以下代码通过在每次验证this之后的每个请求时下载JWKS来验证JWT令牌
<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Error: expired token or invalid token" require-expiration-time="true" require-scheme="Bearer" require-signed-tokens="true">
<openid-config url="https://IdentityProvider/oidc/.well-known/openid-configuration" />
<audiences>
<audience>aud id</audience>
</audiences>
</validate-jwt>
我的问题是如何从下面的示例链接缓存JWKS以避免每次都下载它,并且没有对JWKS进行硬编码,因为它是定期轮换的。
https://demo.identityserver.io/.well-known/openid-configuration/jwks
https://openid-connect-eu.onelogin.com/oidc/certs
任何代码示例和缓存和验证JWT的链接将不胜感激。
下面似乎相关但不是一个完整的例子。
https://docs.microsoft.com/en-us/azure/api-management/api-management-sample-cache-by-key
更新
为了清楚起见,我想缓存上面链接的JWKS中的内容以提高性能。
如果有帮助,请查看以下示例referred from here!
<policies>
<inbound>
<!-- Add your wcf relay address as the base URL below -->
<set-backend-service base-url="" />
<!-- verify if there is a relaytoken key stored in cache -->
<cache-lookup-value key="@("relaytoken")" variable-name="relaytoken" />
<choose>
<!-- If there is no key stored in cache -->
<when condition="@(!context.Variables.ContainsKey("relaytoken"))">
<set-variable name="resourceUri" value="@(context.Request.Url.ToString())" />
<!-- Retrieve Shared Access Policy key from Name Value store -->
<set-variable name="accessKey" value="{{accessKey}}" />
<!-- Retrieve Shared Access Policy key name from Name Value store -->
<set-variable name="keyName" value="{{accessKeyName}}" />
<!-- Generate the relaytoken key -->
<set-variable name="relaytoken" value="@{
TimeSpan sinceEpoch = DateTime.UtcNow - new DateTime(1970, 1, 1);
string expiry = Convert.ToString((int)sinceEpoch.TotalSeconds + 3600);
string resourceUri = (string)context.Variables["resourceUri"];
string stringToSign = Uri.EscapeDataString (resourceUri) + "\n" + expiry;
HMACSHA256 hmac = new HMACSHA256(Encoding.UTF8.GetBytes((string)context.Variables["accessKey"]));
string signature = Convert.ToBase64String(hmac.ComputeHash(Encoding.UTF8.GetBytes(stringToSign)));
string sasToken = String.Format("SharedAccessSignature sr={0}&sig={1}&se={2}&skn={3}",
Uri.EscapeDataString(resourceUri), Uri.EscapeDataString(signature), expiry, context.Variables["keyName"]);
return sasToken;
}" />
<!-- Store the relaytoken in the cache -->
<cache-store-value key="relaytoken" value="@((string)context.Variables["relaytoken"])" duration="10" />
</when>
</choose>
<!-- If the operation request uses json format, convert it to XML - Azure Relay expects XML format (based on WCF) -->
<set-body template="liquid">
<!-- set your body transformation here -->
</set-body>
<!-- Create the ServiceBusAuthorization header using the relaytoken as value -->
<set-header name="ServiceBusAuthorization" exists-action="override">
<value>@((string)context.Variables["relaytoken"])</value>
</set-header>
<!-- Set the content type to application/xml -->
<set-header name="Content-Type" exists-action="override">
<value>application/xml</value>
</set-header>
<base />
</inbound>
<backend>
<base />
</backend>
<outbound>
<!-- If the operation responses uses json format, convert it from XML - Azure Relay will return XML format (based on WCF) -->
<set-body template="liquid">
<!-- set your body transformation here -->
</set-body>
<!-- Set the content type to application/json -->
<set-header name="Content-Type" exists-action="override">
<value>application/json</value>
</set-header>
</outbound>
<on-error>
<base />
</on-error>
</policies>
Azure API Management服务使用资源URL作为密钥(https://github.com/toddkitta/azure-content/blob/master/articles/api-management/api-management-sample-cache-by-key.md)内置了对HTTP响应缓存的支持。你可以做的是将openid-config url设置为一个操作并自己控制缓存。另一种方法可以是引入自己的缓存服务。
APIM不会为每个请求下载open id配置。如果我没记错的话,它会每小时定期下载,缓存和自动刷新。