18

I am trying to determine if the JwtBearer Service provided for .Net Core 3.0, actually uses the asymettric signing key that is provided by my oidc provider's well known configuration?

I can't find any documentation around this.

.AddJwtBearer(opt =>
{
    opt.Authority = "http://localhost:8180/auth/realms/master";
    opt.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = false,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true
    };

I am using Keycloak 4.8.3 as my oidc provider. The closest documentation I could find was here. https://developer.okta.com/blog/2018/03/23/token-authentication-aspnetcore-complete-guide

The relevant piece is here:

If you let the JwtBearer middleware auto-configure via the discovery document, this all works automatically!

Did that above code do all that? Is this still relevant in 3.0 since we don't register the middleware anymore??

I bet a lot of people don't know about Asymetric Signing keys, and why they are so important. We have abstracted away so much from the developer, that now I don't even know if my api is secure.

So the final question is:

Does the .AddJwtBearer service with "ValidateIssuerSigningKey" periodically check the wellknown or whatever discovery document to grab the latest asymettric signing key?

4 Answers 4

24

I was wondering same - research/debugging showed that JwtBearer indeed trying to contact authority to get public key.

Here is function called during validation :

// System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.cs
   
protected virtual SecurityKey ResolveIssuerSigningKey(string token, JwtSecurityToken jwtToken, TokenValidationParameters validationParameters)
{
    if (validationParameters == null)
        throw LogHelper.LogArgumentNullException(nameof(validationParameters));
    
    if (jwtToken == null)
        throw LogHelper.LogArgumentNullException(nameof(jwtToken));
    
    return JwtTokenUtilities.FindKeyMatch(jwtToken.Header.Kid, jwtToken.Header.X5t, validationParameters.IssuerSigningKey, validationParameters.IssuerSigningKeys);
}

Obviously this logic to contact authority for public key is called only when you set Oauth authority in your configuration:

.AddJwtBearer(opt => {
    opt.Authority = "https://authorityUri/";
});

AddJwtBearer middleware handler internally will add ".well-known/openid-configuration" string to o.Authority and will try to fetch JSON with details of authority server. (Google example: https://accounts.google.com/.well-known/openid-configuration).

Next step - get jwks_uri, (in case of google https://www.googleapis.com/oauth2/v3/certs) and fetch jwks file, which will have data used for signature validation (publicKey, algorithm, initial vector)..

After all this steps, JwtBearer validates token signature.

Just for info - JwtBearer can validate token without authority if you configure it with your own Signing Key issuer, like this:

.AddJwtBearer(opt => {
    opt.TokenValidationParameters.IssuerSigningKey = GetKey();
    //in this case you need to provide valid audience or disable validation
    opt.TokenValidationParameters.ValidateAudience = false
    //in this case you need to provide valid issuer or disable validation
    opt.TokenValidationParameters.ValidateIssuer= false
})

Microsoft.IdentityModel.Tokens.SecurityKey = GetKey() {
    string key = "Secret_Pass";
    return new SymmetricSecurityKey(Encoding.UTF8.GetBytes(key));
}

In this case you need either provide issuer and audience or disable validation. This configuration can be used for B2B cases - server to server communications - when you don't have Oauth server and issue tokens yourself using shared secret.

For the full picture look at this configuration - both authority and issuer key set:

.AddJwtBearer(opt => {
   opt.Authority = "https://authorityUri/";
   opt.TokenValidationParameters.IssuerSigningKey = GetKey();
});

In this case authority will not be touched and your locally generated key will be used to validate token, so priority is TokenValidationParameters.IssuerSigningKey. Means no reason to add Authority.

4
  • I ultimately set up a Charles proxy for the authority and validated it makes all appropriate calls, but not on startup, on first request! Then everytime an invalid token is passed it will check it to see if the authority changed keys Commented Jan 21, 2020 at 19:24
  • Hey people, if we started to "reverse-engineer" it, do you see/know if jwks endpoint response cached? For example in nodeJs, similar middleware (node-jsonwebtoken with node-jwks-rsa) has caching options, like cache age, etc.. I believe JwtBearer should have similar, but don't see options to configure it.. Commented Jan 21, 2020 at 22:20
  • Some really valuable intel in this answer, which is omitted in its entirety in the MSDN docs...
    – Beltway
    Commented Sep 21, 2021 at 14:30
  • I came here from github.com/AzureAD/… Commented Mar 2 at 15:59
7

You don't need to set TokenValidationParameters . If Authority which is the address of the token-issuing authentication server is set correctly , the JWT bearer middleware will use this URI to find and retrieve the public key that can be used to validate the token’s signature. It will also confirm that the iss parameter in the token matches this URI . Middleware will help get keys from the OIDC metadata and cache the keys .

TokenValidationParameters can be used in scenario that you want to validate tokens without access to the issuing server. Instead, you wanted to use a public key that was already present locally to validate incoming tokens.Then you can not set the Authority, setting ValidateIssuerSigningKeyand ValidateIssuer , and finally set IssuerSigningKey which is the public key used for validating incoming JWT tokens.

2
  • while this mostly answers my question. Again, all this seems abstracted. There is no more middleware configuration for jwtbearer in .net core 3.0. Is this still happening? Commented Nov 8, 2019 at 20:51
  • What do you mean by "There is no more middleware configuration for jwtbearer in .net core 3.0" ? The configuration is the same as .net core 2.2 , the source codes are available for you . How validating the jwt token is not changed AFAIK .
    – Nan Yu
    Commented Nov 11, 2019 at 1:37
4

Looking into the source code for AddJwtBearer and based on my experimentation, Authority is only property you need to assign. In this case handler will use

MetadataAddress = $"{Authority}/.well-known/openid-configuration";

to resolve the metadata URL for your realm and download signing keys from there.

1
  • Not only, but it's important to check signature.
    – Ievgen
    Commented Jan 26 at 18:00
2

You can refer to https://zhiliaxu.github.io/how-do-aspnet-core-services-validate-jwt-signature-signed-by-aad.html#configuration to understand how AddJwtBearer() gets the the asymmetric signing key from .well-known/openid-configuration.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.