将 Core MVC 客户端与 IdentityServer v3 一起使用 - 客户端应用程序未知或未授权

Question

我有一个非核心 webapi 和一个身份服务器 v3。现在我想实现一个 asp 核心网站。 asp 核心测试网站在 http://localhost:49946/ 上运行是否可以将 asp 核心站点与 identityserver v3 sts 服务器一起使用？有任何已知问题吗？

我试过了，但我总是得到

The client application is not known or is not authorized.

我确保重定向 uri 和客户端 ID 匹配。

这是我在身份服务器中的客户端配置

  return new Client
            {
                Enabled = true,
                ClientId = "website",
                ClientName = "Site",
                Flow = Flows.Implicit,
                AllowedScopes = new List<string>
                {
                    Constants.StandardScopes.OpenId,
                    Constants.StandardScopes.Email,
                    Constants.StandardScopes.Profile,
                    Constants.StandardScopes.AllClaims,
                    Constants.StandardScopes.Roles,

                    "read","warehouseapi"

                },
                RedirectUris = new List<string>
                {"http://localhost:49946/"
                },
                PostLogoutRedirectUris = new List<string>
                {
                    "http://localhost:49946/"
                }
            };

这里是 asp 核心 mvc 客户端的配置

 app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
            {
                AuthenticationScheme = "oidc",
                SignInScheme = "Cookies",

                Authority = "http://localhost:7890",
                RequireHttpsMetadata = false,

                ClientId = "website",

                ResponseType = "id_token token",
                Scope = { "openid profile email warehouseapi" },

                GetClaimsFromUserInfoEndpoint = true,
                SaveTokens = true,
                AutomaticAuthenticate = true,
                AutomaticChallenge = true,
            });

这里是客户端要验证时重定向到的url。在那里你可以看到重定向 uri 设置为 http://localhost:49946/

http://localhost:7890/connect/authorize?client_id=website&redirect_uri=http%3A%2F%2Flocalhost%3A49946%2Fsignin-oidc&response_type=id_token%20token&scope=openid%20profile%20openid%20profile%20email%20warehouseapi&response_mode=form_post&nonce=636115164423104247.ZjY0MjY4OTctZWY3Ny00MGE2LTg4NDAtOWEzZWQyMmQ0NDY5YzJiOWRiNDQtYWY4Yy00MjE2LWE5ZWEtNTA3ZmU3MThkNzBi&state=CfDJ8Faq7VwoA29ApMd_ECq59Rnz2OH_juBD61Mbr40-8VxMsE4i5s5i-jNyb4LdOBYcCAvojnXLPzGy5fvm3c0eNcCnALfy2M2Pl_k0eXcxwXIlF9D_GBmPH5EwsQTXXP5jNBaPuFuxpFM-5tbdSkiqQbdpeddgO7LBPqqxlHcu3MB7e0MOBcPsVOKcTfXwUMG_cWDCoUldgu4k-CjunCTsXOnS7VWpg8ICEP8fcMM8q5GY8KfZFHoOPzu5_24SOLhAeujPF2l_YkVQJRY-QMmv-IWThjk97ewZE8Pl8uIyof38B0lRtbYeE0ChBbM4Wx5O-3yFtTVaT46gtXxqdn4lny39Te1b0SFsG5-LqzZrtTw-RZ_EMZO9wbdd4uwXoifjXg

这只是兼容性问题吗？我在监督什么？

-- 更新

感谢最小权限的提示，我在日志中找到了解决方案。有一个意外的子路径 /signin-oidc

Trace 我看到了

2016-10-08 13:07:41.450 +02:00 [Information] Start authorize request
2016-10-08 13:07:41.465 +02:00 [Information] Start authorize request protocol validation
2016-10-08 13:07:41.498 +02:00 [Error] "Invalid redirect_uri: http://localhost:49946/signin-oidc"
 "{
  \"ClientId\": \"website\",
  \"ClientName\": \"Pluto Site\",
  \"RedirectUri\": \"http://localhost:49946/signin-oidc\",
  \"AllowedRedirectUris\": [
    \"http://localhost:49946/\"
  ],
  \"SubjectId\": \"unknown\",
  \"Flow\": \"AuthorizationCode\",
  \"RequestedScopes\": \"\",
  \"Raw\": {
    \"client_id\": \"website\",
    \"redirect_uri\": \"http://localhost:49946/signin-oidc\",
    \"response_type\": \"id_token token\",
    \"scope\": \"openid profile openid profile email warehouseapi\",
    \"response_mode\": \"form_post\",
    \"nonce\": \"636115215901620557.ZTNkNmFmYjMtOTY4MC00ODE3LWExMmEtYTc0OWYzYzRkZmY4MDRlM2JjZjUtZGViNC00MjIyLWI1MTktOTM4Y2U2MWFkYzkw\",
    \"state\": \"CfDJ8Faq7VwoA29ApMd_ECq59RmXQrEZdMEoqQ9onYQLXRTRz-ge13paqnwmi_xjJMoVpaItur0ETX08PxoOzQ-YUn--7DR1pvaxqUngPYOiS44j4t9bS4_yiu7Gb1fjU_R5OiZU2cc-0T6PzT_WgUZ48rqC-unHdJqd_NgE7D_9H9ZT1a-2J3GBZEkfh4LOCHHtfcuG06lgXTPn85fkVKcWxbqn6pTrCLRhiRfH9h41e6bvKsGTOmzJ45G9HRpEAlyo7GkgtFgrrshKNo0xDsIxXjAhxp_me_tipBEpyHT8Mo7T9G4-HTtP8FSnb7YurSWjfywOpEG136-T7wvksCEwlMGrL8k90v6prM-bwefOhCFA-8vJO1hvtKkF3wPSgeMiYg\"
  }
}"

Answer 1

在 asp 核心中有一个子路径静默附加

soo http://localhost:49946/signin-oidc 必须添加到重定向 uris

将 Core MVC 客户端与 IdentityServer v3 一起使用 - 客户端应用程序未知或未授权

Using Core MVC Client with IdentityServer v3 - The client application is not known or is not authorized

asp.net

openid

identityserver3

identityserver4