OpenIddict 解密密钥失败

Question

正如标题所说，得到：

“IDX10609：解密失败。未尝试任何密钥：令牌：'System.String'。”

尝试进行身份验证时出错。使用 Openiddict 作为身份验证服务器。我确信我在其中或 api 服务器中配置了错误，但我不知道是什么。我一直在尝试不同的组合，但目前却陷入困境。这是身份验证服务器配置：

   public void ConfigureServices(IServiceCollection services) {
            services.AddDbContext<TrustContext>(options =>
            {
                options.UseSqlServer(Configuration.GetConnectionString("Trust"), b => b.MigrationsAssembly("Application.Trust"));
                options.UseOpenIddict();
            });

            services.AddDefaultIdentity<AspNetUsers>()
                .AddEntityFrameworkStores<TrustContext>()
                .AddDefaultTokenProviders();
            services.Configure<IdentityOptions>(options =>
            {
                options.ClaimsIdentity.UserNameClaimType = Claims.Name;
                options.ClaimsIdentity.UserIdClaimType = Claims.Subject;
                options.ClaimsIdentity.RoleClaimType = Claims.Role;
            });

            services.AddOpenIddict()

                // Register the OpenIddict core components.
                .AddCore(options =>
                {
                    options.UseEntityFrameworkCore()
                           .UseDbContext<TrustContext>();
                   
                })
                .AddServer(options =>
                {
                    options.IgnoreEndpointPermissions()
                            .IgnoreGrantTypePermissions()
                            .IgnoreScopePermissions();
                    // Enable the authorization, logout, token and userinfo endpoints.
                    options.SetAuthorizationEndpointUris("/connect/authorize")
                           .SetLogoutEndpointUris("/connect/logout")
                           .SetTokenEndpointUris("/connect/token")
                           .SetUserinfoEndpointUris("/connect/userinfo");
                    options.RegisterScopes(Scopes.Email, Scopes.Profile, Scopes.Roles, Scopes.OpenId);
                    options.AllowAuthorizationCodeFlow()
                            .AllowPasswordFlow()
                            .AllowImplicitFlow()
                            .AllowHybridFlow()
                          .AllowRefreshTokenFlow();
                    options.AddDevelopmentEncryptionCertificate()
                           .AddDevelopmentSigningCertificate();
                    options.AcceptAnonymousClients();

                    options.UseAspNetCore()
                           .EnableAuthorizationEndpointPassthrough()
                           .EnableLogoutEndpointPassthrough()
                           .EnableTokenEndpointPassthrough()
                           .EnableUserinfoEndpointPassthrough()
                           .EnableStatusCodePagesIntegration();
                    
                })

                .AddValidation(options =>
                {
                    options.UseLocalServer();

                    options.UseAspNetCore();
                });

API服务器配置：

  IConfigurationManager<OpenIdConnectConfiguration> configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>($"https://localhost:44395/.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever());
            OpenIdConnectConfiguration openIdConfig = configurationManager.GetConfigurationAsync(CancellationToken.None).Result;

            services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer(options =>
                {
                    options.IncludeErrorDetails = true;
                    options.TokenValidationParameters.ValidateIssuer = true;
                    options.TokenValidationParameters.ValidateAudience = false;
                    options.TokenValidationParameters.ValidateIssuerSigningKey = false;
                    options.TokenValidationParameters.ValidIssuer = "https://localhost:44395";
                    options.TokenValidationParameters.ValidAudiences = new[] { "resource_server_1" };
                    options.TokenValidationParameters.IssuerSigningKeys = openIdConfig.SigningKeys;
                    options.Events = new JwtBearerEvents()
                    {
                        OnAuthenticationFailed = c =>
                        {
                            c.NoResult();

                            c.Response.StatusCode = 500;
                            c.Response.ContentType = "text/plain";


                            return c.Response.WriteAsync("An error occured processing your authentication. " + c.Exception.Message);
                        }
                    };
                });

我已经让它与 keycloak 作为身份验证服务器一起工作，但是当我切换到 OpenIddict 时，我最终遇到了上述错误。我想我可能缺少签名密钥或者我的配置/客户端配置有问题？

Answer 1

在 OpenIddict 3.0 中，访问令牌默认是加密的。要修复您看到的错误，您可以：

• 在 JWT 处理程序选项 ( ) 中注册加密密钥options.TokenValidationParameters.TokenDecryptionKey。

• 禁用访问令牌加密：

services.AddOpenIddict()
    .AddServer(options =>
    {
        options.DisableAccessTokenEncryption();
    });

注意：在 3.0 中，推荐的选项是使用 OpenIddict 验证处理程序，而不是 Microsoft 开发的 JWT 处理程序。