使用公共/专用密钥而不是共享机密的IdentityServer客户端身份验证 [英] IdentityServer client authentication with public/private keys instead of shared secrets
问题描述
我正在尝试使用公钥/私钥,而不是IdentityServer4的客户端机密使用共享机密. 此处记录了这种方法.
I'm trying to use public/private keys instead of a shared secret for client secrets with IdentityServer4. This approach is documented here.
如果它是一个共享机密,则请求将包含纯文本中的secret
.例如
If it was a shared secret, the request would contain the secret
in plain text. e.g.
curl -X POST \
http://<identityserver>/connect/token \
-F client_id=abc \
-F client_secret=secret \
-F grant_type=client_credentials \
-F scope=api1 api2
我的问题是:应使用公钥/私钥身份验证方法作为secret
传递什么?
My question is: What should be passed in as the secret
with the public/private key authentication method?
为了提供一些背景知识,使用公共/密钥身份验证的客户端将通过以下步骤向IdentityServer 注册
To give some background, a Client using public/key authentication will register with IdentityServer with the following steps
-
客户端生成一个
.crt
文件,例如
// create key
$ openssl genrsa -des3 -passout pass:x -out client.pass.key 2048
$ openssl rsa -passin pass:x -in client.pass.key -out client.key
// create certificate request (csr)
$ openssl req -new -key client.key -out client.csr
// create certificate (crt)
$ openssl x509 -req -sha256 -days 365 -in client.csr -signkey client.key -out client.crt
// export pfx file from key and crt
$ openssl pkcs12 -export -out client.pfx -inkey client.key -in client.crt
客户端将与IdentityServer共享client.crt
文件
IdentityServer将通过以下方式注册客户端
IdentityServer will register the Client by
var client = new Client
{
ClientId = "abc",
ClientSecrets =
{
new Secret
{
Type = IdentityServerConstants.SecretTypes.X509CertificateBase64,
Value = "MIIDF...." <================= contents of the crt file
}
},
AllowedGrantTypes = GrantTypes.ClientCredentials,
AllowedScopes = { "api1", "api2" }
};
推荐答案
这要归功于IdentityServer4中的单元测试!
Figured this out thanks to the unit tests in IdentityServer4!
在使用公共/私人身份验证时,不使用client_secret
.而是使用client_assertion
,它是JWT令牌.
When using public/private authentication, client_secret
is not used. Rather, a client_assertion
is used, which is a JWT token.
这是令牌请求的示例代码. client.pfx
是从问题中上面的步骤生成的证书捆绑包.
Here is sample code for the token request. client.pfx
is the certificate bundle generated from the steps above in the question.
var now = DateTime.UtcNow;
var clientId = "abc";
var tokenEndpoint = "http://localhost:5000/connect/token";
var cert = new X509Certificate2("client.pfx", "1234");
// create client_assertion JWT token
var token = new JwtSecurityToken(
clientId,
tokenEndpoint,
new List<Claim>
{
new Claim("jti", Guid.NewGuid().ToString()),
new Claim(JwtClaimTypes.Subject, clientId),
new Claim(JwtClaimTypes.IssuedAt, now.ToEpochTime().ToString(), ClaimValueTypes.Integer64)
},
now,
now.AddMinutes(1),
new SigningCredentials(
new X509SecurityKey(cert),
SecurityAlgorithms.RsaSha256
)
);
var tokenHandler = new JwtSecurityTokenHandler();
var tokenString = tokenHandler.WriteToken(token);
// token request - note there's no client_secret but a client_assertion which contains the token above
var requestBody = new FormUrlEncodedContent(new Dictionary<string, string>
{
{"client_id", clientId},
{"client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"},
{"client_assertion", tokenString},
{"grant_type", "client_credentials"},
{"scope", "api1 api2"}
});
var client = new HttpClient();
var response = await client.PostAsync(tokenEndpoint, requestBody);
var tokenRespone = new TokenResponse(await response.Content.ReadAsStringAsync());
这篇关于使用公共/专用密钥而不是共享机密的IdentityServer客户端身份验证的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!