0

我在我的 Java 应用程序中实现 jose4j 以验证 Azure 颁发的访问令牌的签名。该应用程序运行良好，但是，我遇到了有关Signing Key rollover的文档。jose4j 在使用时会自动处理它HttpsJwksVerificationKeyResolver吗？

我目前正在使用以下代码段来构建JwtConsumer

String azureKeyDiscoveryUrl =
                "https://login.microsoftonline.com/{my-tenant-id}/discovery/keys";
HttpsJwks azureKeyDiscovery = new HttpsJwks(azureKeyDiscoveryUrl);

HttpsJwksVerificationKeyResolver azureJwksKeyResolver = new HttpsJwksVerificationKeyResolver(azureKeyDiscovery);

JwtConsumer azureJwtConsumer = new JwtConsumerBuilder()
                .setRequireExpirationTime()
                .setAllowedClockSkewInSeconds(30)
                .setRequireIssuedAt()
                .setRequireNotBefore()
                .setVerificationKeyResolver(azureJwksKeyResolver)
                .setExpectedAudience("my-audience")
                .setJwsAlgorithmConstraints(new AlgorithmConstraints(
                        AlgorithmConstraints.ConstraintType.WHITELIST, AlgorithmIdentifiers.RSA_USING_SHA256))
                .build();
JwtClaims claims = azureJwtConsumer.processToClaims("tokenStringHere");
4

1 回答 1

0

是的，假设 Azure 使用https://login.microsoftonline.com/ {my-tenant-id}/discovery/keys 端点做正确/合理的事情，我认为他们会这样做，它会起作用。

于 2019-07-05T17:21:28.850 回答