使用 asp.net 身份在身份服务器 4 中实现角色
implementing roles in identity server 4 with asp.net identity
我正在使用身份服务器 4 作为令牌服务开发 asp.net MVC 应用程序。我还有一个 api,它有一些安全资源。我想为 api 实施角色(授权)。我想确保只有具有有效角色的授权资源才能访问 api 端点,否则会得到 401(未经授权的错误)。
这是我的配置:
客户端
new Client()
{
ClientId = "mvcClient",
ClientName = "MVC Client",
AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
ClientSecrets = new List<Secret>()
{
new Secret("secret".Sha256())
},
RequireConsent = false;
// where to redirect to after login
RedirectUris = { "http://localhost:5002/signin-oidc" },
// where to redirect to after logout
PostLogoutRedirectUris = { "http://localhost:5002" },
AllowedScopes =
{
StandardScopes.OpenId.Name,
StandardScopes.Profile.Name,
StandardScopes.OfflineAccess.Name,
StandardScopes.Roles.Name,
"API"
}
}
范围
return new List<Scope>()
{
StandardScopes.OpenId, // subject id
StandardScopes.Profile, // first name, last name
StandardScopes.OfflineAccess, // requesting refresh tokens for long lived API access
StandardScopes.Roles,
new Scope()
{
Name = "API",
Description = "API desc",
Type = ScopeType.Resource,
Emphasize = true,
IncludeAllClaimsForUser = true,
Claims = new List<ScopeClaim>
{
new ScopeClaim(ClaimTypes.Name),
new ScopeClaim(ClaimTypes.Role)
}
}
};
用户
new InMemoryUser()
{
Subject = "1",
Username = "testuser",
Password = "password",
Claims = new List<Claim>()
{
new Claim("name", "Alice"),
new Claim("Website", "http://alice.com"),
new Claim(JwtClaimTypes.Role, "admin")
}
}
在服务器启动时我添加了这个:
services.AddIdentityServer()
.AddTemporarySigningCredential()
.AddSigningCredential(证书)
.AddInMemoryClients(Config.GetClients())
.AddInMemoryScopes(Config.GetScopes())
.AddInMemoryUsers(Config.GetUsers())
在 api 启动时,我有这个:
app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions()
{
Authority = "http://localhost:5000",
ScopeName = "NamfusAPI",
RequireHttpsMetadata = false
});
在 api 控制器中,我有这个:
[Authorize(Roles = "admin")]
public IActionResult Get()
{
return new JsonResult(from c in User.Claims select new {c.Type, c.Value });
}
在 MVC 客户端启动时,我有这个:
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
AuthenticationScheme = "Cookies"
});
var oidcOptions = new OpenIdConnectOptions()
{
AuthenticationScheme = "oidc",
SignInScheme = "Cookies",
Authority = "http://localhost:5000",
RequireHttpsMetadata = false,
ClientId = "mvcClient",
ClientSecret = "secret",
SaveTokens = true,
GetClaimsFromUserInfoEndpoint = true,
ResponseType = "code id_token", // hybrid flow
};
oidcOptions.Scope.Clear();
oidcOptions.Scope.Add("openid");
oidcOptions.Scope.Add("profile");
oidcOptions.Scope.Add("NamfusAPI");
oidcOptions.Scope.Add("offline_access");
oidcOptions.Scope.Add("roles");
我正在尝试这样调用 api:
public async Task<IActionResult> CallApiUsingUserAccessToken()
{
var accessToken = await HttpContext.Authentication.GetTokenAsync("access_token");
var client = new HttpClient();
client.SetBearerToken(accessToken);
var content = await client.GetStringAsync("http://localhost:5001/identity");
ViewBag.Json = JArray.Parse(content).ToString();
return View("json");
}
我获得了访问令牌,但是当调用 api (identity/get) 时,我收到 302 错误禁止访问(在 chrome 网络中它显示 500 内部服务器错误)。如果我从
更改 API 授权属性
[Authorize(Roles = "admin")]
public IActionResult Get()
至(无角色):
[Authorize]
public IActionResult Get()
它有效,我从 api 在 mvc 应用程序中获取数据。我如何在此代码中应用角色。
求推荐。
首先,您需要在 OpenIdConnectOptions() 中请求 "API" 范围。
oidcOptions.Scope.Add("API");
或
Scope = { "API", "offline_access",..},
然后您需要检查角色声明是否包含在您的 API 控制器可用的声明列表中(不要在授权属性中应用角色过滤器。在控制器方法中放置一个调试点并展开用户 属性)。检查您收到的角色声明类型(在声明集合中列出)是否匹配 User.Identity.RoleClaimType
属性
如果您拥有的角色声明类型与 User.Identity.RoleClaimType
不匹配,则具有角色过滤器的授权属性将不起作用。您可以在 IdentityServerAuthenticationOptions() 中设置正确的 RoleClaimType
,如下所示
app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions
{
Authority = "http://localhost:5000",
ScopeName = "API",
RoleClaimType = ClaimTypes.Role,
RequireHttpsMetadata = false
