使用 JSON Web Token Handler for .Net 生成带有证书指纹的 JWT

Question

我正在开始一项新任务，我必须处理来自 JWT 的指纹。我们为 Microsoft .Net 框架使用 JSON Web 令牌处理程序。已经有一个在测试中使用的实现，它生成 JWT，而在标头中没有 x5t 文件。它看起来像这样：

var handler = new JwtSecurityTokenHandler();
      var securityKey = new InMemorySymmetricSecurityKey(Any.Array<byte>(1024));
      var desc = new SecurityTokenDescriptor
      {
        TokenIssuerName = "MSI",
        Lifetime = new Lifetime(null, DateTime.UtcNow.AddDays(10)),
        SigningCredentials = new SigningCredentials(securityKey, "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256", "http://www.w3.org/2001/04/xmlenc#sha256"),
      };

      var identity = new ClaimsIdentity();
      identity.AddClaim(new Claim("scope", "msi_unsapi_presence.watch"));
      identity.AddClaim(new Claim("scope", "msi_unsapi_location.watch"));
      identity.AddClaim(new Claim("scope", "msi_unsapi_groupmgt.read"));
      identity.AddClaim(new Claim("scope", "msi_unsapi_groupmgt.write"));
      var jwtToken = handler.CreateToken(desc);
      return jwtToken;

它产生的令牌：{"typ":"JWT","alg":"HS256"}.{"scope":["msi_unsapi_presence.watch","msi_unsapi_location.watch","msi_unsapi_groupmgt.read","msi_unsapi_groupmgt.write"]} 我尝试将 SecurityTokenDescriptor 的 AttachedReference 属性设置为以下AttachedReference = new X509ThumbprintKeyIdentifierClause(Any.Array<byte>(1024)) 以在令牌中填充 x5t 字段（我不关心确切的值，我只需要它出于测试目的存在于令牌中）但生成的令牌仍然没有设置此字段。如何在标头中生成非空 x5t 的令牌，最好修改现有代码？

Answer 1

这是您的 customJsonWebTokenFormat 的实现：

您真的可以使用 payload.add() 向其中添加任何内容。

          public class yourJsonWebTokenFormat: ISecureDataFormat<AuthenticationTicket>
            {
                public string Protect(AuthenticationTicket data)
                {
                DateTime notBefore = DateTime.UtcNow;
                DateTime expires = notBefore + TimeSpan.FromHours(1); //validity timer.

         SigningCredentials cred= new SigningCredentials(); // your signing credentials.
                    JwtHeader header = new JwtHeader(cred);
header.add("x5t","your value");
                    JwtPayload payload = newJwtPayload(ConfigurationManager.AppSettings["Issuer"],data.Properties.Dictionary["audience"], data.Identity.Claims, notBefore, expires);
        payload.add("x5t","your x5t to json property");

                    var jwtToken = new JwtSecurityToken(header, payload);
                    var handler = new JwtSecurityTokenHandler();
                    var jwt = handler.WriteToken(jwtToken);
                    return jwt;
                }
    }

然后在您的 OAuth 配置中：

     OAuthAuthorizationServerOptions OAuthServerOptions = new 

    OAuthAuthorizationServerOptions()
                {
    // provider configuration, token authentication expiracy, etc...
Provider = new SampleAuthorizationServerProvider()
                    AccessTokenFormat = new JsonWebTokenFormat()
                };

请求令牌现在将调用您的 yourJsonWebTokenFormat.protect() 方法。

您应该在您自己的 OAuthAuthorizationServerProvider 的 AuthenticationTicket 中设置您在示例中构建的身份。

类似的东西：

        public class SampleAuthorizationServerProvider : OAuthAuthorizationServerProvider, IOAuthAuthorizationServerProvider
        {
           public override Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
                {
        // do AD check or other stuff needed to validate the user here
            var ticket = new AuthenticationTicket(identity, props); // props here is a AuthenticationProperties Dictionnary with other stuff that you want in your JwtToken
    context.Validated(ticket);
        }

        public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
        {
//do some check...
context.Validated();
}
    }

所以你最终需要实现 2 个类：ISecureDataFormat<AuthenticationTicket> 和

OAuthAuthorizationServerProvider, IOAuthAuthorizationServerProvider