How do you create and consume OWIN JWT?

问题:

I have a WebAPI, and I need to secure an Angular 4.x app so I though I could use JWT. I'm trying to figure out what's the bare minimum (no OAuth?) to achieve it using Microsoft's OWIN Katana 3.x packages.

How can it be done?

回答1:

The following doesn't work (Microsoft's/System parts entangled in a breaking way). But it's the closest I could get to something looking almost simple.

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Security.Cryptography;
using Microsoft.IdentityModel.Tokens;
using Microsoft.Owin;
using Microsoft.Owin.Security.Jwt;
using Owin;

[assembly: OwinStartup(typeof(WebApplication1.Startup))]
namespace WebApplication1
{
    public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            var issuer = "test";
            var audience = issuer;
            var key = new AesManaged().Key;

            var options = new JwtBearerAuthenticationOptions
            {
                AllowedAudiences = new[] { audience },
                IssuerSecurityTokenProviders = new[] { new SymmetricKeyIssuerSecurityTokenProvider(issuer, key) }
            };
            app.UseJwtBearerAuthentication(options);

            app.Map("/Login", subApp =>
            {
                subApp.Run(context =>
                {
                    var tokenHandler = new JwtSecurityTokenHandler();
                    var tokenDescriptor = new SecurityTokenDescriptor
                    {
                        SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.Sha256Digest),
                        Audience = audience,
                        Issuer = issuer,
                        Subject = new ClaimsIdentity(new[]
                        {
                          new Claim(ClaimTypes.Name, "Serge")
                        })
                    };
                    var token = tokenHandler.WriteToken(tokenHandler.CreateToken(tokenDescriptor));

                    return context.Response.WriteAsync(token);
                });
            });
        }
    }
}