在 .Net 中将 Google 帐户实施为 Open ID Connect

Question

我正在尝试根据 google 提供的以下链接使用 .Net 实施 Google 帐户作为 Open ID Connect 身份提供商：

Google OIDC EndPoints

我在 Startup/Program.cs 中添加了以下内容：

var configurationGoogle = new OpenIdConnectConfiguration()
{
    Issuer = "https://accounts.google.com",
    AuthorizationEndpoint = "https://accounts.google.com/o/oauth2/v2/auth",
    TokenEndpoint = "https://oauth2.googleapis.com/token",
    UserInfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo",
    JwksUri = "https://www.googleapis.com/oauth2/v3/certs",
    RegistrationEndpoint = "https://oauth2.googleapis.com/revoke",
};
builder.Services.AddAuthentication(options =>
{
    // options.DefaultSignInScheme = "Cookies";
    // options.DefaultAuthenticateScheme = "Cookies";
    // options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
    options.DefaultScheme = OpenIdConnectDefaults.AuthenticationScheme;
}).AddCookie().AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme,
    options =>
    {
        // options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters()
        // {
        //     RequireExpirationTime = false,
        //     ValidateLifetime = false,
        //     RequireSignedTokens = false,
        //     ValidateIssuerSigningKey = false,
        //     ValidateAudience = false,
        //     ValidateIssuer = false,
        //     RequireAudience = false,
        // };
        options.ClientId = "********.apps.googleusercontent.com";
        options.ClientSecret = "******";
        options.Configuration = configurationGoogle;
        options.SignInScheme = "Cookies";
        options.CallbackPath = new PathString("/signin-google");
        options.Scope.Add("openid");
        options.Scope.Add("email");
        options.Scope.Add("profile");
        options.SaveTokens = true;
        options.ResponseType = OpenIdConnectResponseType.Code;
        options.Events.OnAuthorizationCodeReceived = ctx =>
        {
            Console.WriteLine(@"Code:{0}", ctx.ProtocolMessage.Code);                    
            return Task.CompletedTask;
        };
        options.Events.OnTokenResponseReceived = ctx =>
        {
            Console.WriteLine("I am executing!");
            Console.WriteLine(@"Access Token:{0}", ctx.TokenEndpointResponse.AccessToken);
            List<AuthenticationToken> tokens = ctx.Properties!.GetTokens().ToList();
            tokens.Add(new AuthenticationToken()
            {
                Name = "TicketCreated",
                Value = DateTime.UtcNow.ToString()
            });
            tokens.Add(new AuthenticationToken()
            {
                Name = "access_token",
                Value = ctx.TokenEndpointResponse.AccessToken,
            });

            tokens.Add(new AuthenticationToken()
            {
                Name = "refresh_token",
                Value = ctx.TokenEndpointResponse.RefreshToken,
            });
            ctx!.Properties!.StoreTokens(tokens);
            return Task.CompletedTask;
        };
        options.Events.OnUserInformationReceived = ctx =>
        {
            Console.WriteLine(ctx.User);
            return Task.CompletedTask;
        };
    }
); 

然后尝试挑战它，重定向后它给我以下错误：

An unhandled exception occurred while processing the request.
SecurityTokenSignatureKeyNotFoundException: IDX10501: Signature validation failed. Unable to match key:
kid: 'System.String'.
Exceptions caught:
'System.Text.StringBuilder'.
token: 'System.IdentityModel.Tokens.Jwt.JwtSecurityToken'.

Microsoft.IdentityModel.Tokens.InternalValidators.ValidateLifetimeAndIssuerAfterSignatureNotValidatedJwt(SecurityToken securityToken, Nullable<DateTime> notBefore, Nullable<DateTime> expires, string kid, TokenValidationParameters validationParameters, StringBuilder exceptionStrings)

正如我认为的，我们在 OIDC 中使用代码并且我们不需要验证令牌（我们没有它，但我们这里有 access_token！）并且只有在 OAuth 2.0 中我们才应该验证它。但顺便说一句，它给了我错误。我在这个过程中哪里错了？ 应该注意的是，我同时获得了 access_token 和 refresh_token 以及 OnTokenResponseReceived 事件中的代码，如果它没有抛出错误，我可以根据 Open ID Connect 执行我的身份验证过程，然后将它们与 Cookie 一起保留以供下次使用。我如何防止这种情况错误，我对 OpenIDConnect 的看法是否正确，我们可能不会验证令牌？！

