IdentityServer与MvcClient交互登录签名验证失败求助

安全阿岳

2026-6-21

交互式登录实现中遇到IDX10500签名验证错误

我按照文档步骤实现交互式登录，在MvcClient中点击隐私标签页触发跳转至IdentityServer登录，登录成功返回时遇到签名验证失败错误，核心提示为：IDX10500: Signature validation failed. No security keys were provided to validate the signature.

完整错误日志如下：

2024-07-05 14:38:57.607 -04:00 [DBG] Connection 0HN4T46RO7B2O established using the following protocol: "Tls13"
2024-07-05 14:38:57.698 -04:00 [INF] Request starting HTTP/2 GET https://localhost:7234/Home/Privacy - null null
2024-07-05 14:38:57.707 -04:00 [DBG] The request path /Home/Privacy does not match a supported file type
2024-07-05 14:38:57.710 -04:00 [DBG] 1 candidate(s) found for the request path '/Home/Privacy'
2024-07-05 14:38:57.712 -04:00 [DBG] Endpoint 'IdentityServerQuickStart.MvcClient.Controllers.HomeController.Privacy (IdentityServerQuickStart.MvcClient)' with route pattern '{controller=Home}/{action=Index}/{id?}' is valid for the request path '/Home/Privacy'
2024-07-05 14:38:57.714 -04:00 [DBG] Request matched endpoint 'IdentityServerQuickStart.MvcClient.Controllers.HomeController.Privacy (IdentityServerQuickStart.MvcClient)'
2024-07-05 14:38:57.719 -04:00 [DBG] AuthenticationScheme: Cookies was not authenticated.
2024-07-05 14:38:57.723 -04:00 [DBG] Policy authentication schemes  did not succeed
2024-07-05 14:38:57.726 -04:00 [INF] Authorization failed. These requirements were not met:
DenyAnonymousAuthorizationRequirement: Requires an authenticated user.
2024-07-05 14:38:57.785 -04:00 [DBG] HandleChallenge with Location: https://localhost:44322/connect/authorize?client_id=mvc&redirect_uri=https%3A%2F%2Flocalhost%3A7234%2Fsignin-oidc&response_type=id_token&scope=openid%20profile&response_mode=form_post&nonce=638558015377798439.ZWEzZGI1OWItNTAwYS00YzI2LTkwMGMtZGVjNzI0ZmM1MTZjNTQxYTdkMDQtMjg4Zi00N2U1LTg5ZDktOGU4ZmUwMjE5YTAy&state=CfDJ8N4mnYggvO1EmxOZVM5SE9PnyMYD11Fh4U7TKnjT6zG0N4Ingxs1bzwYt8ev5Mc2558w8Vc0y-QEAvQzFJbaVM9MrqzefXn91zrRzrBUVL-W-LdIsExT-dQ5X1N_4G7WCY3qQ6DsWdm9CchXs0sDTkgqTmWYulZcPvRCNgMn3-Y-sQYAsgSltRZlwkl9NNWt5oufVCvtcQP0yWHO_KeOvpHeebOU1Y-uP52yJrw2W15EXhx7T9K2MRuWcwRC9vZ_ymualA3coVHgNvI26iXcxzHPHVqx4tuXoLFKaq95HWALrh-JKWJfY_H7lc_sHIqM1A&x-client-SKU=ID_NET8_0&x-client-ver=7.1.2.0; and Set-Cookie: .AspNetCore.OpenIdConnect.Nonce.CfDJ8N4mnYggvO1EmxOZVM5SE9PVkcRiW5LrFbFxUINAn7v-2W-58VReFRAG1fVOgE0tdjCqG8yro5Urkac4lSDaB2GqhoZoW8IlYgiqhKKGyfdgzE_HgAnlGPUAq2HO21rc8gKbJQEuRd9bcYrMFpqy0HK-O3B5E2XdRK6Iqyr4LnjDWRKjDWkeWwE9iyvMRGAi59rqPFP6J0wEjEml-kRAxQHAmWf3IXHBGBuNQz-YLcigMxvo3yvHsoPZDTPe_egwyYw3tG94WE76M1B8B0kC834=N; expires=Fri, 05 Jul 2024 18:53:57 GMT; path=/signin-oidc; secure; samesite=none; httponly,.AspNetCore.Correlation.XD3pXaL1E7xZ3-aW8OQQLsng-vgjcfDX3BolBIgFZ6E=N; expires=Fri, 05 Jul 2024 18:53:57 GMT; path=/signin-oidc; secure; samesite=none; httponly.
2024-07-05 14:38:57.787 -04:00 [INF] AuthenticationScheme: OpenIdConnect was challenged.
2024-07-05 14:38:57.789 -04:00 [INF] Request finished HTTP/2 GET https://localhost:7234/Home/Privacy - 302 0 null 91.4072ms
