Python中使用public_key进行KeyCloak解码

Question

我不知道如何解码 keycloak 公钥和证书的结果。我应该使用哪一个来解码？我只有access_token。并尝试过使用 cert 和 public_key

结果来自：https://keycloak.some.domain/auth/realms/name-realm/

{
"realm": "name-realm",
"public_key": "some-secert-stringMIIBIsome-secert-stringknhFmdCmX9lu1EJNEsome-secert-string",
"token-service": "https://keycloak.some.domain/auth/realms/name-realm/protocol/openid-connect",
"account-service": "https://keycloak.some.domain/auth/realms/name-realm/account",
"tokens-not-before": 0
}

结果来自：https://keycloak.some.domain/auth/realms/epf-uat/protocol/openid-connect/certs

{
"keys": [
{
"kid": "WtJZKhwIsome-secert-stringA",
"kty": "RSA",
"alg": "RS256",
"use": "sig",
"n": "xtG3QzVml8lxYQz1FaesgZ2-TPR2h_NqGHwRsome-secert-stringH2Bd5Dncsome-secert-stringEHVBAd75gzIPh_wTsome-secert-stringiAw",
"e": "AQAB",
"x5c": [
"some-secert-string"
],
"x5t": "y-Ksome-secert-stringMViQ",
"x5t#S256": "vvsome-secert-stringbosome-secert-stringtE8QW2vnmw60NJfaDJlVE"
}
]
}

我尝试使用https://github.com/mpdavis/python-jose来解码 jwt。这里是样本：

环境：

keycloak_algorithm = ["RS256"]
keycloak_domain = "https://keycloak.some.domain/auth/realms/some-realm/"
keycloak_audience = "https://login.some-domain.com"

验证码

token = CLEANED_BEARER_TOKEN_FROM_CLIENT
jsonurl = urlopen(setting.keycloak_domain)
algorithms = setting.keycloak_algorithm
audience = setting.keycloak_audience
issuer = setting.keycloak_domain

jwks = json.loads(jsonurl.read())

try:
    payload = jwt.decode(token, jwks["public_key"], algorithms=algorithms, audience=audience, issuer=issuer)
except jwt.ExpiredSignatureError:
   raise AuthError("Token is expired. Please update your token.", 401)
except jwt.JWTClaimsError as e:
   raise AuthError("Invalid claims. " + str(e), 401)
except jwt.JWTError as e:
    raise AuthError("JWT Error." + str(e), 401)
except Exception as e:
    raise AuthError("Unable to parse authentication token. " + str(e), 401)

如果我使用域（没有 protocol/openid-connect/certs端点），结果如下：

AuthError: ('Unable to parse authentication token. Could not deserialize key data.', 401)

在这里，如果我使用protocol/openid-connect/certs端点：

AuthError: ('JWT Error.Signature verification failed.', 401)

我不知道为什么这两件事（public_key和证书）无法解码。

其他注意事项：

• 我正在使用 FastApi ( https://fastapi.tiangolo.com/ )

• 有 Express js 的工作部分。所以我只使用 python 应用程序使用来自express js 的身份验证。（express js 将通过提供 来到达端点access_code）

Answer 1

似乎public_key是 base64 编码的 DER 格式。您应该能够像这样使用它：

from base64 import b64decode

import jwt
from cryptography.hazmat.primitives import serialization

r = requests.get("https://keycloak.some.domain/auth/realms/name-realm/")
r.raise_for_status()
key_der_base64 = r.json()["public_key"]
key_der = b64decode(key_der_base64.encode())

public_key = serialization.load_der_public_key(key_der)

payload = jwt.decode(token, public_key, algorithms=["RS256"])

但是，请注意，https://keycloak.some.domain/auth/realms/name-realm/端点似乎不遵循任何正式标准。您最好使用/certs端点，如下所示：

import jwt
from jwt import PyJWKClient

url = "https://keycloak.some.domain/auth/realms/epf-uat/protocol/openid-connect/certs"
jwks_client = PyJWKClient(url)
signing_key = jwks_client.get_signing_key_from_jwt(token)
payload = jwt.decode(token, signing_key.key, algorithms=["RS256"])

Answer 2

我认为你应该用 -----BEGIN PUBLIC KEY----- [and your key here] -----END PUBLIC KEY----- 包装你的公钥