Authenticate Google JWT

Question

I am attempting to authenticate a google jwt bearer token from my .net core webapi application and continually receive 401s. I have verified that the token is valid via jwt.io. I am trying to implement the solution offered here, google-jwt-authentication-with-aspnet-core-2-0

Can anyone see what is wrong with my code?

Below is my code:

Startup.cs

public void ConfigureServices(IServiceCollection services)
    {
        // Configure SnapshotCollector from application settings
        services.Configure<SnapshotCollectorConfiguration>(Configuration.GetSection(nameof(SnapshotCollectorConfiguration)));

        // Add SnapshotCollector telemetry processor.
        services.AddSingleton<ITelemetryProcessorFactory>(sp => new SnapshotCollectorTelemetryProcessorFactory(sp));

        conString = Microsoft
        .Extensions
        .Configuration
        .ConfigurationExtensions
        .GetConnectionString(this.Configuration, "DefaultConnection");

        services.AddDbContext<GotNextDBContext>(
            options =>
            options.UseSqlServer(conString));



        services.AddTransient<ILocationService, LocationService>();
        services.AddTransient<ICompanyService, CompanyService>();
        services.AddTransient<IUserLocationLogService, UserLocationLogService>();
        services.AddTransient<IUserService, UserService>();
        services.AddTransient<ILanguageService, LanguageService>();
        services.AddTransient<IGenderService, GenderService>();
        services.AddTransient<ISportService, SportService>();
        services.AddTransient<IMeasurementService, MeasurementService>();


        var clientIds = new List<string>();
        clientIds.Add("[myClientId]");
        services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

        })
        .AddJwtBearer(o =>
        {

            o.SecurityTokenValidators.Clear();
            o.SecurityTokenValidators.Add(new GoogleTokenValidator(clientIds: clientIds ));
        });

        services.AddRouting();
        services.AddAutoMapper();

        services.AddAntiforgery(options =>
        {

            options.Cookie.Name = "X-CSRF-TOKEN-GOTNEXT-COOKIE";                
            options.HeaderName = "X-CSRF-TOKEN-GOTNEXT-HEADER";
            options.SuppressXFrameOptionsHeader = false;
        });

        var serviceProvider = services.BuildServiceProvider();

        var context = serviceProvider.GetService<GotNextDBContext>();



    }

GoogleTokenValidator.cs

public class GoogleTokenValidator : ISecurityTokenValidator
{
    private readonly JwtSecurityTokenHandler _tokenHandler;
    private readonly IEnumerable<string> _clientIds;


    public GoogleTokenValidator()
    {
        _tokenHandler = new JwtSecurityTokenHandler();
    }
    public GoogleTokenValidator(IEnumerable<string> clientIds)
    {
        _tokenHandler = new JwtSecurityTokenHandler();
        _clientIds = clientIds;

    }

    public bool CanValidateToken => true;

    public int MaximumTokenSizeInBytes { get; set; } = TokenValidationParameters.DefaultMaximumTokenSizeInBytes;

    public bool CanReadToken(string securityToken)
    {
        return _tokenHandler.CanReadToken(securityToken);
    }

    public ClaimsPrincipal ValidateToken(string securityToken, TokenValidationParameters validationParameters, out SecurityToken validatedToken)
    {

        validatedToken = null;
        var payload = GoogleJsonWebSignature.ValidateAsync(securityToken, new GoogleJsonWebSignature.ValidationSettings() { Audience = _clientIds }).Result; // here is where I delegate to Google to validate

        var claims = new List<Claim>
            {
                new Claim(ClaimTypes.NameIdentifier, payload.Name),
                new Claim(ClaimTypes.Name, payload.Name),
                new Claim(JwtRegisteredClaimNames.FamilyName, payload.FamilyName),
                new Claim(JwtRegisteredClaimNames.GivenName, payload.GivenName),
                new Claim(JwtRegisteredClaimNames.Email, payload.Email),
                new Claim(JwtRegisteredClaimNames.Sub, payload.Subject),
                new Claim(JwtRegisteredClaimNames.Iss, payload.Issuer),
            };

        try
        {
            var principle = new ClaimsPrincipal();
            principle.AddIdentity(new ClaimsIdentity(claims));
            return principle;
        }
        catch (Exception e)
        {

            Console.WriteLine(e);
            throw;

        }
    }
}

}

I am hitting the endpoint from the belowHttpClient call in Xamarin Forms.

using (var client = new HttpClient() { BaseAddress = new Uri("https://gotnext.azurewebsites.net/api/user/post/") })
            {
                client.DefaultRequestHeaders.Accept.Clear();
                client.DefaultRequestHeaders.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
                client.DefaultRequestHeaders.Add(verificationToken.tokenName, verificationToken.token);
                //client.DefaultRequestHeaders.Add("X-ZUMO-AUTH", googleUser.GoogleAuthToken);
                client.DefaultRequestHeaders.Add("Bearer", googleUser.GoogleIdToken);
                var json = JsonConvert.SerializeObject(newUser);
                var content = new StringContent(json, Encoding.UTF8, "application/json");



                response = client.PostAsync(client.BaseAddress, content).Result;

            }

Answer 1

The ClaimsIdentity that you add to your ClaimsPrincipal does not have an AuthenticationType set so IsAuthenticated will always be false (source).

return new ClaimsPrincipal(new ClaimsIdentity(claims, "Google"));

You can set the authentication type to any value as long as it's not empty.

Answer 2

Stepping throw the code locally, this line: return new ClaimsPrincipal(new ClaimsIdentity(claims, "Google")); Is returning an authenticated identity. However it still is returning a 401. I feel like I'm so close!!

I am making the authentification with google in my web application too(and i walked from there: enter link description here) and i spended much time to investigate these all. In your solution just add these pieces:

1)

//at "ConfigureServices" in "Startup.cs":
services.AddAuthorization(options =>
        {
            options.DefaultPolicy = new AuthorizationPolicyBuilder(JwtBearerDefaults.AuthenticationScheme)
                .RequireAuthenticatedUser()
                .Build();
        });

2) How was said above that it is requied too

return new ClaimsPrincipal(new ClaimsIdentity(claims, "Google"));