如何解决UnauthorizedError:jwt受众无效预期:
我正在尝试使用IdentityServer4保护我的nodeAPI。
export const jwtauth = jwt({
secret: jwksClient.expressJwtSecret({
cache: true,rateLimit: true,jwksRequestsPerMinute: 2,jwksUri: `${identity_authority}/.well-known/openid-configuration/jwks`
}),// validate the audience & issuer from received token vs JWKS endpoint
audience:'projectapi',issuer: `${identity_authority}`,algorithms: ['RS256']
})
我认为我所做的一切都正确,但是当我从Web应用程序调用API时,出现此错误:
UnauthorizedError: jwt audience invalid. expected: projectapi
从我做过的所有研究中,建议将听众更改为aud: 'projectapi'
,我尝试过不起作用。
public static IEnumerable<Client> Clients =>
new Client[]
{
new Client
{
ClientId = "portal",ClientName = "portal",AllowedGrantTypes = GrantTypes.Implicit,AllowAccessTokensViaBrowser = true,RequireConsent = false,RedirectUris = new List<string> {
"https://url/oidc-callback","https://url/oidc-silent-renew.html"
},PostLogoutRedirectUris = { "https://url/logout" },AllowedCorsOrigins = new List<string> { "https://url" },AllowedScopes = new List<string>
{
IdentityServerConstants.StandardScopes.OpenId,IdentityServerConstants.StandardScopes.Profile,IdentityServerConstants.StandardScopes.Email,"authenticationapi","projectapi","workflowapi"
}
}
};
}
public static IEnumerable<ApiScope> ApiScopes =>
new List<ApiScope>
{
new ApiScope("authenticationapi","Authentication API"),new ApiScope("projectapi","Project API"),new ApiScope("workflowapi","Project Workflow API")
};
access_token:
{
"nbf": 1597959828,"exp": 1597960728,"iss": "https://url","aud": "https://url/resources","client_id": "portal","sub": "183d2e05-3c19-44c0-a8c5-bfa29320b10b","auth_time": 1597959828,"idp": "local","email": "text@email.com","name": "text@email.com","family_name": "test","given_name": "test","role": "User","jti": "5CD7A8058DAE31615529A0EBCC7334E2","sid": "BA53399482221C789A1BB07F393C2806","iat": 1597959828,"scope": [
"openid","profile","email","workflowapi","authenticationapi"
],"amr": [
"pwd"
]
}
解决方法
您已经创建了API范围,但是我在代码中看不到任何API资源。
请添加一个名为projectapi的API资源。
有关Identityserver4的实现,您可以参考here
public static IEnumerable<APIResource> getApiResource(){
return new []{
new APIResource {
Name = "projectapi",DisplayName = "Api",Description = "your description",Scopes = new List<string> {//add your scopes here},ApiSecrets = new List<Secret> {new Secret("secretpassword".Sha256())},UserClaims = new List<string> {//user claims}
}
}
}
还将此资源添加到Startup.cs的内存中:
.AddInMemoryApiResources(//call the function created above);
在添加了所有内存客户端和Api范围的地方添加此行
版权声明:本文内容由互联网用户自发贡献,该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容, 请发送邮件至 dio@foxmail.com 举报,一经查实,本站将立刻删除。