连接到 Google 的 OWIN OpenID Connect 中间件中的 SecurityTokenSignatureKeyNotFoundException

Question

我们正在使用通用 OpenID Connect 中间件来使用 Google 作为使用 IdentityServer3 的外部身份提供者。我们没有设置 MetadataAddress 或任何特殊的 TokenValidationParameters （所以它应该根据授权获取元数据，然后根据它填写参数，这应该没问题）。我们间歇性地收到以下错误。我提出的其他有此错误的问题似乎涉及不正确的自定义验证并且不是间歇性的。

Authentication Failed : Microsoft.IdentityModel.Protocols.OpenIdConnectMessage : System.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException : IDX10500 : Signature validation failed.Unable to resolve SecurityKeyIdentifier : 'SecurityKeyIdentifier
(
IsReadOnly = False,
Count = 1,
Clause[0] = System.IdentityModel.Tokens.NamedKeySecurityKeyIdentifierClause
)
',
token : '{"alg":"RS256","kid":"74e0db263dbc69ac75d8bf0853a15d05e04be1a2"}.{"iss":"https://accounts.google.com","iat":1484922455,"exp":1484926055, <snip more claims>}'.
at System.IdentityModel.Tokens.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters)in c :  \ workspace \ WilsonForDotNet45Release \ src \ System.IdentityModel.Tokens.Jwt \ JwtSecurityTokenHandler.cs : line 943
at System.IdentityModel.Tokens.JwtSecurityTokenHandler.ValidateToken(String securityToken, TokenValidationParameters validationParameters, SecurityToken & validatedToken)in c :  \ workspace \ WilsonForDotNet45Release \ src \ System.IdentityModel.Tokens.Jwt \ JwtSecurityTokenHandler.cs : line 671
at Microsoft.IdentityModel.Extensions.SecurityTokenHandlerCollectionExtensions.ValidateToken(SecurityTokenHandlerCollection tokenHandlers, String securityToken, TokenValidationParameters validationParameters, SecurityToken & validatedToken)in c :  \ workspace \ WilsonForDotNet45Release \ src \ Microsoft.IdentityModel.Protocol.Extensions \ SecurityTokenHandlerCollectionExtensions.cs : line 71
at Microsoft.Owin.Security.OpenIdConnect.OpenIdConnectAuthenticationHandler. < AuthenticateCoreAsync > d__1a.MoveNext()

所指的kid 目前是https://www.googleapis.com/oauth2/v3/certs 的三个键中的第二个。

我们的选项如下所示：

var options = new OpenIdConnectAuthenticationOptions
                {
                    AuthenticationType = "Google",
                    Caption = "Sign in with Google",
                    Scope = "openid email profile",
                    ClientId = clientId,
                    Authority = "https://accounts.google.com/",
                    AuthenticationMode = AuthenticationMode.Passive,
                    RedirectUri = new Uri(baseUri, "identity/signin-google").ToString(),
                    Notifications = new OpenIdConnectAuthenticationNotifications()
                    {
                        AuthenticationFailed = context => HandleException(context),
                        RedirectToIdentityProvider = context => AddLoginHint(context),
                    },
                    SignInAsAuthenticationType = signInAsType
                };

                app.UseOpenIdConnectAuthentication(options);

这是需要处理的配置问题还是某种暂时性错误（如果需要，如何处理）？最终客户端正在重试一次（尽管我认为它根本没有在等待）但这似乎没有帮助。

Answer 1

这里的问题似乎是由于默认的ConfigurationManager 将结果缓存 5 天，而 Google 更频繁地滚动其密钥（更像是每天）。使用 OWIN 中间件的默认行为，第一个带有无法识别密钥的请求将失败，然后在下一个请求时它会刷新密钥。

解决方案是通过更快的 AutomaticRefreshInterval 传入您自己的 ConfigurationManager。下面的大部分设置都是OpenIdConnectAuthenticationMiddleware

private static void ConfigureIdentityProviders(IAppBuilder app, string signInAsType)
    {
        var baseUri = new Uri("https://localhost:44333");
        var googleAuthority = "https://accounts.google.com/";
        var metadataAddress = googleAuthority + ".well-known/openid-configuration";
        var httpClient = new HttpClient(new WebRequestHandler());
        httpClient.Timeout = TimeSpan.FromMinutes(1);
        httpClient.MaxResponseContentBufferSize = 1024 * 1024 * 10; // 10 MB
        var configMgr = new ConfigurationManager<OpenIdConnectConfiguration>(metadataAddress, httpClient)
                            {
                                // Default is 5 days, while Google is updating keys daily
                                AutomaticRefreshInterval
                                    =
                                    TimeSpan
                                    .FromHours(12)
                            };

        var options = new OpenIdConnectAuthenticationOptions
                          {
                              AuthenticationType = "Google",
                              Caption = "Google",
                              Scope = "openid email profile",
                              ClientId = GoogleClientId,
                              Authority = googleAuthority,
                              ConfigurationManager = configMgr,
                              AuthenticationMode = AuthenticationMode.Passive,
                              RedirectUri =
                                  new Uri(baseUri, "identity/signin-google").ToString(),
                              SignInAsAuthenticationType = signInAsType
                          };

        app.UseOpenIdConnectAuthentication(options);
    }