使用ForceDotNetJwtCompanion实现Salesforce JWT认证遇私钥空引用问题

使用ForceDotNetJwtCompanion连接Salesforce时触发System.NullReferenceException异常 #

作为密码学新手，我尝试通过ForceDotNetJwtCompanion NuGet包采用JWT认证方式连接Salesforce，但遇到了问题。参照项目GitHub页面的代码示例实现，加载p12证书并提取出XML格式的私钥后，调用JwtPrivateKeyAsync方法时触发了System.NullReferenceException异常。推测可能是私钥格式不符合要求，但不清楚该方法期望的私钥格式，恳请提供技术帮助。

代码实现 #

string certificatePath = AppDomain.CurrentDomain.BaseDirectory + "Resources\\cert.keys.p12";
X509Certificate2 certificate = new X509Certificate2(certificatePath, "pw", X509KeyStorageFlags.Exportable);
RSA certPrivateKey = certificate.GetRSAPrivateKey();
string privateKeyXML = certPrivateKey.ToXmlString(false);

var apiVersion = "v50.0";
var privateKey = privateKeyXML;
var passPhrase = "passphrase";
var isProd = true;
var authClient = new JwtAuthenticationClient(apiVersion, isProd);

await authClient.JwtPrivateKeyAsync(
    "value_that_ive_removed",
    privateKey,
    passPhrase,
    "user@company.com",
    "https://login.salesforce.com/services/oauth2/token"
);
var accessToken = authClient.AccessToken;

异常信息 #

System.NullReferenceException
HResult=0x80004003
Message=Object reference not set to an instance of an object.
Source=ForceDotNetJwtCompanion
StackTrace:
 at ForceDotNetJwtCompanion.Util.KeyHelpers.CreatePrivateKeyWrapperWithPassPhrase(String key, String passphrase)
 at ForceDotNetJwtCompanion.JwtAuthenticationClient.<JwtPrivateKeyAsync>d__29.MoveNext()

问题分析与解决方案 #

异常栈显示错误发生在KeyHelpers.CreatePrivateKeyWrapperWithPassPhrase方法中，核心原因是你传入的XML格式私钥不符合JwtPrivateKeyAsync方法的要求。该方法期望的私钥格式是PEM格式的PKCS#8私钥，而非XML格式。

修正后的代码如下，将私钥从XML格式替换为PEM格式：

string certificatePath = AppDomain.CurrentDomain.BaseDirectory + "Resources\\cert.keys.p12";
X509Certificate2 certificate = new X509Certificate2(certificatePath, "pw", X509KeyStorageFlags.Exportable);
RSA certPrivateKey = certificate.GetRSAPrivateKey();

// 导出PKCS#8私钥并转换为标准PEM格式
byte[] privateKeyBytes = certPrivateKey.ExportPkcs8PrivateKey();
string privateKeyPem = $"-----BEGIN PRIVATE KEY-----\n{Convert.ToBase64String(privateKeyBytes, Base64FormattingOptions.InsertLineBreaks)}\n-----END PRIVATE KEY-----";

var apiVersion = "v50.0";
var privateKey = privateKeyPem;
var passPhrase = "passphrase"; // 若私钥未加密，可传null或空字符串
var isProd = true;
var authClient = new JwtAuthenticationClient(apiVersion, isProd);

await authClient.JwtPrivateKeyAsync(
    "your_client_id", // 替换为实际的Client ID
    privateKey,
    passPhrase,
    "user@company.com",
    "https://login.salesforce.com/services/oauth2/token"
);
var accessToken = authClient.AccessToken;

补充说明 #

• 如果你的p12证书私钥未设置密码，passPhrase参数传入null或空字符串即可；若有密码，需确保传入的密码与证书密码一致。
• ToXmlString(false)导出的XML格式私钥仅适用于.NET内部的RSA操作，并非ForceDotNetJwtCompanion库所需的标准JWT私钥格式。

内容的提问来源于stack exchange，提问作者user1366062