如果范围为graph.microsoft.com，则访问令牌验证失败 [英] Access token validation fails if scope is graph.microsoft.com

问题描述

使用以下网址从AAD接收访问令牌 https://login.microsoftonline.com/gdfdddddd-87dd-497c-b894-xxxxxx/oauth2/v2.0/token

grant_type:client_credentials

client_id:xxxxx-1ff5-4615-8d71-yyyyyy

client_secret:[7aCw] fdsfsfsfds.AC61Fg:cm33

范围: https://vault.azure.net/.default

使用以下代码手动验证了上面收到的令牌& 工作正常

 IConfigurationManager<OpenIdConnectConfiguration> configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>("https://login.microsoftonline.com/TestDomain310320.onmicrosoft.com/v2.0/.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever());
            OpenIdConnectConfiguration openIdConfig = AsyncHelper.RunSync(async () => await configurationManager.GetConfigurationAsync(CancellationToken.None));

            TokenValidationParameters validationParameters =
                new TokenValidationParameters
                {
                    ValidIssuer = "https://sts.windows.net/a3d2bff3-87dd-497c-b894-f63befdd7496/",
                    ValidAudiences = new[] { "https://vault.azure.net" },
                    IssuerSigningKeys = openIdConfig.SigningKeys
                };

            SecurityToken validatedToken;
            JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
            var user = handler.ValidateToken(token, validationParameters, out validatedToken);

修改后的参数 范围: https://graph.microsoft.com/.default &成功接收到AAD令牌，但使用上述代码的令牌验证失败，并显示错误消息"IDX10511:签名验证失败.尝试的密钥:'[PII被隐藏]'".具有上述客户端ID的经过验证的AAD应用具有"user.read/user.read.basicall权限".如果从AAD收到 范围为: https://graph的令牌，为什么令牌验证失败. microsoft.com/.default

观察:

通过 范围收到的令牌: https://vault.azure.net/.默认

     {
       "typ": "JWT",
      "alg": "RS256",
       "x5t": "YMELHT0gvb0mxoSDoYfomjqfjYU",
       "kid": "YMELHT0gvb0mxoSDoYfomjqfjYU"
      }

收到令牌时使用 范围: https://graph.microsoft.com/.default 具有额外的 nonce 属性以避免重播攻击，这是令牌验证失败的原因吗?

   {
     "type": "JWT",
    "nonce": "wCXLm9rF5Nma2S7OswU44uAVRpVbM_20WrWJkqbWe6Y",
    "alg": "RS256",
   "x5t": "YMELHT0gvb0mxoSDoYfomjqfjYU",
   "kid": "YMELHT0gvb0mxoSDoYfomjqfjYU"
 }

请提出建议.

解决方案

您不应该查看或验证未发行给自己的Apis的令牌.预期的接收者，KeyVault和MS Graph将自己进行必要的验证.您应该将这些访问令牌视为不透明的斑点将您塞入对这些Apis的调用中的Authorization标头中.

Api所有者，Graph或KeyVault明天可以更改其中的所有权声明，甚至选择加密其令牌，这样您的代码就会损坏.

您为什么要验证令牌?如果您正在读取应用程序中不属于您的经过验证的Apis令牌作为身份验证的证明，那么您就将自己设置为失败.此外，由于世界上任何可以获取KeyVault或MS图的访问令牌的应用程序都可能会将其传递给您的Apis并对其造成危害，因此这也是一个安全问题.

这里是供参考的讨论-无法验证签名. #609

Received access token from AAD, using below url https://login.microsoftonline.com/gdfdddddd-87dd-497c-b894-xxxxxx/oauth2/v2.0/token

grant_type :client_credentials

client_id :xxxxx-1ff5-4615-8d71-yyyyyy

client_secret:[7aCw]fdsfsfsfds.AC61Fg:cm33

scope : https://vault.azure.net/.default

Validated the above received token using below code manually & it works fine

 IConfigurationManager<OpenIdConnectConfiguration> configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>("https://login.microsoftonline.com/TestDomain310320.onmicrosoft.com/v2.0/.well-known/openid-configuration", new OpenIdConnectConfigurationRetriever());
            OpenIdConnectConfiguration openIdConfig = AsyncHelper.RunSync(async () => await configurationManager.GetConfigurationAsync(CancellationToken.None));

            TokenValidationParameters validationParameters =
                new TokenValidationParameters
                {
                    ValidIssuer = "https://sts.windows.net/a3d2bff3-87dd-497c-b894-f63befdd7496/",
                    ValidAudiences = new[] { "https://vault.azure.net" },
                    IssuerSigningKeys = openIdConfig.SigningKeys
                };

            SecurityToken validatedToken;
            JwtSecurityTokenHandler handler = new JwtSecurityTokenHandler();
            var user = handler.ValidateToken(token, validationParameters, out validatedToken);

Modified parameter Scope:https://graph.microsoft.com/.default & received AAD token successfully but token validation using above code fails with error message "IDX10511: Signature validation failed. Keys tried: '[PII is hidden]'." Verified AAD app with above mentioned client id is having "user.read/user.read.basicall permissions". Why token validation fails if tokens are received from AAD with Scope:https://graph.microsoft.com/.default

Observation:

Token received with scope : https://vault.azure.net/.default

     {
       "typ": "JWT",
      "alg": "RS256",
       "x5t": "YMELHT0gvb0mxoSDoYfomjqfjYU",
       "kid": "YMELHT0gvb0mxoSDoYfomjqfjYU"
      }

While token received with Scope:https://graph.microsoft.com/.default has extra nonce property to avoid replay attack, is it be the reason for token validation failure?

   {
     "type": "JWT",
    "nonce": "wCXLm9rF5Nma2S7OswU44uAVRpVbM_20WrWJkqbWe6Y",
    "alg": "RS256",
   "x5t": "YMELHT0gvb0mxoSDoYfomjqfjYU",
   "kid": "YMELHT0gvb0mxoSDoYfomjqfjYU"
 }

please suggest.

解决方案

You should not be looking into, or validating tokens that were not issued to your own Apis. The intended receiver, KeyVault and MS Graph will do the necessary validation themselves. You should treat these Access Tokens as an opaque blobs that you stuff into the Authorization header in your calls to these Apis.

An Api owner, Graph or KeyVault can tomorrow can change the claims present in them or even choose to encrypt their tokens and your code will break.

Why are you validating tokens? If you are reading validated tokens of Apis that do not belong to you in your applications as a proof of Authentication, then you are setting yourself up for failure. Also its a security concern as any app in the world which can obtain an Access token for KeyVault or MS graph can pass it your Apis and compromise it.

Here is a discussion for reference - Cannot validate signature. #609

这篇关于如果范围为graph.microsoft.com，则访问令牌验证失败的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！