我正在使用可操作的消息(通过 Outlook Web 应用程序)来调用逻辑应用程序。因此我在请求中得到了一个不记名令牌:
“操作-授权”:“承载者eyJ0eXAi...”
调用堆栈:Outlook web app -> Logic App -> my endpoint hosted in azure
现在我尝试使用 jwt.io 验证令牌,但收到签名无效的问题。
所以我尝试用 c# 来验证它JwtSecurityTokenHandler
.
我尝试添加https://substrate.office.com/sts/
到发行人列表,但似乎验证甚至没有到达那里。
我使用以下代码来验证 Office.com 颁发的 jwt 令牌:
bool IsAuthorized(HttpActionContext actionContext)
{
var valid = base.IsAuthorized(actionContext);
// Custom handle for Bearer token, when invalid from base-class
if (!valid && actionContext.Request.Headers.Authorization.Scheme == "Bearer")
{
var jwt = actionContext.Request.Headers.Authorization.Parameter;
var th = new JwtSecurityTokenHandler();
var sjwt = th.ReadToken(jwt) as JwtSecurityToken;
var validationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = false,
//IssuerSigningToken = sjwt,
ValidateActor = false,
ValidateAudience = false,
ValidateIssuer = true,
ValidateLifetime = true,
ValidIssuers = new[] { "https://substrate.office.com/sts/" },
ValidAudiences = new[] {"https://XXX.logic.azure.com"}
};
SecurityToken validatedToken;
try
{
th.ValidateToken(jwt, validationParameters, out validatedToken);
}
catch (Exception ex)
{
return false;
}
}
return valid;
}
这是我的 JWT 令牌:
我收到异常:
IDX10500: Signature validation failed. Unable to resolve SecurityKeyIdentifier: 'SecurityKeyIdentifier
(
IsReadOnly = False,
Count = 2,
Clause[0] = X509ThumbprintKeyIdentifierClause(Hash = 0x818...),
Clause[1] = System.IdentityModel.Tokens.NamedKeySecurityKeyIdentifierClause
)
', ...
尽管我设定了ValidateIssuerSigningKey = false
.
有没有办法接受https://substrate.office.com/sts/
作为有效的发行人?