【Azure Developer】如何验证 Azure AD的JWT Token (JSON Web 令牌)？

提示：扫一扫查出行
【扫一扫了解最新限行尾号】
复制提示

问题描述

使用微软Azure AD，对授权进行管理。通过所注册应用的OAuth API（https://login.chinacloudapi.cn/{TENANT ID}/oauth2/v2.0/token），已经获取到Token，但是如何在应用端对Token进行验证呢？

问题场景类似于：一个基于 Java 的API服务，使用Azure AD生产的access_token来做为客户端访问API服务的身份验证。

步骤如下：

客户端申请AAD的access_token
客户端在header里添加Authorization参数（值为Bearer <access_token>）访问API
服务端在收到header里的token后，验证此token是否有效。若有效则进行具体的业务数据处理；若无效，则返回认证失败

问题是：在Java代码中如何来验证这个Token是否有效呢？

问题解决

在验证JWT的关键问题中，是需要获取到生产Token时候的公钥密钥。因为 Azure AD 使用一组私钥签署JWT Token访问令牌，并在 JWKS URI 提供相应的公共密钥。

第一步：通过Azure AD的 openid-configuration 终结点，可以获取到 JWKS URI，中国区公用的JWKS URI 为: https://login.partner.microsoftonline.cn/common/discovery/keys ，获取方式见下图：

第二步：在代码中，直接使用JWKS URI来解析公钥密钥，然后生成 RSA256 Algorithm 对象，以下为代码片段：

URL keysURL = new URL("https://login.partner.microsoftonline.cn/common/discovery/keys");
JwkProvider provider = new UrlJwkProvider(keysURL);
Jwk jwk = provider.get(jwt.getKeyId());
Algorithm algorithm = Algorithm.RSA256((RSAPublicKey) jwk.getPublicKey(), null);
algorithm.verify(jwt);

全部的Java 代码：

package jwttest;import java.net.MalformedURLException;
import java.net.URL;
import java.security.interfaces.RSAPublicKey;
import java.util.*;
import com.auth0.jwk.Jwk;
import com.auth0.jwk.JwkException;
import com.auth0.jwk.JwkProvider;
import com.auth0.jwk.UrlJwkProvider;
import com.auth0.jwt.JWT;
import com.auth0.jwt.algorithms.Algorithm;
import com.auth0.jwt.exceptions.SignatureVerificationException;
import com.auth0.jwt.interfaces.DecodedJWT;
import java.util.Scanner;public class Main { public static void main(String[] args) { System.out.println("Start to verify the AAD TOken..."); // Using Scanner for Getting Input from User
Scanner in = new Scanner(System.in); String stoken = in.nextLine();
System.out.println("You entered Token is :: " + stoken); if (stoken.length() < 50) {
stoken = "eyJ0eXAiOiJKV1QiLCJhbGciO......................_-dIQ"; System.out.println("You entered Token is too short, use the default value :: " + stoken);
} DecodedJWT jwt = JWT.decode(stoken); System.out.println("JWT Key ID is : " + jwt.getKeyId()); JwkProvider provider = null;
Jwk jwk = null;
Algorithm algorithm = null; try {
URL keysURL = new URL("https://login.partner.microsoftonline.cn/common/discovery/keys");
provider = new UrlJwkProvider(keysURL);
jwk = provider.get(jwt.getKeyId());
algorithm = Algorithm.RSA256((RSAPublicKey) jwk.getPublicKey(), null);
algorithm.verify(jwt);
// if the token signature is invalid, the method will throw
// SignatureVerificationException System.out.println("JWT Validation completed."); } catch (MalformedURLException e) {
e.printStackTrace();
} catch (JwkException e) {
e.printStackTrace();
} catch (SignatureVerificationException e) { System.out.println(e.getMessage()); }
}
}

需要添加的依赖有(pom.xml):

<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>2.13.0</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>2.13.0</version>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
<version>2.13.0</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>3.16.0</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>jwks-rsa</artifactId>
<version>0.18.0</version>
</dependency>

代码执行结果为：

在上面这段简单的代码中，也先后遇见了启动异常，主要是添加依赖时候少加了 com.fasterxml.jackson.core，并且需要保持版本的一致性。否则，会依次遇见如下错误：

错误一：java.lang.ClassNotFoundException: com.fasterxml.jackson.core.exc.InputCoercionException

Exception in thread "main" java.lang.NoClassDefFoundError: com/fasterxml/jackson/core/exc/InputCoercionException
at com.auth0.jwt.impl.JWTParser.addDeserializers(JWTParser.java:58)
at com.auth0.jwt.impl.JWTParser.<init>(JWTParser.java:24)
at com.auth0.jwt.impl.JWTParser.<init>(JWTParser.java:20)
at com.auth0.jwt.JWTDecoder.<init>(JWTDecoder.java:32)
at com.auth0.jwt.JWT.decode(JWT.java:45)
at blob.Main.main(Main.java:36)
Caused by: java.lang.ClassNotFoundException: com.fasterxml.jackson.core.exc.InputCoercionException
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:583)
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
... 6 more

错误二：java.lang.ClassNotFoundException: com.fasterxml.jackson.core.util.JacksonFeature

Exception in thread "main" java.lang.NoClassDefFoundError: com/fasterxml/jackson/core/util/JacksonFeature
at com.fasterxml.jackson.databind.ObjectMapper.<init>(ObjectMapper.java:673)
at com.fasterxml.jackson.databind.ObjectMapper.<init>(ObjectMapper.java:576)
at com.auth0.jwt.impl.JWTParser.getDefaultObjectMapper(JWTParser.java:64)
at com.auth0.jwt.impl.JWTParser.<init>(JWTParser.java:20)
at com.auth0.jwt.JWTDecoder.<init>(JWTDecoder.java:32)
at com.auth0.jwt.JWT.decode(JWT.java:45)
at blob.Main.main(Main.java:36)
Caused by: java.lang.ClassNotFoundException: com.fasterxml.jackson.core.util.JacksonFeature
at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:583)
at java.base/jdk.internal.loader.ClassLoaders$AppClassLoader.loadClass(ClassLoaders.java:178)
at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
... 7 more

只要在引入 jackson-core，jackson-databind，jackson-annotations 时保持版本一直即可解决以上问题。如本示例中使用的版本为：2.13.0

Java 应用验证Azure AD的 Token演示动画：

参考资料

Azure Active Directory Token Validation in Java Applications ： https://sgonzal.com/2020/04/06/jwt-validation.html#:~:text=Set%20up%20the%20clients%20that%20call%20the%20web,tokens%20issued%20by%20AAD%20in%20a%20Java%20application.

How can I validate an Azure AD JWT Token in Java? : https://stackoverflow.com/questions/60884823/how-can-i-validate-an-azure-ad-jwt-token-in-java