新年快樂給大家......IdentityServer4 IdentityServer3.AccessTokenValidation
我配置的IdentityServer4,我可以做成功的ASP.net核心網絡API調用。 但是對於asp.net框架4.5.2 web apis, 我得到了{「響應狀態代碼不表示成功:401(未授權)。」}來自.NET框架web api的錯誤。我想問你的幫助和意見。
我用IS4調查了這個話題,發現了一些關於IdentityServer3.AccessTokenValidation兼容性的條目。根據回覆,我加載了一個簽名證書,並調用了AddSigningCredential而不是AddTemporarySigninCredential。 x509certificate是本地創建的證書。並且我更新了IdentityServer3.AccessTokenValidation版本到v2.13.0。
我仍然得到了錯誤。 任何幫助表示讚賞。
感謝您的努力。
IdentityServer 4側: Startup.cs
public void ConfigureServices(IServiceCollection services)
{
services
.AddIdentityServer()
//.AddTemporarySigningCredential()
.AddSigningCredential(x509Certificate)
.AddInMemoryIdentityResources(Config.GetIdentityResources())
.AddInMemoryApiResources(Config.GetApiResources())
.AddInMemoryClients(Config.GetClients())
.AddAspNetIdentity<ApplicationUser>();
}
Config.cs
public static IEnumerable<ApiResource> GetApiResources()
{
return new List<ApiResource>
{
new ApiResource("AuthorizationWebApi","Authorization Web API .NET Core"),
new ApiResource("AuthorizationWebApiNetFramework","Authorization Web API NET Framework"),
new ApiResource("api1", "Empty Test Api")
};
}
public static IEnumerable<Client> GetClients()
{
return new List<Client> {
new Client {
ClientId = "silicon",
ClientName = "console app",
AllowedGrantTypes = GrantTypes.ClientCredentials,
ClientSecrets = { new Secret("abcdef".Sha256())},
AllowedScopes = new List<string>{
"AuthorizationWebApiNetFramework"
}
},
new Client
{
ClientId = "MYUX",
ClientName = "MYUX MVC Client",
AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
RequireConsent = false,
ClientSecrets= {new Secret("abcdef".Sha256()) },
RedirectUris = { "http://localhost:5002/signin-oidc" },
PostLogoutRedirectUris = {"http://localhost:5002"},
AllowedScopes = {
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile,
"custom.profile",
"AuthorizationWebApi",
"AuthorizationWebApiNetFramework"
},
AllowOfflineAccess = true
}
};
}
的.NET Framework API側
public void Configuration(IAppBuilder app)
{
//ConfigureAuth(app);
app.UseCookieAuthentication(new CookieAuthenticationOptions());
app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions
{
Authority = "http://www.abcdefgh.com:5000",
ValidationMode = ValidationMode.ValidationEndpoint,
RequiredScopes = new[] { "AuthorizationWebApiNETFramework" }
});
//configure web api
var config = new HttpConfiguration();
config.MapHttpAttributeRoutes();
//require authentication for all controllers
config.Filters.Add(new AuthorizeAttribute());
app.UseWebApi(config);
}
主叫側:
try
{
ViewData["Message"] = "Authorization Test.";
var accessToken = await HttpContext.Authentication.GetTokenAsync("access_token");
var authorizationApiClient = new HttpClient();
authorizationApiClient.SetBearerToken(accessToken);
var content = await authorizationApiClient.GetStringAsync("http://localhost:13243/values");
return View();
}
catch (Exception ex)
{
throw;
}
或通過一個控制檯應用程序...
try
{
// discover endpoints from metadata
var disco = await DiscoveryClient.GetAsync("http://www.abcdefgh.com:5000");
var tokenClient = new TokenClient(disco.TokenEndpoint, "silicon", "abcdef");
var tokenResponse = await tokenClient.RequestClientCredentialsAsync("AuthorizationWebApiNetFramework");
if (tokenResponse.IsError)
{
Console.WriteLine(tokenResponse.Error);
return;
}
Console.WriteLine(tokenResponse.Json);
var client = new HttpClient();
client.SetBearerToken(tokenResponse.AccessToken);
var response = await client.GetAsync("http://localhost:13243/values");
if (!response.IsSuccessStatusCode)
{
Console.WriteLine(response.StatusCode);
}
else
{
var content = await response.Content.ReadAsStringAsync();
Console.WriteLine(JArray.Parse(content));
}
}
catch (Exception)
{
throw;
}
編輯:在4.5.2阿比側:我註釋行 ValidationMode = ValidationMode.ValidationEndpoint。我通過以下IS3文檔添加了該行。感謝大家。
我建議首先是樣品,並確認他們的工作。然後從樣本開始比較您的自定義項目中的差異。 –
當您收到401錯誤時,idsrv4日誌會說什麼? –
感謝球員們,@BrockAllen,正如我所說的,我可以使用開放式ID連接對ASP.Net Core MVC進行身份驗證,並使用我的ASP.Net Core IS4以客戶端憑據對ASP.Net Core WebApi進行身份驗證。但是我遇到了4.5.2 ApiResource的問題。 Jonas Axelsson我看到令牌被成功生成,但是我記得當我調用WebApi的GetAsync時什麼也沒有發生。我今天會檢查一下:)。關於 – ozgurozkanakdemirci