How to decrypt JWE token in IdentityServer4? Implementing JWE in Identity Server4? - oauth-2.0

Question

I am trying to implement JWE in IdentityServer4. But getting exception
SecurityTokenKeyWrapException: IDX10659: UnwrapKey failed, exception from cryptographic operation: '[PII of type 'Internal.Cryptography.CryptoThrowHelper+WindowsCryptographicException' is hidden.
Basically I am following https://www.scottbrady91.com/identity-server/encrypting-identity-tokens-in-identityserver4 for the encryption and decryption.
Encrypting "id_token" by overriding CreateTokenAsync method of DefaultTokenCreationService
public class JweTokenCreationService : DefaultTokenCreationService
{
public JweTokenCreationService(ISystemClock clock, IKeyMaterialService keys,
IdentityServerOptions options, ILogger<DefaultTokenCreationService> logger) :
base(clock, keys, options, logger)
{
}
public override async Task<string> CreateTokenAsync(Token token)
{
var filePath = Path.Combine(Environment.CurrentDirectory, "server.crt");
var certificate = new X509Certificate2(filePath); // certificate for encryption
if (token.Type == IdentityServerConstants.TokenTypes.IdentityToken)
{
var payload = await base.CreatePayloadAsync(token);
var handler = new JsonWebTokenHandler();
var jwe = handler.CreateToken(
payload.SerializeToJson(),
await Keys.GetSigningCredentialsAsync(),
new X509EncryptingCredentials(new X509Certificate2(certificate))
);
return jwe; // encrypted token
}
return await base.CreateTokenAsync(token);
}
}
The "id_token" gets encrypted sucessfully.
Decrypting "id_token" in MVC client.
In the Startup.cs class of MVC client I have added the code.
var filePath = Path.Combine(Environment.CurrentDirectory, "server.pfx");
var certificate = new X509Certificate2(filePath, "123456", X509KeyStorageFlags.Exportable);
services.AddAuthentication(options =>
{
options.DefaultScheme = "Cookies";
options.DefaultChallengeScheme = "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect("oidc", options =>
{
options.Authority = "https://localhost:5001";
options.ClientId = "mvc";
options.ClientSecret = "secret";
options.ResponseType = "code";
options.Scope.Add("api1");
options.SaveTokens = true;
options.TokenValidationParameters = new TokenValidationParameters
{
TokenDecryptionKey = new X509SecurityKey(certificate) // set the TokenDecryptionKey on OpenIdConnectsOptions’s TokenValidationParameters to the appropriate private key
};
});
Result:
While running the application the "id_token" gets encrypted successfully (Checked with debugger). But in client app its throwing exception SecurityTokenKeyWrapException: IDX10659: UnwrapKey failed, exception from cryptographic operation.
Tried Workarounds:
a. Tried using RSA key instead of X5t as mentioned here IDX10659 error when using X509Certficate to decrypt JWT token
options.TokenValidationParameters = new TokenValidationParameters
{
TokenDecryptionKey = new
RsaSecurityKey(certificate.GetRSAPrivateKey().ExportParameters(true))
};
Still getting same exception.
b. Tried Using a Custom Crypto Provider like https://github.com/AzureAD/azure-activedirectory-identitymodel-extensions-for-dotnet/issues/615
Created a Custom CryptoProviderFactory
public class UnwrappingCryptoProviderFactory : CryptoProviderFactory
{
public UnwrappingCryptoProviderFactory()
{
System.Console.WriteLine("UnwrappingCryptoProviderFactory invoked");
}
public override KeyWrapProvider CreateKeyWrapProvider(SecurityKey key, string algorithm)
{
switch (key)
{
case X509SecurityKey x509Key:
return new RsaKeyWrapProvider(x509Key, algorithm, true);
default:
return base.CreateKeyWrapProvider(key, algorithm);
}
}
}
In MVC client used this custom CryptoProviderFactory
var filePath = Path.Combine(Environment.CurrentDirectory, "server.pfx");
var certificate = new X509Certificate2(filePath, "123456", X509KeyStorageFlags.Exportable);
var key = new X509SecurityKey(certificate);
{
// Custom provider to ensure we can unwrap the key properly when decrypting the token
CryptoProviderFactory = new UnwrappingCryptoProviderFactory()
};
Here is the TokenValidationParameters
options.TokenValidationParameters = new TokenValidationParameters
{
TokenDecryptionKey = key
};
Still getting same exception.
Any help/suggestion would be really helpful. Thanks!