passport-azure-ad，它是否解析和验证令牌？

Question

我的平均堆栈应用程序使用Azure AD进行身份验证。我正在使用“Passport-Azure-AD”模块进行web api认证。根据这里的回复，我了解到

    "use strict";
    var passport = require('passport');
    var OIDCBearerStrategy = require('passport-azure-ad').BearerStrategy;

    var options = {      
        identityMetadata: 'https://login.microsoftonline.com/tenantid/.well-known/openid-configuration',   
        validateIssuer: true, 
        passReqToCallback: false,
        loggingLevel: 'error' 
    };

    function configure(app) {    
        app.use(passport.initialize());
        app.use(passport.session());  

        passport.use(new OIDCBearerStrategy(options,
            function(token, done) {
               //is there anything else i need to do here?
               return done(null, token.unique_name, token);            
            })); 

             passport.serializeUser(function (user, done) {
                    done(null, user);
             });

            passport.deserializeUser(function (id, done) {
                done(null, id);
            });         
    }

    function authenticate(req, res, next) {
        //is there anything else i need to do here?
        passport.authenticate('oauth-bearer')(req, res, next);
    }

server.js
下面的“UserService”用于从数据库获取用户，我想保护该API调用

        "use strict";

    var authentication = require('./AzureAuthenticationService');
    var userService = require('./UserService');

    // Initialize server
    var express = require('express');
    var app = exports.app = express();
    authentication.configure(app);

    // Set routes
    app.get('/api/users',authentication.authenticate,userService.getUsers);

Answer 1

我是passport-azure-ad的维护者。回答您的问题，是的，它将为您验证令牌。它通过调用代码中的jwtVerify来完成这一操作。你可以看到这是从哪里开始的。它将使用在配置中的元数据endpoint找到的密钥来解密令牌。

如果验证不成功，您将从代码中得到一个错误，如上面所示，并在此引用：

jwt.verify(token, PEMkey, options, function(err, token) {
            if (err) {
                if (err instanceof jwt.TokenExpiredError) {
                    log.warn("Access token expired");
                    done(null, false, 'The access token expired');
                } else if (err instanceof jwt.JsonWebTokenError) {
                    log.warn("An error was received validating the token", err.message);
                    done(null, false, util.format('Invalid token (%s)', err.message));
                } else {
                    done(err, false);
                }