Add request for jwks from .well_known endpoint

Author: whamm86

src/AasSecurity/SecurityHelper.cs

@@ -101,18 +101,13 @@ private static void ParseSecurityMetamodel()
             {
                 for (var i = 0; i < GlobalSecurityVariables.ServerKid.Count; i++)
                 {
-                    if (GlobalSecurityVariables.ServerKid[i] != "" &&
+                    if ((GlobalSecurityVariables.ServerKid[i] != "" &&
                         GlobalSecurityVariables.ServerKid[i] == kid)
+                        || GlobalSecurityVariables.ServerIssuerUrl[i] == iss)
                     {
                         domain = GlobalSecurityVariables.ServerDomain[i];
                         return GlobalSecurityVariables.ServerJwksUrl[i];
                     }
-                    else if (GlobalSecurityVariables.ServerIssuerUrl[i] == iss)
-                    {
-                        domain = GlobalSecurityVariables.ServerDomain[i];
-                        //ToDo request well-known endpoint to get JWKS properly
-                        return $"{GlobalSecurityVariables.ServerIssuerUrl[i]}/jwks";
-                    }
                 }
             }
 

src/AasSecurity/SecurityService.cs

@@ -581,14 +581,27 @@ private string HandleBearerToken(string? bearerToken, ref string user, ref bool
                             user = "";
                             var jwksUrl = "";
                             var kid = jwtSecurityToken.Header["kid"].ToString();
+                            var clientHandler = new HttpClientHandler { DefaultProxyCredentials = CredentialCache.DefaultCredentials };
+                            using var httpClient = new HttpClient(clientHandler);
+
                             if (kid != null)
                             {
                                 jwksUrl = SecurityHelper.FindServerJwksUrl(kid, iss, out domain);
                             }
-                            if (!jwksUrl.IsNullOrEmpty())
+                            if (jwksUrl.IsNullOrEmpty())
+                            {
+                                var openIdConfig = httpClient.GetStringAsync($"{iss}/.well-known/openid-configuration").Result;
+                                var openIdConfigJson = JsonDocument.Parse(openIdConfig);
+
+                                string jwksUri = $"{iss}/jwks";
+                                if (openIdConfigJson.RootElement.TryGetProperty("jwks_uri", out var propJwksUri))
+                                {
+                                    jwksUri = propJwksUri.GetString();
+                                }
+                            }
+
+                            try
                             {
-                                var clientHandler = new HttpClientHandler { DefaultProxyCredentials = CredentialCache.DefaultCredentials };
-                                using var httpClient = new HttpClient(clientHandler);
                                 var jwksJson = httpClient.GetStringAsync(jwksUrl).Result;
                                 var jwks = new JsonWebKeySet(jwksJson);
                                 var signingKeys = jwks.GetSigningKeys();
@@ -611,11 +624,12 @@ private string HandleBearerToken(string? bearerToken, ref string user, ref bool
                                 }
                                 catch (Exception ex)
                                 {
+                                    _logger.LogError($"Error in validation of token {bearerToken}: {ex.Message}.");
                                 }
                             }
-                            else
+                            catch (Exception ex)
                             {
-
+                                _logger.LogError($"Error in loading jwks from {jwksUrl}: {ex.Message}.");
                             }
                         }
                     }