How to Validate Apigee Edge generated JWT Token from .NET/C# code?

Question

I have created a proxy in Apigee Edge to Generate JWT token. I have created another proxy in Apigee Edge Validate the JWT token, and I am able to Validate using that. Now I am unable to Validate the JWT Token completely from .NET/C# code.

Below is the .NET code I tried:

private static bool ValidateToken(string authToken, string key)
{
    var tokenHandler = new JwtSecurityTokenHandler();
    var validationParameters = GetValidationParameters(key);
    SecurityToken validatedToken;
    IPrincipal principal = tokenHandler.ValidateToken(authToken, validationParameters, out validatedToken);
    return true;
}

private static TokenValidationParameters GetValidationParameters(string key)
{
    return new TokenValidationParameters()
    {
        ValidateLifetime = false, // Because there is no expiration in the generated token
        ValidateAudience = false, // Because there is no audiance in the generated token
        ValidateIssuer = false,   // Because there is no issuer in the generated token
        ValidIssuer = "urn:apigee-edge-JWT-policy-test",
        ValidAudience = "audience1",
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("key")) // The same key as the one that generate the token
    };
}

And the JWT Generation Policy Code from Apigee Edge:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<GenerateJWT async="false" continueOnError="false" enabled="true" name="Generate-JWT-1">
    <DisplayName>Generate JWT-1</DisplayName>
    <Algorithm>HS256</Algorithm>
    <SecretKey>
        <Value ref="private.key"/>
    </SecretKey>
    <Subject>subject-subject</Subject>
    <Issuer>urn://apigee-edge-JWT-policy-test</Issuer>
    <Audience>audience1,audience2</Audience>
    <ExpiresIn>8h</ExpiresIn>
    <AdditionalClaims>
        <Claim name="userId" type="string" ref="request.formparam.username"/>
    </AdditionalClaims>
    <OutputVariable>jwt-variable</OutputVariable>
</GenerateJWT>

Here is the error message:

Microsoft.IdentityModel.Tokens.SecurityTokenInvalidSignatureException: IDX10503: Signature validation failed. Keys tried: 'Microsoft.IdentityModel.Tokens.SymmetricSecurityKey, KeyId: '', InternalId: '96edcecb-17ad-4022-a50b-558f426ed337'. , KeyId: '. Exceptions caught: 'System.ArgumentOutOfRangeException: IDX10603: Decryption failed. Keys tried: 'HS256'. Exceptions caught: '128'. token: '96' Parameter name: KeySize at Microsoft.IdentityModel.Tokens.SymmetricSignatureProvider..ctor(SecurityKey key, String algorithm, Boolean willCreateSignatures) at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateSignatureProvider(SecurityKey key, String algorithm, Boolean willCreateSignatures) at Microsoft.IdentityModel.Tokens.CryptoProviderFactory.CreateForVerifying(SecurityKey key, String algorithm) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(Byte[] encodedBytes, Byte[] signature, SecurityKey key, String algorithm, TokenValidationParameters validationParameters) at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.ValidateSignature(String token, TokenValidationParameters validationParameters) '.........

@cyptus Here it is: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJzdWJqZWN0LXN1YmplY3QiLCJhdWQiOlsiYXVkaWVuY2UxIiwiYXVkaWVuY2UyIl0sImlzcyI6InVybjpcL1wvYXBpZ2VlLWVkZ2UtSldULXBvbGljeS10ZXN0IiwiZXhwIjoxNTY1MTgwNDA5LCJ1c2VySWQiOiIxOTgxMzciLCJpYXQiOjE1NjUxNTE2MDksImp0aSI6IjE4OWY1NzBkLTNlMzQtNDRiMS04NWI3LWRmYzBiMTFmZjk3YyJ9.FiGy7tRbyGg4TOe-hczU2utph5ksmtXu-fsOa6dodXQ — Abhinaba Nag, Aug 07 '19 at 06:54
seems okay, i only see your issuer is not matching the one out of the token (missing "//"). — cyptus, Aug 07 '19 at 07:01
i think your key is not long enough: Exceptions caught: '128'. token: '96' Parameter name: KeySize - can you try a longer key? — cyptus, Aug 07 '19 at 07:11
Appreciate your input @cyptus. Key Size was the issue. Thanks a lot! — Abhinaba Nag, Aug 07 '19 at 08:09

score 1 · Answer 1 · answered Aug 07 '19 at 08:12

1

IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("key"))

In the above code, the size of the "key" value was smaller than expected.

answered Aug 07 '19 at 08:12

Abhinaba Nag

57
10

score 0 · Accepted Answer · answered Aug 07 '19 at 08:11

0

Your keysize is not long enough like the exception mentions:

Exceptions caught: '128'. token: '96' Parameter name: KeySize

use a longer key that matches the excepted size

answered Aug 07 '19 at 08:11

cyptus

3,346
3
31
52

How to Validate Apigee Edge generated JWT Token from .NET/C# code?

2 Answers2