如何正确验证空受众的 Cognito JWT 并在之后进行身份验证？

Question

我将 aps.net core 与 JWT 身份验证结合使用，发现 aws cognito 返回错误的令牌。相反，aud 它会在访问令牌中返回 client_id。我使用 Nuget 库

• AWSSDK.核心
• AWSSDK.CognitoIdentityProvider
• Amazon.Extensions.CognitoAuthentication

结果是一样的。例如：访问令牌是：

{
  "sub": "9ed87b45-da04-4fda-bc74-XXXXXXXXXXXX",
  "event_id": "469880d0-8b17-417a-88d7-XXXXXXXXXXXX",
  "token_use": "access",
  "scope": "aws.cognito.signin.user.admin",
  "auth_time": 1583252488,
  "iss": "https://cognito-idp.us-east-2.amazonaws.com/us-east-2_XXXXXXXX",
  "exp": 1583256088,
  "iat": 1583252488,
  "jti": "c1ca9561-51ce-4b57-9f51-3355363fb4f6",
  "client_id": "AppClientIDXXXXXXXXXXXXX",
  "username": "testname"
}

毕竟我发现 id 令牌返回“aud”

{
  "sub": "9ed87b45-da04-4fda-bc74-XXXXXXXXXXXX",
  "aud": "AppClientIDXXXXXXXXXXXXX",
  "email_verified": true,
  "event_id": "469880d0-8b17-417a-88d7-XXXXXXXXXXXX",
  "token_use": "id",
  "auth_time": 1583252488,
  "iss": "https://cognito-idp.us-east-2.amazonaws.com/us-east-2_XXXXXXXX",
  "cognito:username": "testname",
  "exp": 1583256088,
  "iat": 1583252488,
  "email": "testname@mail.no"
}

我使用了两种添加 jwt 身份验证的方法。这对我不起作用。示例1：

{
  "sub": "9ed87b45-da04-4fda-bc74-XXXXXXXXXXXX",
  "event_id": "469880d0-8b17-417a-88d7-XXXXXXXXXXXX",
  "token_use": "access",
  "scope": "aws.cognito.signin.user.admin",
  "auth_time": 1583252488,
  "iss": "https://cognito-idp.us-east-2.amazonaws.com/us-east-2_XXXXXXXX",
  "exp": 1583256088,
  "iat": 1583252488,
  "jti": "c1ca9561-51ce-4b57-9f51-3355363fb4f6",
  "client_id": "AppClientIDXXXXXXXXXXXXX",
  "username": "testname"
}

示例2：

{
  "sub": "9ed87b45-da04-4fda-bc74-XXXXXXXXXXXX",
  "aud": "AppClientIDXXXXXXXXXXXXX",
  "email_verified": true,
  "event_id": "469880d0-8b17-417a-88d7-XXXXXXXXXXXX",
  "token_use": "id",
  "auth_time": 1583252488,
  "iss": "https://cognito-idp.us-east-2.amazonaws.com/us-east-2_XXXXXXXX",
  "cognito:username": "testname",
  "exp": 1583256088,
  "iat": 1583252488,
  "email": "testname@mail.no"
}

我的验证码

使用 AWSSDK.CognitoIdentityProvider

services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
     options.TokenValidationParameters = new TokenValidationParameters
     {
         ValidateIssuerSigningKey = true,
         IssuerSigningKeyResolver = (s, securityToken, identifier, parameters) =>
         {
             var json = new WebClient().DownloadString(parameters.ValidIssuer + "/.well-known/jwks.json");
             return JsonConvert.DeserializeObject<JsonWebKeySet>(json).Keys;
         },
         ValidateIssuer = true,
         ValidIssuer = $"https://cognito-idp.{region}.amazonaws.com/{poolId}",
         ValidateAudience = true,
         ValidAudience = appClientId,
     };
});

使用 Amazon.Extensions.CognitoAuthentication

services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
     options.Audience = appClientId;
     options.Authority = $"https://cognito-idp.{region}.amazonaws.com/{poolId}";
});

如何获取有效的 JWT 令牌？如何正确验证token？

更新：在示例 1 中，如果我将 ValidateAudience 设置为 false 并删除 ValidAudience，则会收到 401 错误

var initiateAuthRequest = new InitiateAuthRequest()
    {
        ClientId = myClientId,
        AuthFlow = AuthFlowType.USER_PASSWORD_AUTH,
    };
initiateAuthRequest.AuthParameters.Add("USERNAME", user.Username);
initiateAuthRequest.AuthParameters.Add("PASSWORD", user.Password);
var authResponse = await _cognitoIdentityProvider.InitiateAuthAsync(initiateAuthRequest);

我的 Startup.cs 是

var provider = new AmazonCognitoIdentityProviderClient(new EnvironmentVariablesAWSCredentials(), myRegion);
var userPool = new CognitoUserPool(myPool, myClient, provider);
var usr = new CognitoUser(user.Username, myClient, userPool, provider);
AuthFlowResponse authResponse = await usr.StartWithSrpAuthAsync(
    new InitiateSrpAuthRequest(){Password = user.Password}).ConfigureAwait(false);

Answer 1

这对我来说很有效，我使用 id 令牌而不是访问令牌

public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        }).AddJwtBearer(options =>
        {
            options.TokenValidationParameters = GetCognitoTokenValidationParams();
        });
    }

    private TokenValidationParameters GetCognitoTokenValidationParams()
    {
        var cognitoIssuer = $"https://cognito-idp.{Configuration["AWS:Region"]}.amazonaws.com/{Configuration["AWS:UserPoolId"]}";
        var jwtKeySetUrl = $"{cognitoIssuer}/.well-known/jwks.json";
        var cognitoAudience = Configuration["AWS:UserPoolClientId"];

        return new TokenValidationParameters
        {
            IssuerSigningKeyResolver = (s, securityToken, identifier, parameters) =>
            {
                // get JsonWebKeySet from AWS
                var json = new WebClient().DownloadString(jwtKeySetUrl);
                return JsonConvert.DeserializeObject<JsonWebKeySet>(json).Keys;
            },
            ValidIssuer = cognitoIssuer,
            ValidateIssuerSigningKey = true,
            ValidateIssuer = true,
            ValidateLifetime = true,
            ValidAudience = cognitoAudience
        };
    }