如何获得“x5t"的值?使用证书凭据进行应用程序身份验证 [英] How to obtain value of "x5t" using Certificate credentials for application authentication
本文介绍了如何获得“x5t"的值?使用证书凭据进行应用程序身份验证的处理方法,对大家解决问题具有一定的参考价值,需要的朋友们下面随着小编来一起学习吧!
问题描述
I was trying to obtain JWT token from Microsoft Azure Active Directory using Certificate credentials for application authentication.
I am struck at figuring out the value of "x5t".
I have tried with
- SHA-1 fingerprint value available in the public certificate.
- SHA-1 hash of the public certificate using FVIC.
But i keep getting below error when send the request to MSA login endpoint
{
"error": "invalid_client",
"error_description": "AADSTS70002: Error validating credentials. AADSTS50012: Client assertion contains an invalid signature. [Reason - The key was not found., Thumbprint of key used by client: '6F67F76B96F6FBBDF9D3EE1DDF7F9A7B877EE9C75DEDBD3DE9C7FB', Configured keys: [Key0:Start=06/01/2018, End=12/31/2099, Thumbprint=6WGktXA64QmA9TPv;Key1:Start=06/01/2018, End=12/31/2099, Thumbprint=rD9Q10sR6Q6ZkDVw;]]
Trace ID: d9e3e276-e878-4b8a-b08b-10c82a0b0600
Correlation ID: 48ec889d-2376-45a6-9bf0-01b22b0e0c17
Timestamp: 2018-06-01 09:38:24Z",
"error_codes": [
70002,
50012
],
"timestamp": "2018-06-01 09:38:24Z",
"trace_id": "d9e3e276-e878-4b8a-b08b-10c82a0b0600",
"correlation_id": "48ec889d-2376-45a6-9bf0-01b22b0e0c17"
}
How to obtain the value for "x5t" ?
解决方案
I found this site and this one invaluable for solving the x5t issue. The easiest way to do it is to manually get the fingerprint:
echo $(openssl x509 -in your.cert.pem -fingerprint -noout) | sed 's/SHA1 Fingerprint=//g' | sed 's/://g' | xxd -r -ps | base64
the value from the above command is the value you put in the x5t field in the JWT. Prior to that I was getting invalid fingerprint error from azure.
If you're using Ruby you can follow this answer to get:
p12 = OpenSSL::PKCS12.new(File.read(CERT_FILE), '')
x509_sha1_thumbprint = Base64.encode64(OpenSSL::Digest::SHA1.new(p12.certificate.to_der).to_s.upcase.scan(/../).map(&:hex).pack("c*")).strip
jwt_token = JWT.encode payload, p12.key, 'RS256', { typ: 'JWT', x5t: x509_sha1_thumbprint }
这篇关于如何获得“x5t"的值?使用证书凭据进行应用程序身份验证的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!
查看全文