JWT Validation with Microsoft IdentityModel
I am trying to test the following test JWT selected key 'private' and I can test it with confidence at https://jwt.io
eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIyNzFjNmFkYjNhYTk1YTIxZWI3ZTljMTE2OGViNjI2YiIsImlhdCI6MTQ5MDE5NzQ2MCwibmJmIjoxNDkwMTk3NDYwLCJleHAiOjE0OTAyMDEwNjAsIklwIjoiNzkuMjMxLjczLjE1NCIsIk1lbWJlcklkIjoxfQ.P3m7RkXJ9TUiUFJ2bbtiyoL7OXaD7ITq_LsWMCRJj04
It looks like Microsoft changed the JwtSecurityTokenhandler () class and the documentation isn't really up to date. I checked several tutorials and gitpages I was using new InMemorySymetricSecurityKey()
, but this class is no longer present.
Nuget package: Install-Package System.IdentityModel.Tokens.Jwt (version 5.1.3).
I created a simple console application and I tried to validate the given JWT, but I don't know how I should specify the TokenValidationParameters.
static void Main(string[] args)
{
var key = "private";
var jwt = "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJqdGkiOiIyNzFjNmFkYjNhYTk1YTIxZWI3ZTljMTE2OGViNjI2YiIsImlhdCI6MTQ5MDE5NzQ2MCwibmJmIjoxNDkwMTk3NDYwLCJleHAiOjE0OTAyMDEwNjAsIklwIjoiNzkuMjMxLjczLjE1NCIsIk1lbWJlcklkIjoxfQ.P3m7RkXJ9TUiUFJ2bbtiyoL7OXaD7ITq_LsWMCRJj04";
var tokenHandler = new JwtSecurityTokenHandler();
var securityToken = tokenHandler.ReadToken(jwt);
var validationParameters = new TokenValidationParameters {IssuerSigningKey = new InMemorySymetricSecurityKey()};
SecurityToken validated;
tokenHandler.ValidateToken(jwt, validationParameters, out validated);
Console.WriteLine(validated.ToString());
}
source to share
[Cm. update below]
It depends on who signed the JWT token. Typically, the authorization server issuing the token will publish metadata with the public key of its credentials.
Your code can load metadata and use the public key to validate the token. For example, Azure AD publishes its signatures here .
You can use this code to validate a JWT token issued by Azure AD.
var jwtToken = "<JWT TOKEN>";
var url = "https://login.windows.net/common/federationmetadata/2007-06/federationmetadata.xml";
var serializer = new MetadataSerializer();
MetadataBase metadata = serializer.ReadMetadata(XmlReader.Create(url));
var entityDescriptor = (EntityDescriptor)metadata;
var securityTokens = new List<X509SecurityToken>();
var descriptor = entityDescriptor.RoleDescriptors.OfType<SecurityTokenServiceDescriptor>().First();
var x509DataClauses = descriptor.Keys.Where(key => key.KeyInfo != null &&
(key.Use == KeyType.Signing || key.Use == KeyType.Unspecified))
.Select(key => key.KeyInfo.OfType<X509RawDataKeyIdentifierClause>().First());
securityTokens.AddRange(x509DataClauses.Select(token => new X509SecurityToken(new X509Certificate2(token.GetX509RawData()))));
var validationParameters = new TokenValidationParameters
{
IssuerSigningTokens = securityTokens,
CertificateValidator = X509CertificateValidator.ChainTrust,
};
SecurityToken validatedToken;
ClaimsPrincipal claimsPrincipal = tokenHandler.ValidateToken(jwtToken, validationParameters, out validatedToken);
UPDATE:
I misread your question and missed you by specifying the literal symmetric key value. You should use SymmetricSecurityKey
like this:
HMACSHA256 hmac = new HMACSHA256(Encoding.ASCII.GetBytes(key));
var validationParameters = new TokenValidationParameters
{
IssuerSigningKey = new SymmetricSecurityKey(hmac.Key);
};
source to share