Google identiy toolkit token validation exception with .NET JSON web token handler

Question

I am trying to integrate GIT in my site. I have been successful in implementing the toolkit and want to validate the JWT sent from Google API with the *.p12 certificate provided during setup.

Exception Details: System.IdentityModel.SignatureVerificationFailedException: IDX10501: Signature validation failed. Key tried: 'System.IdentityModel.Tokens.X509SecurityKey'.

JSON Web Token Received: token: '{"alg":"RS256","kid":"qwYevA"}.{"iss":"https://identitytoolkit.google.com/","aud":"238895676270-i8o5fe2poogs83nki8jl5tgtfm7h9n5l.apps.googleusercontent.com","iat":1445739256,"exp":1446948856,"user_id":"","email":"","provider_id":"google.com","verified":true,"display_name":""}'

 var signingToken = new X509SecurityToken(new X509Certificate2(fileName, "notasecret"));
        TokenValidationParameters validationParameters =

                              new TokenValidationParameters()

                              {

                                  IssuerSigningKey = new X509SecurityKey(new X509Certificate2(fileName, "notasecret")),
                                  ValidAudience = "238895676270-i8o5fe2poogs83nki8jl5tgtfm7h9n5l.apps.googleusercontent.com",
                                  ValidIssuer = "https://identitytoolkit.google.com/",
                                  IssuerSigningKeyResolver = (token, a, ski, tvp) => { return new X509SecurityKey(new X509Certificate2(fileName, "notasecret")); },
                                  IssuerSigningToken = signingToken,

    };
        SecurityToken st;

        var result = tokenHandler.ValidateToken((Request.Cookies["gtoken"]).Value, validationParameters, out st);

Jin Liu Jin Liu · Accepted Answer · 2015-10-26T06:07:57

The JWT generated by the Identity Toolkit is signed by Identity Toolkit's own RSA private key, not the .p12 you downloaded during setup.

You need to download the current active Identity Toolkit X509 public certs from https://www.googleapis.com/identitytoolkit/v3/relyingparty/publicKeys?key={YOUR_SERVER_API_KEY}, select the cert for the 'kid' in the JWT you received, and build a X509Certificate2 using that cert.

The SERVER_API_KEY can be generated in Google Developers Console where you have created OAuth2 clients.

Google identiy toolkit token validation exception with .NET JSON web token handler

1 Answers