使用 AzukeKeyVault 密钥签署 JWT答案

【问题标题】：Signing JWT with AzukeKeyVault Key使用 AzukeKeyVault 密钥签署 JWT
【发布时间】：2021-06-10 11:31:14
【问题描述】：

我必须使用存储在 AzukeKeyVault 中的密钥对 JWT 进行签名，但很难让它工作，我迄今为止使用的解决方案不起作用或正在使用 Secrets 而不是密钥来存储 RSA 密钥（除非我' m 错了，RSA 密钥应该存储为 Secret？）

        JwtSecurityToken jwt = new JwtSecurityToken(jwtHeader, jwtPayload);
        string encodedJwt = jwt.EncodedHeader + "." + jwt.EncodedPayload;
        byte[] encodedJwtBytes = Encoding.UTF8.GetBytes(encodedJwt);
        KeyOperationResult signature = await keyVaultClient.SignAsync(keyId, "RS256", new SHA256CryptoServiceProvider().ComputeHash(encodedJwtBytes));
        string jwtString = encodedJwt + "." + Base64UrlEncoder.Encode(signature.Result);

【问题讨论】：

正常情况下，我们应该使用azure key vault key来签署jwt。能否请您提供错误消息？

标签： c# .net azure azure-functions azure-keyvault

【解决方案1】：

如果要签署 jwt，我们应该使用 azure key vault key。具体怎么做，请参考以下代码

创建服务主体。
为 sp 配置访问策略
代码

           #create rsa key
            var clientId = "42e0d080-****c522d988c4";
            var secret = "Gbx2eK64i***.ClJDfQpIjoae:";
            var tenant = "e4c9ab4e-bd2***0ba2a757fb";
            var creds = new ClientSecretCredential(tenant, clientId, secret);
            var keyClient = new KeyClient(new Uri("https://jimkey02.vault.azure.net/"), creds);
            string rsaKeyName = "testkey";
            var rsaKey = new CreateRsaKeyOptions(rsaKeyName, hardwareProtected: false)
            {
                KeySize = 2048,
            };
            await keyClient.CreateRsaKeyAsync(rsaKey);
            
            #sign
             var claimsToSign = new[]
            {
              new Claim("sub", "1234567890"),
              new Claim("name", "John Doe")
            };

            var token = new JwtSecurityToken(

                claims: claimsToSign
            );

            var header = Base64UrlEncoder.Encode(JsonConvert.SerializeObject(new Dictionary<string, string>()
            {
                  {JwtHeaderParameterNames.Alg, "RS256" },
                  {JwtHeaderParameterNames.Typ, "JWT"}
             }));

            var byteData = Encoding.UTF8.GetBytes(header + "." + token.EncodedPayload);
            var hasher = new SHA256CryptoServiceProvider();
            var digest = hasher.ComputeHash(byteData);
             KeyVaultKey key = await keyClient.GetKeyAsync(rsaKeyName);
            var cryptClient = new CryptographyClient(key.Id, creds);
            var signature = await cryptClient.SignAsync("RS256", digest);
            var fullJwt = $"{header}.{token.EncodedPayload}.{Base64UrlEncoder.Encode(signature.Signature)}";
            Console.WriteLine(fullJwt);

            var kid = key.Key.Id.Substring(key.Key.Id.LastIndexOf('/') + 1);

            var jsonString = JsonConvert.SerializeObject(key.Key);
            var jk = new Microsoft.IdentityModel.Tokens.JsonWebKey(jsonString)
            {
                Kid = kid
            };

【讨论】：