signature=7db5437b326fdc6e2b4c8035139002f8,openid - Signed JWT rejected: Invalid signature

最新推荐文章于 2023-04-24 12:13:29 发布

郝培强

最新推荐文章于 2023-04-24 12:13:29 发布

阅读量1.2k

点赞数

文章标签： signature=7db5437b326fdc6e2b4c8035139002f8

该博客内容描述了一个单元测试用例，其中尝试使用NimbusJwtDecoder解码两个JWT（访问令牌和身份ID令牌）。在解码访问令牌时遇到问题，抛出了一个`JwtException`，详细错误信息指出签名无效。测试用例在`test()`方法中解码访问令牌失败，在`test1()`方法中解码身份ID令牌成功。

摘要由CSDN通过智能技术生成

Hi Folks, here is how to reproduce:

This UT, has two signatures... test() .. the access token fails ... test1() ... the id token passes (or did when I ran the test :)

The issues is repeatable. Same happens if you post into https://jwt.io/ debugger.

Steve

package com.kloudspot.licensing;

import org.junit.jupiter.api.Test;

import org.springframework.security.oauth2.jwt.Jwt;

import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;

import org.springframework.security.oauth2.jwt.NimbusJwtDecoder.JwkSetUriJwtDecoderBuilder;

public class JwtTest {

static String sampleAccess = "eyJ0eXAiOiJKV1QiLCJub25jZSI6ImZGLWpjTTkxejQ0MG9VVjJucnE0cUx5bjhVU3NITk9wT29RZ1pXbUZhcjQiLCJhbGciOiJSUzI1NiIsIng1dCI6IllNRUxIVDBndmIwbXhvU0RvWWZvbWpxZmpZVSIsImtpZCI6IllNRUxIVDBndmIwbXhvU0RvWWZvbWpxZmpZVSJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTAwMDAtYzAwMC0wMDAwMDAwMDAwMDAiLCJpc3MiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC8zMTJkMzM5Yi1iY2U1LTRiMzItOGNkZS1iY2I2N2UzZDgzNDQvIiwiaWF0IjoxNTg1MTU2MjQyLCJuYmYiOjE1ODUxNTYyNDIsImV4cCI6MTU4NTE2MDE0MiwiYWNjdCI6MCwiYWNyIjoiMSIsImFpbyI6IkFXUUFtLzhQQUFBQU5iNllIMzNPd0FzalFxVEJqbzNhYkFIbC8yWFA0STdVYTdmZVlMeVlCSHpmbTNzSmV2S0Rhbk8xWWppQjZUdzN6SzIrMjZEaVRaVU9KUkdIaXVTeUsxT3ZNTVo1VTI2dnU2VkhDSzJsck1kNGpUaEtCaFdZRW9zc0lYK0J2UG5pIiwiYWx0c2VjaWQiOiI1OjoxMDAzQkZGRDlCNzkyQjVCIiwiYW1yIjpbInB3ZCJdLCJhcHBfZGlzcGxheW5hbWUiOiJLbG91ZHNwbyBBcHAiLCJhcHBpZCI6IjkwMTc1NTk3LTMxZDUtNGUzNy1iNjM2LWJmZmZjMDA0MWMxYiIsImFwcGlkYWNyIjoiMCIsImVtYWlsIjoic3RldmVAa2xvdWRzcG90LmNvbSIsImZhbWlseV9uYW1lIjoiSmVybWFuIiwiZ2l2ZW5fbmFtZSI6IlN0ZXZlIiwiaWRwIjoiaHR0cHM6Ly9zdHMud2luZG93cy5uZXQvMjgxZGU4NTktYzcyYS00YjU4LThlZjMtNDMwZDAwZGQ1ZjQzLyIsImlwYWRkciI6IjY1LjE5MC4zOS4yMzMiLCJuYW1lIjoic3RldmVAa2xvdWRzcG90LmNvbSIsIm9pZCI6ImZiMDA4NGMzLWI3NjYtNDczMy04MzgzLTJjMmM3YzFlYWIyMiIsInBsYXRmIjoiNSIsInB1aWQiOiIxMDAzMjAwMDkwRkY0NUI2Iiwic2NwIjoiRGlyZWN0b3J5LkFjY2Vzc0FzVXNlci5BbGwgVXNlci5SZWFkIHByb2ZpbGUgb3BlbmlkIGVtYWlsIiwic2lnbmluX3N0YXRlIjpbImttc2kiXSwic3ViIjoibEFDalFkVlBhSThGVFp4SFNZaXZCNGxPRGRiQjNTeVJMNjNpdnk4QXFGcyIsInRpZCI6IjMxMmQzMzliLWJjZTUtNGIzMi04Y2RlLWJjYjY3ZTNkODM0NCIsInVuaXF1ZV9uYW1lIjoic3RldmVAa2xvdWRzcG90LmNvbSIsInV0aSI6Ilp1cmxxWXQyREU2UjFyT192X3FJQUEiLCJ2ZXIiOiIxLjAiLCJ4bXNfc3QiOnsic3ViIjoiQ3o5YUVzS3loREIzQTU4cFhCRnJBeC13Rk5pTFFUOUd3ZGs4UDl5a1NZcyJ9LCJ4bXNfdGNkdCI6MTU3NjA5NDc1OH0.ma94q-4TkeAjRZgyL9DbR-WOzH4KseC31lMRB_gRk-zD6zb3staGZ-yrNjpBYfrSGtg70T1b3au1_3ve4M1v_4HGTFXg1QPfauYPHYdU0DmvseCCCyWavEz9q5jw5RJaRVIt_1vza90eSUaL5lI40XQhmTzx4atcB8tg2ErNY0XMhXUB94S5XZo284fQHimbQPsQ4FkMYOvkF0IwXJV_xp6XBWDzcHlVg5532kucj6WzyPxyrI81Cx-IbkNkBQ0UyhpDRvPkGLgR28MDGXyvVO6SwAhdolFD36N7ydb1Flk9QKev2TwFfNihkUazIAZtXlvX4WIJGHhNmZCGcJPgpg" ;

