当使用 Azure API 管理更改为不同的受众时，JWT 验证策略突然无效

Question

我有一个奇怪的问题，在 APIM 中更改下面的受众元素的值以进行 JWT 验证，参考下面的 link

https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#ValidateJWT

1 个新 link: https://new.onelogin.com/oidc/token

我只在 2 中更改了旧版本的受众元素的值。但是当我尝试保存策略时，我从 APIM 门户收到以下验证错误：

The element 'validate-jwt' has invalid child element 'openid-config'. List of possible elements expected: 'required-claims'.

请注意，2 中的旧版本不需要 'required-claims' 元素。

client_id=新xxx

    <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Error: expired token or invalid token" require-expiration-time="true" require-scheme="Bearer" require-signed-tokens="true">
        <audiences>
            <audience>new xxx</audience>
        </audiences>
        <issuers>
            <issuer>https://openid-connect-eu.onelogin.com/oidc</issuer>
        </issuers>
       <openid-config url="https://openid-connect-eu.onelogin.com/oidc/.well-known/openid-configuration" />
    </validate-jwt>

2 旧的 url 和 jwt 验证，并且有效。

https://old.onelogin.com/oidc/token

     client_id=old xxx

    <validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Error: expired token or invalid token" require-expiration-time="true" require-scheme="Bearer" require-signed-tokens="true">
        <audiences>
            <audience>old xxx</audience>
        </audiences>
        <issuers>
            <issuer>https://openid-connect-eu.onelogin.com/oidc</issuer>
        </issuers>
       <openid-config url="https://openid-connect-eu.onelogin.com/oidc/.well-known/openid-configuration" />
    </validate-jwt>

有什么想法吗？

更新：

现在即使是原来的政策也没有任何改变也有问题：

The element 'validate-jwt' has invalid child element 'openid-config'. List of possible elements expected: 'required-claims'.

Answer 1

您需要将 xml 中的 openid-config 向上移动，并使其保持在 validate-jwt 开始标记下方。请看下面：

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Unauthorized" require-expiration-time="true" require-scheme="Bearer" require-signed-tokens="true">
    <openid-config url="" />
    <issuer-signing-keys>
        <key>Base64 Encoded Key</key>
    </issuer-signing-keys>
    <audiences>
        <audience></audience>       
    </audiences>
    <issuers>
        <issuer></issuer>
    </issuers>  
</validate-jwt>

当使用 Azure API 管理更改为不同的受众时，JWT 验证策略突然无效

JWT Validation policy suddently not valid when changed to a different audience with Azure API Management

azure

azure-api-management