Answer 1

OpenID Connect 有一个需要验证的 ID 令牌。根据 OpenID 规范，我们应该使用 RS256 算法对其进行验证，该算法需要来自发行者的公钥。此公钥 ID 应从 ID 令牌标头中指定的孩子的 JwksUri 获取。如果在 OIDC 选项中使用元数据，此步骤会自动执行。但是，如果像我们在这个问题中那样使用配置，我们应该在选项令牌验证参数中手动指定此键，如下所示：

var GoogleCertsExpected = new JsonWebKeySet();
GoogleCertsExpected.Keys.Add(
     new JsonWebKey
     {
         Alg = "RS256",
         E = "AQAB",
         Kty = "RSA",
         Kid = "58b429662db0786f2efefe13c1eb12a28dc442d0",
         N = "xszAZmDzaUa5d8anZL6ZExj0YNiUVZqzFxWQGKT3fPw5N5lKb_eVtxFKFjgyfOx8Lm1NbVIFVBNTGFsd42MMSU-CrEMMsWe3WTgSzwCmW4t5XE__y1b7MkUTd4WkSzgifMok_SD4D8x-Gd1-awC6nLu0bEbqLWcaXtwfogDiO2nMTgQcuVBGH3ZA-sS7ASgNK-3bNM0mXeVvaIzRPAahZ9tzJ_CEj8mrDVdmgSsO42PTnYtfQc1nytLwNX19_92HQAvWLtQ3-zjZ0FlJUGFTUui8whktgRXv2eXyp-bNkprD7HORUjzCU0Ugwq-nfa1zyYrBDpwQ8FVnS6opUK7iAQ",
         Use = "sig",
     });
GoogleCertsExpected.Keys.Add(
     new JsonWebKey
     {
         Alg = "RS256",
         E = "AQAB",
         Kty = "RSA",
         Kid = "cec13debf4b96479683736205082466c14797bd0",
         N = "1YWUM8Y5UExSfXsBrF6oACI48nITxDf07CiYKn_VTbLRlpXX1AfNtQhrjm-jPjC16qXnGCBhdlZHdCycfezoMg8svo41U7YIVLP5G5H6f7VxAEglmV5IGc0kj35__qmqy3t1Eug_iqxCOyRlcDELQ75MNOhYFQtjeEtLuw4ErpPpOeYVX71vOH3Q9epItMM0n18FXW5Dd6BkCiHvMkb5eSHOH07J0h-MkRF133R-YSPPgDlqLeRxdjDo2rwqKFsOa68edzconVcETWR2YSoFtangVd-IBhzFrax8gyVsntKpmbg8XyJZU2vtgMiTdP0wAjAe8gy78Dg1WIOVOe58lQ",
         Use = "sig",
     });

options.MetadataAddress = "https://accounts.google.com/.well-known/openid-configuration";


options.TokenValidationParameters = new TokenValidationParameters
        {
          IssuerSigningKeys = GoogleCertsExpected.Keys,
        };

我们还可以在选项事件中更动态地执行此操作，如下所示：

options.Events.OnMessageReceived = async messageReceivedContext =>
    {
        var options = messageReceivedContext.Options;
        if (options.TokenValidationParameters.ValidIssuer == null || options.TokenValidationParameters.IssuerSigningKeys == null)
        {
            var credentials = await options.Backchannel.GetFromJsonAsync<GoogleKeys>(options.Configuration!.JwksUri, new JsonSerializerOptions { PropertyNameCaseInsensitive = true, });
          
            options.TokenValidationParameters.IssuerSigningKeys = credentials.Keys;
            options.TokenValidationParameters.ValidIssuer = options.Authority;
        }
    };

其中 GoogleKeys 是定义如下的类：

public class GoogleKeys
    {
        public IEnumerable<JsonWebKey> Keys { get; set; }
    }