Azure移动应用程序使用Cordova自定义身份验证

Question

我目前使用Azure移动应用程序为我的应用程序提供了后端解决方案.我启用了facebook,twitter,google和Microsoft登录.我正在尝试添加自定义登录流程.我已经设置了一个Auth0帐户和应用程序,当我使用auth0 lock widget在应用程序中发出请求时,我能够从auth0获取令牌和配置文件.

我遵循了这个指南:https://shellmonger.com/2016/04/08/30-days-of-zumo-v2-azure-mobile-apps-day-5-custom-authentication/并进入舞台'Custom服务器中的JWT验证'但这是我被卡住的地方......我的后端是在C#而不是node.js,那么我该如何做与本教程相同的操作并验证JWT令牌,然后从我的前端访问表控制器使用azureClient.login/azureClient.table的应用程序？

编辑:好的,所以你会在@AdrianHall的评论主题中看到我已经成功地从我的cordova应用程序中生成一个令牌,但我的绊脚石现在让服务接受它而无需交换令牌.根据发布的指南,这是可能的.

这是我的客户端代码,它当前对auth0进行auth调用,并设置一些客户端来获取userID并生成包含新令牌的'currentUser'对象.

 auth0.lock.show(auth0.options, function(err, profile, token) {
    if (err) {
     console.error('Error authenticating with Auth0: ', err);
     alert(err);
    } else {
     debugger;
     var userID;
     if (profile.user_id.indexOf("auth0") > -1) {
      userID = profile.user_id.replace("auth0|", "");
     } else if (profile.user_id.indexOf("facebook") > -1) {
      userID = profile.user_id.replace("facebook|", "");
     } else if (profile.user_id.indexOf("twitter") > -1) {
      userID = profile.user_id.replace("twitter|", "");
     } else if (profile.user_id.indexOf("microsoft") > -1) {
      userID = profile.user_id.replace("microsoft|", "");
     } else if (profile.user_id.indexOf("google-oauth2") > -1) {
      userID = profile.user_id.replace("google-oauth2|", "");
     }
     window.azureClient.currentUser = {
      userId: userID,
      profile: profile,
      mobileServiceAuthenticationToken: token
     };

     //A client session has now been created which contains attributes relevant to the currently logged in user.

     console.log("window.azureClient.currentUser", window.azureClient.currentUser);
     window.localStorage.setItem("currentUser", JSON.stringify(window.azureClient.currentUser));
     //Call the get profile function which will call our API to get the user's activities and bio etc.
     getProfile();
    }

后端代码MobileAppSettingsDictionary

settings = config.GetMobileAppSettingsProvider().GetMobileAppSettings();

        if (string.IsNullOrEmpty(settings.HostName))
        {
            //This middleware is intended to be used locally for debugging.By default, HostName will

            //only have a value when running in an App Service application.
            app.UseAppServiceAuthentication(new AppServiceAuthenticationOptions
            {
                SigningKey = ConfigurationManager.AppSettings[""],
                ValidAudiences = new[] { ConfigurationManager.AppSettings[""] },
                ValidIssuers = new[] { ConfigurationManager.AppSettings["https://domain.eu.auth0.com/"] },
                TokenHandler = config.GetAppServiceTokenHandler()
             });
        }

Answer 1

在Azure Mobile Apps C#后端,有一个App_Start\Startup.Mobile.cs包含以下代码的文件:

    MobileAppSettingsDictionary settings = config.GetMobileAppSettingsProvider().GetMobileAppSettings();

    if (string.IsNullOrEmpty(settings.HostName))
    {
        // This middleware is intended to be used locally for debugging. By default, HostName will
        // only have a value when running in an App Service application.
        app.UseAppServiceAuthentication(new AppServiceAuthenticationOptions
        {
            SigningKey = ConfigurationManager.AppSettings["SigningKey"],
            ValidAudiences = new[] { ConfigurationManager.AppSettings["ValidAudience"] },
            ValidIssuers = new[] { ConfigurationManager.AppSettings["ValidIssuer"] },
            TokenHandler = config.GetAppServiceTokenHandler()
        });
    }

该app.UseAppServiceAuthentication调用设置解码JWT所需的配置.您只需要了解您的受众(JWT中的aud字段)和Issuer(JWT中的iss字段).在auth0情况下,Audience是您的ClientId,Issuer是" https:// your-domain-value " - Client Secret是签名密钥

您可以通过https://jwt.io上的剪切和粘贴来验证示例JWT - 这将明确显示值应该是什么,并允许您验证签名.