UnauthorizedError：jwt受众无效预期：

如何解决UnauthorizedError：jwt受众无效预期：

我正在尝试使用IdentityServer4保护我的nodeAPI。

export const jwtauth = jwt({
  secret: jwksClient.expressJwtSecret({
    cache: true,rateLimit: true,jwksRequestsPerMinute: 2,jwksUri: `${identity_authority}/.well-known/openid-configuration/jwks`
  }),// validate the audience & issuer from received token vs JWKS endpoint
  audience:'projectapi',issuer: `${identity_authority}`,algorithms: ['RS256']
})

我认为我所做的一切都正确，但是当我从Web应用程序调用API时，出现此错误：

UnauthorizedError: jwt audience invalid. expected: projectapi

从我做过的所有研究中，建议将听众更改为aud: 'projectapi'，我尝试过不起作用。

public static IEnumerable<Client> Clients =>
    new Client[]
    {
        new Client
        {
            ClientId = "portal",ClientName = "portal",AllowedGrantTypes = GrantTypes.Implicit,AllowAccessTokensViaBrowser = true,RequireConsent = false,RedirectUris = new List<string> {
                "https://url/oidc-callback","https://url/oidc-silent-renew.html"
            },PostLogoutRedirectUris = { "https://url/logout" },AllowedCorsOrigins = new List<string> { "https://url" },AllowedScopes = new List<string>
            {
                IdentityServerConstants.StandardScopes.OpenId,IdentityServerConstants.StandardScopes.Profile,IdentityServerConstants.StandardScopes.Email,"authenticationapi","projectapi","workflowapi"
            }
        }
    };
    }

public static IEnumerable<ApiScope> ApiScopes =>
            new List<ApiScope>
            {
                       new ApiScope("authenticationapi","Authentication API"),new ApiScope("projectapi","Project API"),new ApiScope("workflowapi","Project Workflow API")
            };

access_token：

{
  "nbf": 1597959828,"exp": 1597960728,"iss": "https://url","aud": "https://url/resources","client_id": "portal","sub": "183d2e05-3c19-44c0-a8c5-bfa29320b10b","auth_time": 1597959828,"idp": "local","email": "[e-mail]","name": "[e-mail]","family_name": "test","given_name": "test","role": "User","jti": "5CD7A8058DAE31615529A0EBCC7334E2","sid": "BA53399482221C789A1BB07F393C2806","iat": 1597959828,"scope": [
    "openid","profile","email","workflowapi","authenticationapi"
  ],"amr": [
    "pwd"
  ]
}

解决方法

您已经创建了API范围，但是我在代码中看不到任何API资源。

请添加一个名为projectapi的API资源。

有关Identityserver4的实现，您可以参考here

public static IEnumerable<APIResource> getApiResource(){
    return new []{
        new APIResource {
            Name = "projectapi",DisplayName = "Api",Description = "your description",Scopes = new List<string> {//add your scopes here},ApiSecrets = new List<Secret> {new Secret("secretpassword".Sha256())},UserClaims = new List<string> {//user claims}
        }
    }
}

还将此资源添加到Startup.cs的内存中：

.AddInMemoryApiResources(//call the function created above);

在添加了所有内存客户端和Api范围的地方添加此行