使用MAUI WebAuthenticator完成Apple登录后遇密钥格式错误求助

问题场景 #

使用MAUI WebAuthenticator完成Apple登录流程，成功从Apple重定向返回API网站，调试确认Apple私钥已加载至内存，但返回至https://api.whittaker.ca/signin-apple时触发以下错误：

ArgumentException: No supported key formats were found. Check that the input represents the contents of a PEM-encoded key file, not the path to such a file. (Parameter 'input')
System.Security.Cryptography.PemKeyHelpers.ImportPem(ReadOnlySpan<char> input, FindImportActionFunc callback)

Exception: An error was encountered while handling the remote login.
Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<TOptions>.HandleRequestAsync()

Stack Query Cookies Headers Routing
ArgumentException: No supported key formats were found. Check that the input represents the contents of a PEM-encoded key file, not the path to such a file. (Parameter 'input')
System.Security.Cryptography.PemKeyHelpers.ImportPem(ReadOnlySpan`1 input, FindImportActionFunc callback)
AspNet.Security.OAuth.Apple.Internal.DefaultAppleClientSecretGenerator.CreateAlgorithm(ReadOnlyMemory`1 pem)
AspNet.Security.OAuth.Apple.Internal.DefaultAppleClientSecretGenerator.GenerateNewSecretAsync(AppleGenerateClientSecretContext context)
AspNet.Security.OAuth.Apple.Internal.DefaultAppleClientSecretGenerator+<>c__DisplayClass5_0+<<GenerateAsync>b__0>d.MoveNext()
Microsoft.Extensions.Caching.Memory.CacheExtensions.GetOrCreateAsync<TItem>(IMemoryCache cache, object key, Func<ICacheEntry, Task<TItem>> factory)
AspNet.Security.OAuth.Apple.Internal.DefaultAppleClientSecretGenerator.GenerateAsync(AppleGenerateClientSecretContext context)
AspNet.Security.OAuth.Apple.AppleAuthenticationEvents+<>c+<<-ctor>b__10_0>d.MoveNext()
AspNet.Security.OAuth.Apple.AppleAuthenticationEvents.GenerateClientSecret(AppleGenerateClientSecretContext context)
AspNet.Security.OAuth.Apple.AppleAuthenticationHandler.ExchangeCodeAsync(OAuthCodeExchangeContext context)
AspNet.Security.OAuth.Apple.AppleAuthenticationHandler.HandleRemoteAuthenticateAsync(Dictionary<string, StringValues> parameters)
AspNet.Security.OAuth.Apple.AppleAuthenticationHandler.HandleRemoteAuthenticateAsync()
Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<TOptions>.HandleRequestAsync()

...（完整栈信息略）

核心原因 #

错误提示明确指出传入的私钥不是有效的PEM编码内容，大概率是内容不完整、格式损坏，或是误传入文件路径而非文件文本内容导致。

解决步骤 #

1. 验证私钥内容完整性 #

• 确认加载的是PEM文件的完整文本：必须包含-----BEGIN PRIVATE KEY-----和-----END PRIVATE KEY-----首尾标记，中间是每行64字符以内的Base64编码内容，无多余空格、空行或不可见字符。
• 用OpenSSL校验格式：执行命令openssl pkcs8 -in your-key-file.pem -noout -text，能正常输出密钥详情则说明格式有效。

2. 修正私钥加载逻辑 #

• 禁止传入文件路径：如果代码中误将私钥文件路径传给Apple认证配置，替换为读取文件内容的逻辑：

  // 错误写法：传入路径
  // options.PrivateKey = "path/to/apple-key.pem";
  // 正确写法：读取文件内容
  options.PrivateKey = File.ReadAllText("path/to/apple-key.pem");
  

• 配置文件读取注意：从appsettings.json读取时，需用多行字符串格式保留换行，示例：

  "Apple": {
    "PrivateKey": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQC...\n-----END PRIVATE KEY-----"
  }
  

  或在C#中手动恢复换行：options.PrivateKey = config["Apple:PrivateKey"].Replace("\\n", "\n");

3. 兼容环境变量中的私钥 #

若私钥存储在环境变量中，部分环境会将换行符替换为空格，需手动恢复：

var privateKey = Environment.GetEnvironmentVariable("APPLE_PRIVATE_KEY");
privateKey = privateKey.Replace(" ", "\n");
options.PrivateKey = privateKey;

4. 自定义ClientSecret生成（可选） #

如果默认中间件的私钥解析逻辑存在兼容问题，可手动实现ClientSecret生成：

services.AddAuthentication()
    .AddApple(options =>
    {
        options.ClientId = "your-client-id";
        options.TeamId = "your-team-id";
        options.KeyId = "your-key-id";
        options.PrivateKey = File.ReadAllText("path/to/apple-key.pem");

        options.Events = new AppleAuthenticationEvents
        {
            OnGenerateClientSecret = context =>
            {
                using var rsa = RSA.Create();
                rsa.ImportFromPem(context.Options.PrivateKey.ToCharArray());
                
                var tokenHandler = new JsonWebTokenHandler();
                var token = tokenHandler.CreateToken(new SecurityTokenDescriptor
                {
                    Issuer = context.Options.TeamId,
                    Audience = "https://appleid.apple.com",
                    Expires = DateTime.UtcNow.AddMinutes(5),
                    IssuedAt = DateTime.UtcNow,
                    Claims = new Dictionary<string, object> { { "sub", context.Options.ClientId } },
                    SigningCredentials = new SigningCredentials(
                        new RsaSecurityKey(rsa), SecurityAlgorithms.RsaSha256)
                    {
                        Kid = context.Options.KeyId
                    }
                });

                context.ClientSecret = token;
                return Task.CompletedTask;
            }
        };
    });

内容的提问来源于stack exchange，提问作者Brett Whittaker