SecurityTokenValidated回調是否使用Owin Middleware自動驗證令牌

我正在使用Azure廣告並設置我的Startup.Auth.cs文件如下我能夠連接並使用Azure，Google，MS和Linked in來成功進行身份驗證，並且我收到了id_token回來，但我希望能夠驗證我從Azure收到的此令牌，但我不確定如何操作。提出的SecurityTokenValidated事件是否意味着令牌已經根據我定義的TokenValidationParameters進行了驗證，我不需要驗證該令牌？如果是這種情況，我應該在TokenValidationParameters中輸入什麼內容？SecurityTokenValidated回調是否使用Owin Middleware自動驗證令牌

我接收回來的id_token不包含加密的簽名來驗證

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType); 

      app.UseCookieAuthentication(new CookieAuthenticationOptions 
       { 
        SlidingExpiration = true, 
        LoginPath = new PathString("/"), 
        CookieSecure = CookieSecureOption.Always, 


       }); 

      var options = new OpenIdConnectAuthenticationOptions 
      { 

       Authority = "https://login.windows.net/common", 
       ClientId = clientId, 
       RedirectUri = redirectUri, 
       PostLogoutRedirectUri = postLogoutRedirectUri, 
       Notifications = new OpenIdConnectAuthenticationNotifications 
       { 

        AuthenticationFailed = AuthenticationFailed, 
        RedirectToIdentityProvider = OnRedirectToIdentityProvider, 
        SecurityTokenReceived = OnSecurityTokenReceived, 
        AuthorizationCodeReceived = OnAuthorizationCodeReceived, 
        SecurityTokenValidated = OnSecurityTokenValidated, 
        MessageReceived = OnMessageReceived 
       }, 
       Scope = "openid", 
       ResponseType = "id_token", 
       Description = new AuthenticationDescription 
       { 

        AuthenticationType = "OpenIdConnect", 
             }, 

       ConfigurationManager = new PolicyConfigurationManager(
        string.Format(CultureInfo.InvariantCulture, aadInstance, tenant, "/v2.0", OidcMetadataSuffix), 
        new[] { SisuGoogle, SisuLinkedIn, SisuMicrosoft, SisuLocal, ResetPasswordLocalPolicyId }), 


       TokenValidationParameters = new TokenValidationParameters 
       { 
        ValidAudiences = new string[] 
        { 
        "http://localhost:44330/", 


        }, 
        IssuerSigningKey = GetSecurityKey(), 
        // If you don't add this, you get IDX10205 
        //ValidateIssuer = false, 
       }, 
      }; 

      app.UseOpenIdConnectAuthentication(options); 



private SecurityKey GetSecurityKey() 
     { 
      var securityKey = "secure key"; 
      var signingKey = new InMemorySymmetricSecurityKey(Encoding.UTF8.GetBytes(securityKey)); 
      var signingCredentials = new SigningCredentials(signingKey, SecurityAlgorithms.RsaSha256Signature,SecurityAlgorithms.Sha256Digest); 
      return signingCredentials.SigningKey; 
     } 


    private Task OnSecurityTokenValidated(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> arg) 
      { 


//do I need to validate the token here or has it already been validated?? 

//if I have to validate it then how do I? I've tried the following but does not work 
       var tokenValidationParameters = new TokenValidationParameters 
       { 
        IssuerSigningKey = GetSecurityKey() 
       }; 

       SecurityToken validatedToken; 
       var jwtHandler = new JwtSecurityTokenHandler(); 


    //crashes at this point 
       jwtHandler.ValidateToken(arg.ProtocolMessage.IdToken, tokenValidationParameters, out validatedToken); 



       return Task.FromResult(0); 
      }

來源

2016-09-06 kurasa

我有同樣的問題。你最終做了什麼？ – Mukus

@Mukus我最終使用密碼學建立了自己的驗證。我已經從那個項目中移出來了。不過，我相信只有在成功驗證令牌後纔會提出回調，這意味着「是」，令牌在此回調提出時已得到驗證。但是，當時我無法找到任何文檔來支持這一點。文檔現在可能已經改變 – kurasa

SecurityTokenValidated回調是否使用Owin Middleware自動驗證令牌

回答

相關問題