search

IdentityServer / IdentityServer3.AccessTokenValidation

OWIN Middleware to validate access tokens from IdentityServer3
Apache License 2.0
90 stars 150 forks source link

Is this middleware compatible with current Identity Server 4? #137

Closed fabiodiluca closed 7 years ago

fabiodiluca commented 7 years ago

Hi, i am trying to use this middleware with Identity Server 4 because I can't run migrate to Asp.net Core right now. Is this possible? I am trying but seems middleware is not setting ClaimsPrincipal. I am sure that access token is valid. Is this middleware compatible with current Identity Server 4? If not, what can I use in framework 4.6.1 that makes the same job as this middleware?

fabiodiluca commented 7 years ago

I got what was wrong. Using SetTemporarySigningCredential(); on Identity Server was the problem (I don't know why). To fix that I put the certificate from idsrv3: var cert = new X509Certificate2(Path.Combine(_environment.ContentRootPath, "idsrv3test.pfx"), "idsrv3test"); The IdentityServer3.AccessTokenValidation middleware is now putting ClaimsPrincipal with the client identity! Please, can you explain me why this fails when there is a 'fake' certificate?

brockallen commented 7 years ago

Each time you re-start IS a new key is used. The JWT middleware caches the key materials from the first time it access the metadata (for 24h or until it restarts).

fabiodiluca commented 7 years ago

Thanks for your reply! But that wasn't exactly the problem. I was using some random dev branch. I changed it to IdentityServer4-1.1.1 and the problem was gone. I was aware about the random certificate key. Keep up the good work! Case closed.