IdentityServer4中JWK集客户端创建与令牌获取报错排查

问题场景 #

客户端配置（IdentityServer4端）：

new Client
{
    ClientId = "infernoSystemClient",
    ClientName = "Client Credentials Client",
    RequireRequestObject = true,

    ClientSecrets =
    {
        new Secret
        {
            // JWK formatted RSA key
            Type = IdentityServerConstants.SecretTypes.JsonWebKey,
            Value = "{'kty': 'RSA','alg': 'RS384','n': 'vjbIzTqiY8K8zApeNng5ekNNIxJfXAue9BjoMrZ9Qy9m7yIA-tf6muEupEXWhq70tC7vIGLqJJ4O8m7yiH8H2qklX2mCAMg3xG3nbykY2X7JXtW9P8VIdG0sAMt5aZQnUGCgSS3n0qaooGn2LUlTGIR88Qi-4Nrao9_3Ki3UCiICeCiAE224jGCg0OlQU6qj2gEB3o-DWJFlG_dz1y-Mxo5ivaeM0vWuodjDrp-aiabJcSF_dx26sdC9dZdBKXFDq0t19I9S9AyGpGDJwzGRtWHY6LsskNHLvo8Zb5AsJ9eRZKpnh30SYBZI9WHtzU85M9WQqdScR69Vyp-6Uhfbvw','e': 'AQAB','use': 'sig','key_ops': ['verify'],'ext': true,'kid': 'b41528b6f37a9500edb8a905a595bdd7'}"
        }
    },

    AllowedGrantTypes = GrantTypes.ClientCredentials,
    AllowedScopes = { "system/*.read" }
}

客户端请求/connect/token的参数：

client_assertion=eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzM4NCIsImtpZCI6IjRiNDlhNzM5ZDFlYjExNWIzMjI1ZjRjZjliZWI2ZDFiIn0.eyJpc3MiOiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpGVXpNNE5DSXNJbXRwWkNJNklqUmlORGxoTnpNNVpERmxZakV4TldJek1qSTFaalJqWmpsaVpXSTJaREZpSW4wLmV5SnBjM01pT2lKcGJtWmxjbTV2VTNsemRHVnRRMnhwWlc1MElpd2ljM1ZpSWpvaWFXNW1aWEp1YjFONWMzUmxiVU5zYVdWdWRDSXNJbUYxWkNJNkltaDBkSEJ6T2k4dmFXRnRMbVYwYUdsNmJ5NWpiMjB2WTI5dWJtVmpkQzkwYjJ0bGJpSXNJbVY0Y0NJNk1UWTJNVEkyTkRZeE15d2lhblJwSWpvaU16Z3dNVFl4TVRObE9UZzFNMlpqTnpVeU9HSTVZV0l4TUdKak9EYzJZelZpWlRNeVpERmtPV0U1TWpsaE5tTmpPRGMxTkdNM09EazFaVGswWkRFNU5DSjkuNWN4TXQ3OW1KaXRuNEZyMm11THNkMVFJQ2lYcjhkTnZXd09IaWdzRmlrWmpQU0pSRl8wam54MTg4Uk9IVDlmN2VnLWFMRkFpd0p3ZVB3T21lZVg0YVdyTGZJTXd6WkYzQ3hmU2JNeXZnSTJ0andGMFN5cFgybU9YbDBQNkh0QUUiLCJzdWIiOiJleUowZVhBaU9pSktWMVFpTENKaGJHY2lPaUpGVXpNNE5DSXNJbXRwWkNJNklqUmlORGxoTnpNNVpERmxZakV4TldJek1qSTFaalJqWmpsaVpXSTJaREZpSW4wLmV5SnBjM01pT2lKcGJtWmxjbTV2VTNsemRHVnRRMnhwWlc1MElpd2ljM1ZpSWpvaWFXNW1aWEp1YjFONWMzUmxiVU5zYVdWdWRDSXNJbUYxWkNJNkltaDBkSEJ6T2k4dmFXRnRMbVYwYUdsNmJ5NWpiMjB2WTI5dWJtVmpkQzkwYjJ0bGJpSXNJbVY0Y0NJNk1UWTJNVEkyTkRZeE15d2lhblJwSWpvaU16Z3dNVFl4TVRObE9UZzFNMlpqTnpVeU9HSTVZV0l4TUdKak9EYzJZelZpWlRNeVpERmtPV0U1TWpsaE5tTmpPRGMxTkdNM09EazFaVGswWkRFNU5DSjkuNWN4TXQ3OW1KaXRuNEZyMm11THNkMVFJQ2lYcjhkTnZXd09IaWdzRmlrWmpQU0pSRl8wam54MTg4Uk9IVDlmN2VnLWFMRkFpd0p3ZVB3T21lZVg0YVdyTGZJTXd6WkYzQ3hmU2JNeXZnSTJ0andGMFN5cFgybU9YbDBQNkh0QUUiLCJhdWQiOiJodHRwczovL2lhbS5ldGhpem8uY29tL2Nvbm5lY3QvdG9rZW4iLCJleHAiOjE2NjEyNjUxNzUsImp0aSI6ImRkYjIyZjQxMDkyYTY0NDlmOWNiYjQ4NzgyY2QxZmI0MGQyZWQ1Nzc4NjdjNTM0ZWVhMjU2NGU3NmZkNWMxMzYifQ.m-nWIEKV1sv6zxX72jaq5L12Owixl-nxFYfOkINGyUPx-qZH2uJYUQC-iKJedpJRUZGyzyqWK1OelYu-Ze1w38gwMss1xGQ50esom6xd8dYyz6-XYhT45F7uDfiySDLx&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&grant_type=client_credentials&scope=system%2F%2A.read

返回错误：invalid client，IdentityServer日志显示：Invalid HTTP request for token endpoint No client identifier found

核心原因 #

1. 未传递client_id参数：即使使用client_assertion进行客户端认证，IdentityServer4仍需要显式的client_id来定位对应的客户端配置，之后才会验证断言的有效性。
2. 断言内容不匹配：
   • 断言的iss和sub字段值不是配置的ClientId（infernoSystemClient），而是无效的长串，无法匹配客户端。
   • 签名算法不匹配：客户端配置的JWK使用RS384算法，但断言的header中指定的是ES384（alg: FUzM4NC对应ES384）。
   • kid不匹配：配置的JWK的kid是b41528b6f37a9500edb8a905a595bdd7，但断言header中的kid是4b49a739d1eb115b3225f4cf9beb6d1b，无法找到对应的验证密钥。

解决方案 #

1. 在请求中添加client_id参数 #

修改token请求参数，追加client_id=infernoSystemClient，完整请求参数示例：

client_id=infernoSystemClient&client_assertion=...&client_assertion_type=urn%3Aietf%3Aparams%3Aoauth%3Aclient-assertion-type%3Ajwt-bearer&grant_type=client_credentials&scope=system%2F%2A.read

2. 修正client_assertion的内容 #

生成断言时确保以下几点：

• iss和sub字段值必须等于客户端配置的ClientId：infernoSystemClient。
• 签名算法与JWK一致：使用RS384（断言header的alg字段设为RS384）。
• kid字段值与JWK的kid完全匹配：b41528b6f37a9500edb8a905a595bdd7。

3. 验证客户端配置的正确性 #

确保客户端的AllowedGrantTypes包含client_credentials，且RequireRequestObject设置正确（当前为true，若不需要可改为false，但需保持客户端和请求的一致性）。

内容的提问来源于stack exchange，提问作者Shoaib Ismail