承载error =“ invalid_token”，error_description =“签名无效”

Question

我有一个角度的应用程序，要求从天蓝色的令牌。登录进展顺利，我得到了令牌。现在，此令牌已从角度应用程序发送到网络核心webapi应用程序。网络核心应验证此令牌，但失败。我认为webapi还应该联系azure来验证令牌，因为它不知道验证令牌所需的私钥和公钥。

目前尚不清楚为什么它会失败。angular应用程序和webapi都在我的计算机上本地运行。

错误是： Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: 'IDX10500: Signature validation failed. No security keys were provided to validate the signature.'

我的净核心2配置是：

var tokenValidationParameters = new TokenValidationParameters
            {

                RequireExpirationTime = true,
                RequireSignedTokens = false,
                ValidateIssuerSigningKey = true,
                ValidateIssuer = true,
                ValidIssuer = "8d708afe-2966-40b7-918c-a39551625958",
                ValidateAudience = true,
                ValidAudience = "https://sts.windows.net/a1d50521-9687-4e4d-a76d-ddd53ab0c668/",
                ValidateLifetime = false,
                ClockSkew = TimeSpan.Zero
            };
            services.AddAuthentication(options =>
            {
                options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;

            }).AddJwtBearer(options =>
            {

                options.Audience = "8d708afe-2966-40b7-918c-a39551625958";
                options.ClaimsIssuer = "https://sts.windows.net/a1d50521-9687-4e4d-a76d-ddd53ab0c668/";
                options.RequireHttpsMetadata=false;
                options.TokenValidationParameters = tokenValidationParameters;
                options.SaveToken = true;
            });

Answer 1

你有很多配置:)

两个强制性设置是受众和权威：

services
    .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(o =>
    {
        o.Audience = "8d708afe-2966-40b7-918c-a39551625958";
        o.Authority = "https://login.microsoftonline.com/a1d50521-9687-4e4d-a76d-ddd53ab0c668/";
    });

您缺少授权，因此它不知道从哪里加载签名公钥。

Answer 2

You are missing IssuerSigningKey property in your TokenValidationParameters. Thats why its complaining.

The simplest example would be

IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("yOURsECRETkEY12345"))

I'm not sure how azure comes into play, you probably need it to retrieve security key information, if thats your signing authority

Edit:

Azure specific settings

.AddJwtBearer(options => {
        options.Authority = string.Format("https://login.microsoftonline.com/tfp/{0}/{1}/v2.0/", Configuration["Authentication:AzureAd:Tenant"], Configuration["Authentication:AzureAd:Policy"]);
        options.Audience = Configuration["Authentication:AzureAd:ClientId"];
    });