});
我正在使用身份服务器 4 作为令牌服务开发 asp.net MVC 应用程序。我还有一个 api,它有一些安全资源。我想为 api 实施角色(授权)。我想确保只有具有有效角色的授权资源才能访问 api 端点,否则会得到 401(未经授权的错误)。
这是我的配置:
客户端
new Client()
{
ClientId = "mvcClient",
ClientName = "MVC Client",
AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
ClientSecrets = new List<Secret>()
{
new Secret("secret".Sha256())
},
RequireConsent = false;
// where to redirect to after login
RedirectUris = { "http://localhost:5002/signin-oidc" },
// where to redirect to after logout
PostLogoutRedirectUris = { "http://localhost:5002" },
AllowedScopes =
{
StandardScopes.OpenId.Name,
StandardScopes.Profile.Name,
StandardScopes.OfflineAccess.Name,
StandardScopes.Roles.Name,
"API"
}
}
范围
return new List<Scope>()
{
StandardScopes.OpenId, // subject id
StandardScopes.Profile, // first name, last name
StandardScopes.OfflineAccess, // requesting refresh tokens for long lived API access
StandardScopes.Roles,
new Scope()
{
Name = "API",
Description = "API desc",
Type = ScopeType.Resource,
Emphasize = true,
IncludeAllClaimsForUser = true,
Claims = new List<ScopeClaim>
{
new ScopeClaim(ClaimTypes.Name),
new ScopeClaim(ClaimTypes.Role)
}
}
};
用户
new InMemoryUser()
{
Subject = "1",
Username = "testuser",
Password = "password",
Claims = new List<Claim>()
{
new Claim("name", "Alice"),
new Claim("Website", "http://alice.com"),
new Claim(JwtClaimTypes.Role, "admin")
}
}
在服务器启动时我添加了这个:
services.AddIdentityServer() .AddTemporarySigningCredential() .AddSigningCredential(证书) .AddInMemoryClients(Config.GetClients()) .AddInMemoryScopes(Config.GetScopes()) .AddInMemoryUsers(Config.GetUsers())
在 api 启动时,我有这个:
app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions()
{
Authority = "http://localhost:5000",
ScopeName = "NamfusAPI",
RequireHttpsMetadata = false
});
在 api 控制器中,我有这个:
[Authorize(Roles = "admin")]
public IActionResult Get()
{
return new JsonResult(from c in User.Claims select new {c.Type, c.Value });
}
在 MVC 客户端启动时,我有这个:
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
app.UseCookieAuthentication(new CookieAuthenticationOptions()
{
AuthenticationScheme = "Cookies"
});
var oidcOptions = new OpenIdConnectOptions()
{
AuthenticationScheme = "oidc",
SignInScheme = "Cookies",
Authority = "http://localhost:5000",
RequireHttpsMetadata = false,
ClientId = "mvcClient",
ClientSecret = "secret",
SaveTokens = true,
GetClaimsFromUserInfoEndpoint = true,
ResponseType = "code id_token", // hybrid flow
};
oidcOptions.Scope.Clear();
oidcOptions.Scope.Add("openid");
oidcOptions.Scope.Add("profile");
oidcOptions.Scope.Add("NamfusAPI");
oidcOptions.Scope.Add("offline_access");
oidcOptions.Scope.Add("roles");
我正在尝试这样调用 api:
public async Task<IActionResult> CallApiUsingUserAccessToken()
{
var accessToken = await HttpContext.Authentication.GetTokenAsync("access_token");
var client = new HttpClient();
client.SetBearerToken(accessToken);
var content = await client.GetStringAsync("http://localhost:5001/identity");
ViewBag.Json = JArray.Parse(content).ToString();
return View("json");
}
我获得了访问令牌,但是当调用 api (identity/get) 时,我收到 302 错误禁止访问(在 chrome 网络中它显示 500 内部服务器错误)。如果我从
更改 API 授权属性 [Authorize(Roles = "admin")]
public IActionResult Get()
至(无角色):
[Authorize]
public IActionResult Get()
它有效,我从 api 在 mvc 应用程序中获取数据。我如何在此代码中应用角色。
求推荐。
首先,您需要在 OpenIdConnectOptions() 中请求 "API" 范围。
oidcOptions.Scope.Add("API");
或
Scope = { "API", "offline_access",..},
然后您需要检查角色声明是否包含在您的 API 控制器可用的声明列表中(不要在授权属性中应用角色过滤器。在控制器方法中放置一个调试点并展开用户 属性)。检查您收到的角色声明类型(在声明集合中列出)是否匹配 User.Identity.RoleClaimType
属性
如果您拥有的角色声明类型与 User.Identity.RoleClaimType
不匹配,则具有角色过滤器的授权属性将不起作用。您可以在 IdentityServerAuthenticationOptions() 中设置正确的 RoleClaimType
,如下所示
app.UseIdentityServerAuthentication(new IdentityServerAuthenticationOptions
{
Authority = "http://localhost:5000",
ScopeName = "API",
RoleClaimType = ClaimTypes.Role,
RequireHttpsMetadata = false
});