OpenIdConnectHandler can't decrypt token with RSA-OAEP-256 and A128GCM
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 5h
- Merged PRs (30d)
- 276
Description
### Is there an existing issue for this?
- [x] I have searched the existing issues
### Describe the bug
```
Platform: macOS Sequoia Version 15.3
Chip: Apple M2 Max
.NET version: 6 and 8 (read below for more information)
Relevant packages: Microsoft.AspNetCore.Authentication.OpenIdConnect v6.0.36 and v8.0.13
```
I'm trying to connect and authenticate users through an OIDC server. I'm getting a valid ID-token in response from the OIDC server. However, I'm struggling with getting decryption of the token to work.
Relevant OIDC setup code:
```cs
var privateKey = new JsonWebKey(File.ReadAllText("private-key.json"));
.AddOpenIdConnect("oidc", config =>
{
config.ResponseType = "code";
config.TokenValidationParameters = new TokenValidationParameters
{
TokenDecryptionKeys = new[] { privateKey }
};
// Given this is .NET 8, you can fallback to this one here. When using .NET 6, it's already the default
// config.UseSecurityTokenValidator = true;
config.Scope.Clear();
config.Scope.Add("openid");
config.Scope.Add("profile");
config.UsePkce = true;
config.SaveTokens = true;
config.GetClaimsFromUserInfoEndpoint = true;
});
```
If I use .NET 6, I'm guessing the `SecurityTokenValidator` will be used, and I get the following error message:
```
IDX10609: Decryption failed. No Keys tried: token: ''.
```
If I use .NET 8, the `JsonWebTokenHandler` is used by default, and I get the following error message (which makes sense, since that was changed in .NET 7 or 8:
```
IDX10618: Key unwrap failed using decryption Keys: 'Microsoft.IdentityModel.Tokens.JsonWebKey, Use: 'enc', Kid: '', Kty: 'RSA', InternalId: ''.
'.
Exceptions caught:
''.
token: ''.
```
I'm not sure why this isn't working? And the error message when using `SecurityTokenValidator` doesn't really make sense to me, but maybe it doesn't support this `enc` og `alg` so it skips using this decryption key?
This I've checked:
* I'm pretty sure the private key I have locally is correct. It got all the needed parts which are required
* The token I get from the OIDC server has the same `kid` as the private key I have
Another problem is that the token as part of the exception generated is corrupt (it only has 4 parts). Not sure why that happens, and/or if it's misleading.
Example header of token:
```json
{
"kid": "",
"cty": "JWT",
"enc": "A128GCM",
"alg": "RSA-OAEP-256"
}
```
### Expected Behavior
I would expect the token to be correctly decrypted.
### Steps To Reproduce
I would love to provide a reproduction, but I don't have any OIDC server I can use for that, and I would need to expose a private key as well...
### Exceptions (if any)
1. `IDX10609: Decryption failed. No Keys tried: token: ''.`
2.
```
IDX10618: Key unwrap failed using decryption Keys: 'Microsoft.IdentityModel.Tokens.JsonWebKey, Use: 'enc', Kid: '', Kty: 'RSA', InternalId: ''.
'.
Exceptions caught:
''.
token: ''.
```
### .NET Version
6 and 8
### Anything else?
IDE: JetBrains Rider 2024.3.5
```
> dotnet --info
.NET SDK:
Version: 8.0.100
Commit: 57efcf1350
Workload version: 8.0.100-manifests.6c33ef20
Runtime Environment:
OS Name: Mac OS X
OS Version: 15.3
OS Platform: Darwin
RID: osx-arm64
Base Path: /usr/local/share/dotnet/sdk/8.0.100/
.NET workloads installed:
Workload version: 8.0.100-manifests.6c33ef20
There are no installed workloads to display.
Host:
Version: 8.0.0
Architecture: arm64
Commit: 5535e31a71
.NET SDKs installed:
6.0.411 [/usr/local/share/dotnet/sdk]
6.0.417 [/usr/local/share/dotnet/sdk]
6.0.425 [/usr/local/share/dotnet/sdk]
7.0.305 [/usr/local/share/dotnet/sdk]
8.0.100 [/usr/local/share/dotnet/sdk]
.NET runtimes installed:
Microsoft.AspNetCore.App 6.0.19 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.25 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.33 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.8 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 6.0.19 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.25 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.33 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.8 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Other architectures found:
None
Environment variables:
Not set
global.json file:
/Users/s/code/company/oidc-test/global.json
Learn more:
https://aka.ms/dotnet/info
Download .NET:
https://aka.ms/dotnet/download
```
Contributor guide
Assessment
This issue has not been assessed yet.