static String sampleId = "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiIsImtpZCI6IllNRUxIVDBndmIwbXhvU0RvWWZvbWpxZmpZVSJ9.eyJhdWQiOiI5MDE3NTU5Ny0zMWQ1LTRlMzctYjYzNi1iZmZmYzAwNDFjMWIiLCJpc3MiOiJodHRwczovL2xvZ2luLm1pY3Jvc29mdG9ubGluZS5jb20vMzEyZDMzOWItYmNlNS00YjMyLThjZGUtYmNiNjdlM2Q4MzQ0L3YyLjAiLCJpYXQiOjE1ODUxNTYyNDIsIm5iZiI6MTU4NTE1NjI0MiwiZXhwIjoxNTg1MTYwMTQyLCJhaW8iOiJBV1FBbS84UEFBQUEwVGVVcGhnQmVMOHdsRWtsKzE5MHpxM1hsL1M2TWtmV0tnelhiZ3N5SEVueVNUOGtDWWwzazdsbDBlNWNMNytybGc3VktIVGNrMzc3M2ZYalEyY2NrZWR6R2dtbEFxQWw5eE9PTEM0UGx5eThqaTRQME5Iem5ZZ1FIRXJYaGRUWCIsImF0X2hhc2giOiJYbklaWW1jc2YxYWpHVDNNTDctRjhRIiwiZW1haWwiOiJzdGV2ZUBrbG91ZHNwb3QuY29tIiwiZmFtaWx5X25hbWUiOiJKZXJtYW4iLCJnaXZlbl9uYW1lIjoiU3RldmUiLCJpZHAiOiJodHRwczovL3N0cy53aW5kb3dzLm5ldC8yODFkZTg1OS1jNzJhLTRiNTgtOGVmMy00MzBkMDBkZDVmNDMvIiwibmFtZSI6InN0ZXZlQGtsb3Vkc3BvdC5jb20iLCJub25jZSI6Ik9XNXlNblJyVVhkMmMwTk5ZekZNYXpCU0xYUlpUVTlaWWt4M1ZWOS1UMFk0TFd0QlgyaFpNVzlSYm5wSyIsIm9pZCI6ImZiMDA4NGMzLWI3NjYtNDczMy04MzgzLTJjMmM3YzFlYWIyMiIsInByZWZlcnJlZF91c2VybmFtZSI6InN0ZXZlQGtsb3Vkc3BvdC5jb20iLCJzdWIiOiJDejlhRXNLeWhEQjNBNThwWEJGckF4LXdGTmlMUVQ5R3dkazhQOXlrU1lzIiwidGlkIjoiMzEyZDMzOWItYmNlNS00YjMyLThjZGUtYmNiNjdlM2Q4MzQ0IiwidXRpIjoiWnVybHFZdDJERTZSMXJPX3ZfcUlBQSIsInZlciI6IjIuMCJ9.R3RGx6u_Ojt4b6AWmGagSd3eJH36sVgEGcBg133pYr_JFHP4TPbEeAMQc99PaiYJD145Hp9zKEty68TrXidZkAWb6TIttwUroecQjoSCE9S8tFxreVX8X-pqx4fWoepJKNr2DYmFzzji1-uXqmdsW_l5qDNeElJiL3rRCnUPsu1ICnNDXyDkIQVjBmsopwn0RHNdQ_uiteJLIoGTuR4Pi9mvJ1-B1Pu8cEp7yMJTJGA0iPEENDs_v6rVzyumG9rzTVzqVL2hN_aXV8eZUWaHpb8fJPrHJxgLpbVAZfsu5N1M8ihpyiU_1ZUu6n5ii9PrsD0MYgIRUZFIGp10W7ecxw" ;

