytes), 16);
  };

是否可以使用 Azure Key Vault 的密钥 API 创建 JSON Web 令牌？

Is it possible to create a JSON Web Token using Azure Key Vault's Keys API?

azure

node.js

jwt

azure-keyvault