dotnet / dotnet/aspnetcore

OpenIdConnectHandler can't decrypt token with RSA-OAEP-256 and A128GCM

Open
#60,367 8 comments 3 reactions 0 assignees View on GitHub
area-auth blocked
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 5h
Merged PRs (30d)
276

Description

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Describe the bug

```
Platform: macOS Sequoia Version 15.3
Chip: Apple M2 Max
.NET version: 6 and 8 (read below for more information)
Relevant packages: Microsoft.AspNetCore.Authentication.OpenIdConnect v6.0.36 and v8.0.13
```

I'm trying to connect and authenticate users through an OIDC server. I'm getting a valid ID-token in response from the OIDC server. However, I'm struggling with getting decryption of the token to work.

Relevant OIDC setup code:

```cs
var privateKey = new JsonWebKey(File.ReadAllText("private-key.json"));

.AddOpenIdConnect("oidc", config =>
{
config.ResponseType = "code";
config.TokenValidationParameters = new TokenValidationParameters
{
TokenDecryptionKeys = new[] { privateKey }
};

// Given this is .NET 8, you can fallback to this one here. When using .NET 6, it's already the default
// config.UseSecurityTokenValidator = true;

config.Scope.Clear();
config.Scope.Add("openid");
config.Scope.Add("profile");

config.UsePkce = true;
config.SaveTokens = true;
config.GetClaimsFromUserInfoEndpoint = true;
});
```

If I use .NET 6, I'm guessing the `SecurityTokenValidator` will be used, and I get the following error message:

```
IDX10609: Decryption failed. No Keys tried: token: ''.
```

If I use .NET 8, the `JsonWebTokenHandler` is used by default, and I get the following error message (which makes sense, since that was changed in .NET 7 or 8:

```
IDX10618: Key unwrap failed using decryption Keys: 'Microsoft.IdentityModel.Tokens.JsonWebKey, Use: 'enc', Kid: '', Kty: 'RSA', InternalId: ''.
'.
Exceptions caught:
''.
token: ''.
```

I'm not sure why this isn't working? And the error message when using `SecurityTokenValidator` doesn't really make sense to me, but maybe it doesn't support this `enc` og `alg` so it skips using this decryption key?

This I've checked:
* I'm pretty sure the private key I have locally is correct. It got all the needed parts which are required
* The token I get from the OIDC server has the same `kid` as the private key I have

Another problem is that the token as part of the exception generated is corrupt (it only has 4 parts). Not sure why that happens, and/or if it's misleading.

Example header of token:

```json
{
"kid": "",
"cty": "JWT",
"enc": "A128GCM",
"alg": "RSA-OAEP-256"
}
```

### Expected Behavior

I would expect the token to be correctly decrypted.

### Steps To Reproduce

I would love to provide a reproduction, but I don't have any OIDC server I can use for that, and I would need to expose a private key as well...

### Exceptions (if any)

1. `IDX10609: Decryption failed. No Keys tried: token: ''.`
2.

```
IDX10618: Key unwrap failed using decryption Keys: 'Microsoft.IdentityModel.Tokens.JsonWebKey, Use: 'enc', Kid: '', Kty: 'RSA', InternalId: ''.
'.
Exceptions caught:
''.
token: ''.
```

### .NET Version

6 and 8

### Anything else?

IDE: JetBrains Rider 2024.3.5

```
> dotnet --info

.NET SDK:
Version: 8.0.100
Commit: 57efcf1350
Workload version: 8.0.100-manifests.6c33ef20

Runtime Environment:
OS Name: Mac OS X
OS Version: 15.3
OS Platform: Darwin
RID: osx-arm64
Base Path: /usr/local/share/dotnet/sdk/8.0.100/

.NET workloads installed:
Workload version: 8.0.100-manifests.6c33ef20
There are no installed workloads to display.

Host:
Version: 8.0.0
Architecture: arm64
Commit: 5535e31a71

.NET SDKs installed:
6.0.411 [/usr/local/share/dotnet/sdk]
6.0.417 [/usr/local/share/dotnet/sdk]
6.0.425 [/usr/local/share/dotnet/sdk]
7.0.305 [/usr/local/share/dotnet/sdk]
8.0.100 [/usr/local/share/dotnet/sdk]

.NET runtimes installed:
Microsoft.AspNetCore.App 6.0.19 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.25 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 6.0.33 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 7.0.8 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.AspNetCore.App 8.0.0 [/usr/local/share/dotnet/shared/Microsoft.AspNetCore.App]
Microsoft.NETCore.App 6.0.19 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.25 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 6.0.33 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 7.0.8 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]
Microsoft.NETCore.App 8.0.0 [/usr/local/share/dotnet/shared/Microsoft.NETCore.App]

Other architectures found:
None

Environment variables:
Not set

global.json file:
/Users/s/code/company/oidc-test/global.json

Learn more:
https://aka.ms/dotnet/info

Download .NET:
https://aka.ms/dotnet/download

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.