Manually Decode OAuth Bearer Token in C #

Question

In my Api 2.2 OWIN application for web applications, I have a situation where I need to manually decode the carrier token, but I do not know how to do this. This is my startup.cs

public class Startup { public static OAuthAuthorizationServerOptions OAuthServerOptions { get; private set; } public static UnityContainer IoC; public void Configuration(IAppBuilder app) { //Set Auth configuration ConfigureOAuth(app); ....and other stuff } public void ConfigureOAuth(IAppBuilder app) { OAuthServerOptions = new OAuthAuthorizationServerOptions() { AllowInsecureHttp = true, TokenEndpointPath = new PathString("/token"), AccessTokenExpireTimeSpan = TimeSpan.FromDays(1), Provider = new AuthProvider(IoC.Resolve<IUserService>(), IoC.Resolve<IAppSettings>()) }; // Token Generation app.UseOAuthAuthorizationServer(OAuthServerOptions); app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions()); } } 

In my controller, Im sends a carrier token as a parameter

 [RoutePrefix("api/EP")] public class EPController : MasterController { [HttpGet] [AllowAnonymous] [Route("DC")] public async Task<HttpResponseMessage> GetDC(string token) { //Get the claim identity from the token here //Startup.OAuthServerOptions... //..and other stuff } } 

How to manually decode and receive claims from the token passed as a parameter?

NOTE I know that I can send a token in the header and use [Authorize] and (ClaimsIdentity) User.Identity, etc., but the question is how to read the token when it is not presented in the header.

Answer 1

I created a sample project for deserializing carrier tokens that are encrypted using MachineKeyDataProtector. You can see the source code.

Marker Marker Deserializer

Answer 2

Just put it here for others who may visit in the future. The solution found at https://long2know.com/2015/05/decrypting-owin-authentication-ticket/ is simpler.

Just two lines:

 var secureDataFormat = new TicketDataFormat(new MachineKeyProtector()); AuthenticationTicket ticket = secureDataFormat.Unprotect(accessToken); private class MachineKeyProtector : IDataProtector { private readonly string[] _purpose = { typeof(OAuthAuthorizationServerMiddleware).Namespace, "Access_Token", "v1" }; public byte[] Protect(byte[] userData) { throw new NotImplementedException(); } public byte[] Unprotect(byte[] protectedData) { return System.Web.Security.MachineKey.Unprotect(protectedData, _purpose); } } 

Answer 3

You can read the JWT and create a Principals and Identity object using the System.IdentityModel.Tokens.Jwt package - https://www.nuget.org/packages/System.IdentityModel.Tokens.Jwt/ .

Here is an example that shows the options available when reading and checking the token,

  private ClaimsIdentity GetIdentityFromToken(string token, X509Certificate2 certificate) { var tokenDecoder = new JwtSecurityTokenHandler(); var jwtSecurityToken = (JwtSecurityToken)tokenDecoder.ReadToken(token); SecurityToken validatedToken; var principal = tokenDecoder.ValidateToken( jwtSecurityToken.RawData, new TokenValidationParameters() { ValidateActor = false, ValidateIssuer = false, ValidateAudience = false, ValidateLifetime = false, ValidateIssuerSigningKey = false, RequireExpirationTime = false, RequireSignedTokens = false, IssuerSigningToken = new X509SecurityToken(certificate) }, out validatedToken); return principal.Identities.FirstOrDefault(); }