DEX LDAP连接器令牌签名

Question

I am playing around with DEX and openldap. When I get a token back in my browser and put it into JWT debugger with the public key i generated, it doesn't verify the signature. I am trying to step through the code of DEX, but the debugging tools are not really working on my computer. I have resorted to log statements. I can't really find where I can observe the signing of the token to see if the program is using the keys i provided or not. Which function actually signs the token and how can I observe what key it uses to sign?

Answer 1

The key can be read from the DEX "keys" endpoint which can be obtained from:

http://your.dex.com/.well-known/openid-configuration

Typically, it would be something like:

http://your.dex.co/keys

After that, the public keys can be extracted using the following program:

https://play.golang.org/p/wVusucNGDI

One of those keys will be able to validate the token:

from jose import jwt

key = '''-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArT9AtIlC8MxhLYhz8ODH
...
+QIDAQAB
-----END PUBLIC KEY-----'''

encoded = 'eyJh...ocw'

audience = ''
if audience == "":
    opts = {"verify_aud": False}
else:
    opts = {}
opts['verify_at_hash'] = False
decoded = jwt.decode(encoded, key, audience=audience, options=opts)

print(decoded)