通过 JWT 令牌在 Azure API 管理中进行授权

Posted 2023-03-10

【中文标题】通过 JWT 令牌在 Azure API 管理中进行授权

【英文标题】：Authorization in Azure API management through JWT token

【发布时间】：2019-07-16 13:15:49

【问题描述】：

我编写了一个入站策略，它启用 CORS 并针对授权服务器验证访问令牌。以下策略运行良好：

<policies>
    <inbound>
        <!-- Extract Token from Authorization header parameter -->
        <set-variable name="token" value="@(context.Request.Headers.GetValueOrDefault("Authorization","scheme param").Split(' ').Last())" />
        <!-- Send request to Token Server to validate token (see RFC 7662) -->
        <send-request mode="new" response-variable-name="tokenstate" timeout="20" ignore-error="true">
            <set-url>https://sso-dev.shell.com/as/introspect.oauth2</set-url>
            <set-method>POST</set-method>
            <set-header name="Content-Type" exists-action="override">
                <value>application/x-www-form-urlencoded</value>
            </set-header>
            <set-body>@($"grant_type=urn:pingidentity.com:oauth2:grant_type:validate_bearer&client_id=UnitsOfMeasure&client_secret=somesecret&token=(string)context.Variables["token"]")</set-body>
        </send-request>
        <cors>
            <allowed-origins>
                <origin>*</origin>
            </allowed-origins>
            <allowed-methods>
                <method>*</method>
            </allowed-methods>
            <allowed-headers>
                <header>*</header>
            </allowed-headers>
            <expose-headers>
                <header>*</header>
            </expose-headers>
        </cors>
        <choose>
            <when condition="@((bool)((IResponse)context.Variables["tokenstate"]).Body.As<JObject>()["active"] == false)">
                <!-- Return 401 Unauthorized with http-problem payload -->
                <return-response response-variable-name="existing response variable">
                    <set-status code="401" reason="Unauthorized" />
                    <set-header name="WWW-Authenticate" exists-action="override">
                        <value>Bearer error="invalid_token"</value>
                    </set-header>
                </return-response>
            </when>
        </choose>
        <base />
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
        <set-header name="Access-Control-Allow-Origin" exists-action="override">
            <value>*</value>
        </set-header>
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

现在我添加一个条件，授权用户仅在属于某个组时才使用 PUT、POST 或 DELETE 方法：

    <when condition="@(new [] "post=""", "put=""", "delete=""".Contains(context.Request.Method,StringComparer.OrdinalIgnoreCase))">
        <validate-jwt header-name="Authorization">
            <required-claims>
                <claim name="groups">
                    <value>UOM WriteAdmin</value>
                </claim>
            </required-claims>
        </validate-jwt>
    </when>

但我在保存策略时遇到以下错误：

One or more fields contain incorrect values:
Error in element 'choose' on line 28, column 10: Syntax error, ',' expected

我不确定出了什么问题。这是合并授权逻辑后的最终策略：

<policies>
    <inbound>
        <!-- Extract Token from Authorization header parameter -->
        <set-variable name="token" value="@(context.Request.Headers.GetValueOrDefault("Authorization","scheme param").Split(' ').Last())" />
        <!-- Send request to Token Server to validate token (see RFC 7662) -->
        <send-request mode="new" response-variable-name="tokenstate" timeout="20" ignore-error="true">
            <set-url>https://sso-dev.shell.com/as/introspect.oauth2</set-url>
            <set-method>POST</set-method>
            <set-header name="Content-Type" exists-action="override">
                <value>application/x-www-form-urlencoded</value>
            </set-header>
            <set-body>@($"grant_type=urn:pingidentity.com:oauth2:grant_type:validate_bearer&client_id=UnitsOfMeasure&client_secret=somesecret&token=(string)context.Variables["token"]")</set-body>
        </send-request>
        <cors>
            <allowed-origins>
                <origin>*</origin>
            </allowed-origins>
            <allowed-methods>
                <method>*</method>
            </allowed-methods>
            <allowed-headers>
                <header>*</header>
            </allowed-headers>
            <expose-headers>
                <header>*</header>
            </expose-headers>
        </cors>
        <choose>
            <when condition="@((bool)((IResponse)context.Variables["tokenstate"]).Body.As<JObject>()["active"] == false)">
                <!-- Return 401 Unauthorized with http-problem payload -->
                <return-response response-variable-name="existing response variable">
                    <set-status code="401" reason="Unauthorized" />
                    <set-header name="WWW-Authenticate" exists-action="override">
                        <value>Bearer error="invalid_token"</value>
                    </set-header>
                </return-response>
            </when>
            <when condition="@(new [] "post=""", "put=""", "delete=""".Contains(context.Request.Method,StringComparer.OrdinalIgnoreCase))">
                <validate-jwt header-name="Authorization">
                    <required-claims>
                        <claim name="groups">
                            <value>UOM WriteAdmin</value>
                        </claim>
                    </required-claims>
                </validate-jwt>
            </when>            
        </choose>
        <base />
    </inbound>
    <backend>
        <base />
    </backend>
    <outbound>
        <base />
        <set-header name="Access-Control-Allow-Origin" exists-action="override">
            <value>*</value>
        </set-header>
    </outbound>
    <on-error>
        <base />
    </on-error>
</policies>

【参考方案1】：

试试这个：

<when condition="@(new [] "post", "put", "delete".Contains(context.Request.Method, StringComparer.OrdinalIgnoreCase))">

你那里似乎有一些额外的符号。

【讨论】：

你能回答这个问题 - ***.com/questions/54853668/… 吗？