如何验证 Apigee Edge 从 .NET/C# 代码生成的 JWT 令牌？

Question

我在 Apigee Edge 中创建了一个代理来生成 JWT 令牌。我在 Apigee Edge 中创建了另一个代理验证 JWT 令牌，我可以使用它进行验证。现在我无法从 .NET/C# 代码完全验证 JWT 令牌。

下面是我试过的 .NET 代码：

private static bool ValidateToken(string authToken, string key)
{
    var tokenHandler = new JwtSecurityTokenHandler();
    var validationParameters = GetValidationParameters(key);
    SecurityToken validatedToken;
    IPrincipal principal = tokenHandler.ValidateToken(authToken, validationParameters, out validatedToken);
    return true;
}

private static TokenValidationParameters GetValidationParameters(string key)
{
    return new TokenValidationParameters()
    {
        ValidateLifetime = false, // Because there is no expiration in the generated token
        ValidateAudience = false, // Because there is no audiance in the generated token
        ValidateIssuer = false,   // Because there is no issuer in the generated token
        ValidIssuer = "urn:apigee-edge-JWT-policy-test",
        ValidAudience = "audience1",
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("key")) // The same key as the one that generate the token
    };
}

以及来自 Apigee Edge 的 JWT 生成策略代码：

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<GenerateJWT async="false" continueOnError="false" enabled="true" name="Generate-JWT-1">
    <DisplayName>Generate JWT-1</DisplayName>
    <Algorithm>HS256</Algorithm>
    <SecretKey>
        <Value ref="private.key"/>
    </SecretKey>
    <Subject>subject-subject</Subject>
    <Issuer>urn://apigee-edge-JWT-policy-test</Issuer>
    <Audience>audience1,audience2</Audience>
    <ExpiresIn>8h</ExpiresIn>
    <AdditionalClaims>
        <Claim name="userId" type="string" ref="request.formparam.username"/>
    </AdditionalClaims>
    <OutputVariable>jwt-variable</OutputVariable>
</GenerateJWT>

错误信息如下：

Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: IDX10503: Signature validation failed. Keys tried: 'Microsoft.IdentityModel.Tokens.SymmetricSecurityKey, KeyId: '', InternalId: '96edcecb-17ad-4022-a50b-558f426ed337'. , KeyId: '. Exceptions caught: 'System.ArgumentOutOfRangeException: IDX10603: Decryption failed. Keys tried: 'HS256'. Exceptions caught: '128'. token: '96' Parameter name: KeySize at Microsoft.IdentityModel.Tokens.SymmetricSignatureProvider..ctor(SecurityKey key, String algorithm, Boolean willCreateSignatures) at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateSignatureProvider(SecurityKey key, String algorithm, Boolean willCreateSignatures) at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateForVerifying(SecurityKey key, String algorithm) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(Byte[] encodedBytes, Byte[] signature, SecurityKey key, String algorithm, TokenValidationParameters validationParameters) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters) '.........

Answer 1

您的密钥长度不够长，如异常所述：

Exceptions caught: '128'. token: '96' Parameter name: KeySize

使用与例外大小相匹配的更长密钥

Answer 2

IssuerSigningKey = new SymmetricSecurityKey(编码。UTF8.GetBytes("key"))

在上面的代码中，"key" 值的大小比预期的要小。

如何验证 Apigee Edge 从 .NET/C# 代码生成的 JWT 令牌？

How to Validate Apigee Edge generated JWT Token from .NET/C# code?

.net

c#

jwt

apigee