使用签名的 jwt 令牌连接开发人员苹果商店连接

Question

我正在使用http://jwt.io 站点中提供的 jose 库，我正在尝试使用此库创建 jwt 令牌，但生成的令牌在粘贴到 http://jwt.io 站点时以及在尝试 curl apple developer connect 401 未授权响应时显示无效签名！我不知道是什么导致了这个问题。

// Create the Claims, which will be the content of the JWT
        JwtClaims claims = new JwtClaims();
        claims.setIssuer("69a6de78-7188-47e3-e053-5b8c7c11a4d1");  // who creates the token and signs it
        claims.setAudience("appstoreconnect-v1"); // to whom the token is intended to be sent
        claims.setExpirationTimeMinutesInTheFuture(20); // time when the token will expire (10 minutes from now)
        claims.setIssuedAtToNow();
        claims.setGeneratedJwtId(); // a unique identifier for the token
     // Generate an EC key pair, which will be used for signing and verification of the JWT, wrapped in a JWK
        EllipticCurveJsonWebKey senderJwk = EcJwkGenerator.generateJwk(EllipticCurves.P256);
        // Give the JWK a Key ID (kid), which is just the polite thing to do
        senderJwk.setKeyId("-----BEGIN PRIVATE KEY-----\n" + 
                "*******************" + 

                "-----END PRIVATE KEY-----");
       // So we first create a JsonWebSignature object.
        JsonWebSignature jws = new JsonWebSignature();
        // The payload of the JWS is JSON content of the JWT Claims
        jws.setPayload(claims.toJson());
        // The JWT is signed using the sender's private key
        jws.setKey(senderJwk.getPrivateKey());
        // Set the Key ID (kid) header because it's just the polite thing to do.
        // We only have one signing key in this example but a using a Key ID helps
        // facilitate a smooth key rollover process
        jws.setKeyIdHeaderValue(senderJwk.getKeyId());
        // Set the signature algorithm on the JWT/JWS that will integrity protect the claims
        jws.setAlgorithmHeaderValue(AlgorithmIdentifiers.ECDSA_USING_P256_CURVE_AND_SHA256);
        jws.setHeader("typ","jwt");
        // Sign the JWS and produce the compact serialization, which will be the inner JWT/JWS
        // representation, which is a string consisting of three dot ('.') separated
        // base64url-encoded parts in the form Header.Payload.Signature
        String outJwt = jws.getCompactSerialization();
        // Now you can do something with the JWT. Like send it to some other party
        // over the clouds and through the interwebs.
        System.out.println("JWT: " + outJwt);

curl -v -H '授权：承载 [签名令牌]' "https://api.appstoreconnect.apple.com/v1/apps"

Answer 1

我不熟悉该库，但看起来您每次运行代码时都在使用一个新的、随机生成的密钥对令牌进行签名：

EllipticCurveJsonWebKey senderJwk = EcJwkGenerator.generateJwk(EllipticCurves.P256);

您似乎还将密钥 ID 设置为 base-64 编码的私钥（可能是您打算使用的私钥？）。密钥 ID 不是密钥，它只是可用于在密钥存储中查找它的东西，例如（According to Apple，他们的 API 的密钥 ID 应该是“来自 App Store Connect 的您的私钥 ID” )。

所以我猜你收到“无效签名”错误的原因是因为你每次都用一个新密钥对令牌进行签名，而不是你用来验证它的那个。