2024-07-05 14:38:57.921 -04:00 [INF] Request starting HTTP/2 POST https://localhost:7234/signin-oidc - application/x-www-form-urlencoded 1387
2024-07-05 14:38:57.926 -04:00 [DBG] POST requests are not supported
2024-07-05 14:38:57.929 -04:00 [DBG] 1 candidate(s) found for the request path '/signin-oidc'
2024-07-05 14:38:57.931 -04:00 [DBG] Endpoint 'IdentityServerQuickStart.MvcClient.Controllers.HomeController.SignInCallBack (IdentityServerQuickStart.MvcClient)' with route pattern 'signin-oidc' is valid for the request path '/signin-oidc'
2024-07-05 14:38:57.933 -04:00 [DBG] Request matched endpoint 'IdentityServerQuickStart.MvcClient.Controllers.HomeController.SignInCallBack (IdentityServerQuickStart.MvcClient)'
2024-07-05 14:38:57.945 -04:00 [DBG] Connection id "0HN4T46RO7B2O", Request id "0HN4T46RO7B2O:00000003": started reading request body.
2024-07-05 14:38:57.946 -04:00 [DBG] Connection id "0HN4T46RO7B2O", Request id "0HN4T46RO7B2O:00000003": done reading request body.
2024-07-05 14:38:57.955 -04:00 [DBG] Updating configuration
2024-07-05 14:38:57.959 -04:00 [DBG] Received 'id_token'
2024-07-05 14:38:58.032 -04:00 [ERR] Exception occurred while processing message.
Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10500: Signature validation failed. No security keys were provided to validate the signature.
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.ValidateTokenUsingHandlerAsync(String idToken, AuthenticationProperties properties, TokenValidationParameters validationParameters)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
2024-07-05 14:38:58.036 -04:00 [DBG] Exception of type 'SecurityTokenSignatureKeyNotFoundException' thrown, Options.ConfigurationManager.RequestRefresh() called.
2024-07-05 14:38:58.039 -04:00 [INF] Error from RemoteAuthentication: IDX10500: Signature validation failed. No security keys were provided to validate the signature..
2024-07-05 14:38:58.043 -04:00 [ERR] An unhandled exception has occurred while executing the request.
Microsoft.AspNetCore.Authentication.AuthenticationFailureException: An error was encountered while handling the remote login.
 ---> Microsoft.IdentityModel.Tokens.SecurityTokenSignatureKeyNotFoundException: IDX10500: Signature validation failed. No security keys were provided to validate the signature.
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.ValidateTokenUsingHandlerAsync(String idToken, AuthenticationProperties properties, TokenValidationParameters validationParameters)
   at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()
   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.ExceptionHandlerMiddlewareImpl.<Invoke>g__Awaited|10_0(ExceptionHandlerMiddlewareImpl middleware, HttpContext context, Task task)

文档说明该功能应开箱即用，但使用最新版本.NET时已解决多个错误，至此受阻。预期流程为点击隐私标签页跳转至IdentityServer登录，成功后返回隐私页。相关代码仓库分支为features/MEP/add-user-auth-with-open-id-connect。

内容的提问来源于stack exchange，提问作者Matt Perejda