brunobritodev
commented
6 months ago Hello @Jogai,
Could you provide more insights into your specific use case or objective?
Security.Jwt is designed for generating JWTs (jws, jwe) using a public key cryptosystem. In other hand Security.JwtExtensions was designed to validate jwt issued by third-party systems, leveraging the jwks uri for this purpose.
Security.Jwt package also includes its extensions for validating tokens it has generated itself.
In the code snippet you've shared, I noticed the usage of both Security.Jwt and Security.JwtExtensions:
builder.Services.AddJwksManager()
.UseJwtValidation(); // <-- Security.Jwtoptions.SetJwksOptions(
new JwkOptions // <-- Security.JwtExtensions
{
Audience = "audience", Issuer = "https://keycloak.myProduct.eu/realms/myProduct",
JwksUri = "https://keycloak.myProduct.eu/realms/myProduct/protocol/openid-connect/certs",
KeepFor = TimeSpan.FromHours(1)
});From my experience, integrating both of these components into the same project can lead to unexpected behaviors. This is because they alter the JWT validation process in different ways, potentially causing compatibility issues. For instance, one extension might modify the validation logic in a manner that inadvertently breaks the functionality provided by the other.
To avoid such complications, it might be beneficial to assess whether both packages are necessary for your project. If your requirements are met by generating and validating JWTs within the same ecosystem, sticking to Security.Jwt and its validation extensions. However, if you need to validate JWTs from external sources, use Security.JwtExtensions instead.
However if you really need both, let me know
Jogai
The validation keeps throwing "IDX10500: Signature validation failed. No security keys were provided to validate the signature."
This one is really baffling to me. I tried everything I could find, but what seems to be fairly simple is really hard to get working. Although it should be simple, your library is seemingly the only one that implements the whole 'validate against a jwksuri' -case.
Locally this works fine. The problem is that the container (based on 'mcr.microsoft.com/dotnet/aspnet:8.0') deployed will not work.
dotnet minimal api setup:
log:
cat /root/.aspnet/DataProtection-Keys/key-e92cdd27-bdba-48e6-a9f5-3dc207e-12223.xml