@Test

public void test() {

JwkSetUriJwtDecoderBuilder tt = NimbusJwtDecoder.withJwkSetUri("https://login.microsoftonline.com/organizations/discovery/v2.0/keys");

NimbusJwtDecoder aa = tt.build();

Jwt jj = aa.decode(sampleAccess);

}

@Test

public void test1() {

JwkSetUriJwtDecoderBuilder tt = NimbusJwtDecoder.withJwkSetUri("https://login.microsoftonline.com/organizations/discovery/v2.0/keys");

NimbusJwtDecoder aa = tt.build();

Jwt jj = aa.decode(sampleId);

}

The failure is:

org.springframework.security.oauth2.jwt.JwtException: An error occurred while attempting to decode the Jwt: Signed JWT rejected: Invalid signature

at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.createJwt(NimbusJwtDecoder.java:159)

at org.springframework.security.oauth2.jwt.NimbusJwtDecoder.decode(NimbusJwtDecoder.java:125)

at com.kloudspot.licensing.JwtTest.test(JwtTest.java:19)

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at org.junit.platform.commons.util.ReflectionUtils.invokeMethod(ReflectionUtils.java:675)

at org.junit.jupiter.engine.execution.MethodInvocation.proceed(MethodInvocation.java:60)

at org.junit.jupiter.engine.execution.InvocationInterceptorChain$ValidatingInvocation.proceed(InvocationInterceptorChain.java:125)

at org.junit.jupiter.engine.extension.TimeoutExtension.intercept(TimeoutExtension.java:132)

at org.junit.jupiter.engine.extension.TimeoutExtension.interceptTestableMethod(TimeoutExtension.java:124)

at org.junit.jupiter.engine.extension.TimeoutExtension.interceptTestMethod(TimeoutExtension.java:74)

at org.junit.jupiter.engine.execution.ExecutableInvoker$ReflectiveInterceptorCall.lambda$ofVoidMethod$0(ExecutableInvoker.java:115)

at org.junit.jupiter.engine.execution.ExecutableInvoker.lambda$invoke$0(ExecutableInvoker.java:105)

at org.junit.jupiter.engine.execution.InvocationInterceptorChain$InterceptedInvocation.proceed(InvocationInterceptorChain.java:104)

at org.junit.jupiter.engine.execution.InvocationInterceptorChain.proceed(InvocationInterceptorChain.java:62)

at org.junit.jupiter.engine.execution.InvocationInterceptorChain.chainAndInvoke(InvocationInterceptorChain.java:43)

at org.junit.jupiter.engine.execution.InvocationInterceptorChain.invoke(InvocationInterceptorChain.java:35)

at org.junit.jupiter.engine.execution.ExecutableInvoker.invoke(ExecutableInvoker.java:104)

at org.junit.jupiter.engine.execution.ExecutableInvoker.invoke(ExecutableInvoker.java:98)

at org.junit.jupiter.engine.descriptor.TestMethodTestDescriptor.lambda$invokeTestMethod$6(TestMethodTestDescriptor.java:202)