Azure API Manager Validate-JWT策略id属性问题及示例请求

场景1：通过OpenID自动拉取签名密钥（推荐） #

无需手动维护密钥，策略会从身份提供商的OpenID配置端点自动获取有效签名密钥：

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Invalid token">
    <openid-config url="https://your-identity-provider/.well-known/openid-configuration" />
    <required-claims>
        <claim name="aud">
            <value>your-api-audience</value>
        </claim>
    </required-claims>
</validate-jwt>

场景2：手动指定签名密钥（支持密钥标识匹配） #

若需手动指定密钥，注意文档中提及的「id指定密钥」实际对应两种合法配置方式，而非直接在issuer-signing-keys节点下添加id属性（该节点Schema不支持此写法，这也是你的配置被表单拒绝的原因）：

方式1：手动配置带密钥ID（kid）的对称/非对称密钥 #

通过kid属性匹配JWT头部中的密钥标识，确保仅使用指定密钥验证：

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Invalid token">
    <issuer-signing-keys>
        <!-- 对称密钥示例 -->
        <key kid="your-key-unique-id" value="your-secret-signing-key" />
        <!-- 非对称公钥示例 -->
        <!-- <key kid="your-key-unique-id" certificate="your-public-certificate-content" /> -->
    </issuer-signing-keys>
    <issuers>
        <issuer>https://your-identity-provider/</issuer>
    </issuers>
    <required-claims>
        <claim name="aud">
            <value>your-api-audience</value>
        </claim>
    </required-claims>
</validate-jwt>

方式2：引用API Manager预配置的命名密钥 #

若已在API Manager的「密钥」菜单中创建了命名密钥，可通过key-id属性直接引用：

<validate-jwt header-name="Authorization" failed-validation-httpcode="401" failed-validation-error-message="Invalid token">
    <issuer-signing-keys>
        <key key-id="pre-configured-key-name" />
    </issuer-signing-keys>
    <issuers>
        <issuer>https://your-identity-provider/</issuer>
    </issuers>
    <required-claims>
        <claim name="aud">
            <value>your-api-audience</value>
        </claim>
    </required-claims>
</validate-jwt>

内容的提问来源于stack exchange，提问作者Umesh Kanitkar