從持票人令牌生成身份

Question

有沒有辦法將持有人令牌字符串並在asp.net中手動將其轉換爲Identity對象？

乾杯， 阿齊茲

Answer 1

令牌只是持有索賠，它只是用來驗證到資源。如果其中一項索賠持有用戶信息，您可以創建一個身份並向其分配索賠。

public void ValidateBearerToken(OwinContext context) 
{ 
    try 
    { 
     var tokenHandler = new JwtSecurityTokenHandler(); 
     byte[] securityKey = GetBytes("some key"); //this should come from a config file 

     SecurityToken securityToken; 

     var validationParameters = new TokenValidationParameters() 
     { 
      ValidAudience = "http://localhost:2000", 
      IssuerSigningToken = new BinarySecretSecurityToken(securityKey), 
      ValidIssuer = "Self" 
     }; 

     var auth = context.Request.Headers["Authorization"]; 

     if (!string.IsNullOrWhiteSpace(auth) && auth.Contains("Bearer")) 
     { 
      var token = auth.Split(' ')[1]; 

      var principal = tokenHandler.ValidateToken(token, validationParameters, out securityToken); 

      context.Request.User = principal; 
     } 
    } 
    catch (Exception ex) 
    { 
     var message = ex.Message; 
    } 
} 

Answer 2

首先，您需要創建一些基於令牌的聲明，然後創建ClaimsIdentity並使用它來授權用戶。

public ActionResoult Login(string token) 
{ 
    if(_tokenManager.IsValid(token))   
    { 
     // optionally you have own user manager which returns roles and user name from token 
     // no matter how you store users and roles 
     var user=_myUserManager.GetUserRoles(token); 

     // user is valid, going to authenticate user for my App 
     var ident = new ClaimsIdentity(
      new[] 
      { 
       // adding following 2 claim just for supporting default antiforgery provider 
       new Claim(ClaimTypes.NameIdentifier, token), 
       new Claim("http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider", "ASP.NET Identity", "http://www.w3.org/2001/XMLSchema#string"), 

       // an optional claim you could omit this 
       new Claim(ClaimTypes.Name, user.Username), 

       // populate assigned user's role form your DB 
       // and add each one as a claim 
       new Claim(ClaimTypes.Role, user.Roles[0]), 
       new Claim(ClaimTypes.Role, user.Roles[1]), 
       // and so on 
      }, 
      DefaultAuthenticationTypes.ApplicationCookie); 

     // Identity is sign in user based on claim don't matter 
     // how you generated it    
     HttpContext.GetOwinContext().Authentication.SignIn(
      new AuthenticationProperties { IsPersistent = false }, ident); 

     // auth is succeed, just from a token 
     return RedirectToAction("MyAction"); 
    } 
    // invalid user   
    ModelState.AddModelError("", "We could not authorize you :("); 
    return View(); 
} 

現在你可以使用Authorize過濾器，以及：

[Authorize] 
public ActionResult Foo() 
{ 
} 

// since we injected user roles to Identity we could do this as well 
[Authorize(Roles="admin")] 
public ActionResult Foo() 
{ 
    // since we injected our authentication mechanism to Identity pipeline 
    // we have access current user principal by calling also 
    // HttpContext.User 
} 

而且我鼓勵你有看Token Based Authentication Sample從我的github回購是一個非常簡單的工作示例。