摘要：
1、 创建IdentityServer4服务器。1.创建空ASP。NET核心项目。2.使用IdentityServer4.模型创建Config类；使用System.Collections。通用的namespaceSample｛publicstaticclassConfig｛publicstaticEnumerable＜ApiScope＞ApiScopes＝＞n
一、创建IdentityServer4服务器
1、创建一个ASP.NET Core空项目
2、创建一个Config类
using IdentityServer4.Models; using System.Collections.Generic; namespace Sample { public static class Config { public static IEnumerable<ApiScope> ApiScopes => new ApiScope[] { new ApiScope{Name="sample_api",DisplayName="Sample Api"}, new ApiScope{Name="scope2",DisplayName="Scope"} }; public static IEnumerable<Client> Clients => new Client[] { new Client { ClientId="sample_Client", ClientName="Client Credentials Client", //客户端名称 AllowedGrantTypes=GrantTypes.ClientCredentials,//客户端验证（验证模式） ClientSecrets={new Secret("511536EF-F270-4058-80CA-1C89C192F69A".Sha256())}, AllowedScopes={ "sample_api" } //访问资源范围 } }; } }
3、配置服务和管道，IdentityServer4采用的中间件形式，必须进行管道配置
1）添加服务
public void ConfigureServices(IServiceCollection services) { var builder= services.AddIdentityServer();//添加服务 builder.AddDeveloperSigningCredential();//配置开发验证模式 builder.AddInMemoryApiScopes(Config.ApiScopes);//配置内存API资源形式 builder.AddInMemoryClients(Config.Clients);//配置内存客户端访问形式 }
2）注册应用
public void Configure(IApplicationBuilder app, IWebHostEnvironment env) { if (env.IsDevelopment()) { app.UseDeveloperExceptionPage(); } app.UseIdentityServer(); }
4、测试https://localhost:5001/.well-known/openid-configuration进行GET请求，查看
2）使用https://localhost:5001/connect/token获取token
3）token为jwt加密，解析查看
二、创建ASP.NET Core API
1、nuget安装Microsoft.AspNetCore.Authentication.JwtBearer
编写API控制器
public class IdentityController : ControllerBase { [Route("api/Identity")] [Authorize] public IActionResult Get() { return new JsonResult( from claim in User.Claims select new{ claim.Type, claim.Value } ); } }
2、配置认证服务
public void ConfigureServices(IServiceCollection services) { services.AddControllers(); services.AddAuthentication("Bearer") .AddJwtBearer("Bearer", options => { options.Authority = "https://localhost:5001"; options.TokenValidationParameters = new TokenValidationParameters { ValidateAudience = false }; }); }
3、将服务加入请求管道
app.UseAuthentication();
4、测试
三、创建客户端程序访问
测试客户端代码
var client = new HttpClient(); var disco = await client.GetDiscoveryDocumentAsync("https://localhost:5001"); if (disco.IsError) { Console.WriteLine(disco.Error); return; } var tokenResponse = await client.RequestClientCredentialsTokenAsync( new ClientCredentialsTokenRequest { Address=disco.TokenEndpoint, ClientId= "sample_Client", ClientSecret= "511536EF-F270-4058-80CA-1C89C192F69A" }); if (tokenResponse.IsError) { Console.WriteLine(tokenResponse.Error); return; } Console.WriteLine(tokenResponse.Json);
测试结果
测试请求资源
var apiclient = new HttpClient(); apiclient.SetBearerToken(tokenResponse.AccessToken); var response = await apiclient.GetAsync("https://localhost:6001/api/Identity"); if (!response.IsSuccessStatusCode) { Console.WriteLine(response.StatusCode); return; } var context = await response.Content.ReadAsStringAsync(); Console.WriteLine(); Console.WriteLine(JArray.Parse(context)); Console.ReadLine();
配置API资源的授权
services.AddAuthorization(options => { options.AddPolicy("ApiScope", builder => { builder.RequireAuthenticatedUser(); builder.RequireClaim("scope", "sample_api"); }); });