Repository navigation
Multiple jwt authentication schemes can't validate signature key #26002
Description
Describe the bug
When using multiple jwt authentication schemes, the last scheme always falls in 401 with Bearer error="invalid_token", error_description="The signature key was not found" and Bearer error="invalid_token", error_description="The signature is invalid" x2 in 3 separate WWW-Authenticate headers.
To Reproduce
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddJwtBearer(ConfigureJwtBearer.CreateJwtBearer(env, settings, "authority 1"))
.AddJwtBearer("Staging", ConfigureJwtBearer.CreateJwtBearer(env, settings, "authority 2"))
.AddJwtBearer("Prod",ConfigureJwtBearer.CreateJwtBearer(env, settings, "authority 3"));
services.AddAuthorization(options =>
{
var defaultAuthorizationPolicyBuilder = new AuthorizationPolicyBuilder(
JwtBearerDefaults.AuthenticationScheme,
"Staging", "Prod");
defaultAuthorizationPolicyBuilder =
defaultAuthorizationPolicyBuilder.RequireAuthenticatedUser();
options.DefaultPolicy = defaultAuthorizationPolicyBuilder.Build();
}); public static Action<JwtBearerOptions> CreateJwtBearer(IHostEnvironment env, AuthenticationSettings settings,
string authority)
{
return options =>
{
options.Authority = authority;
options.RequireHttpsMetadata = settings.RequireHttpsMetadata;
options.TokenValidationParameters = new TokenValidationParameters
{
NameClaimType = "sub",
ValidateIssuer = true,
ValidateAudience = false,
ValidateLifetime = true,
RequireSignedTokens = true,
ValidateIssuerSigningKey = true
};
};
}The first two schemes work but the Prod scheme doesn't. If I put the Prod scheme before the Staging scheme, Prod works and Staging doesn't.
Exceptions (if any)
Further technical details
- ASP.NET Core version 3.1.401
Activity
bernard-arnaud commentedon Sep 17, 2020
In debug console I have this error :
blowdart commentedon Sep 17, 2020
@HaoK does multiple auth of the same type fail fast, or would removing the default scheme work (and adding a default challenge to have challenge work?)
bernard-arnaud commentedon Sep 21, 2020
Removing the default scheme and replacing it by a challenge still produces the error, if that's what you mean.
HaoK commentedon Sep 21, 2020
Multiple schemes of the same name will fail fast, that's the only thing we guard against. In this case, they are called Dev/Staging/Prod so they are all logically different. You are allowed to have 3 JwtBearers configured.
bernard-arnaud commentedon Sep 22, 2020
The problem was caused by an internal package which had the wrong version of Microsoft.AspNetCore.Authentication.JwtBearer in its dependencies.
Using Microsoft.AspNetCore.Authentication.JwtBearer in 3.1.7 worked.
Thank you for your time, closing this issue.