如何验证使用 Google 登录的用户是否仍然有效？

Question

我是运行 .NET Core v3.1 和 Blazor，并且已经使用 Google 实现了授权，仅限于我们在 Google G Suite 中的域，如此处所述：https://www.jerriepelser.com/blog/forcing-users-sign-in-gsuite-domain-account/

Login/logout 工作正常，但是当登录的用户在 Google G Suite 中被阻止或删除时，用户将保持登录到我的应用程序，直到他退出应用程序。当他不注销时，他可以继续使用该应用程序。

我希望每小时刷新一次。

这是我的 login.cshtml.cs:

        public async Task<IActionResult> OnGetCallbackAsync(string returnUrl = null, string remoteError = null)
        {
            // Get the information about the user from the external login provider
            var GoogleUser = User.Identities.FirstOrDefault();
            if (GoogleUser.IsAuthenticated)
            {
                var authProperties = new AuthenticationProperties
                {
                    IsPersistent = true,
                    RedirectUri = Request.Host.Value,
                    IssuedUtc = System.DateTime.UtcNow,
                    ExpiresUtc = System.DateTime.UtcNow.AddHours(1)
                };
                await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme, new ClaimsPrincipal(GoogleUser), authProperties);
            }
            return LocalRedirect("/");
        }

我已经添加了 IssuedUtc 和 ExpiresUtc 但这并没有改变任何东西。

Answer 1

您必须启用调用 Google API 的功能（https://www.googleapis.com/auth/admin.directory.user, https://www.googleapis.com/auth/admin.directory.group) to get this information, but, before you can do that, the G-Suite Domain Admin has to authorize that access using https://developers.google.com/admin-sdk/directory/v1/guides/authorizing

这解释了这个过程： https://developers.google.com/admin-sdk/directory/v1/guides/delegation

您将希望看到此 GitHub 代码示例的存储库： https://github.com/googleapis/google-api-dotnet-client

这是一些伪代码：

string[] Scopes = {
DirectoryService.Scope.AdminDirectoryGroup,
DirectoryService.Scope.AdminDirectoryUser
};

GoogleCredential credential;

//redirectUrl = this.Request.Host.Value;
string keyfilepath = "yourKeyFile.json";

using (var stream = new FileStream(keyfilepath, FileMode.Open, FileAccess.Read))
{
    // As we are using admin SDK, we need to still impersonate user who has admin access
    //  https://developers.google.com/admin-sdk/directory/v1/guides/delegation
    credential = GoogleCredential.FromStream(stream)
            .CreateScoped(Scopes).CreateWithUser(EmailOfGoogleDomainAdmin);
}

// Create Directory API service.
var service = new DirectoryService(new BaseClientService.Initializer()
{
    HttpClientInitializer = credential,
    ApplicationName = "ApplicationName",
});

// G Suite User to get information about
// This test user should be suspended
var gs_email = UserToCHeck;

var request = service.Users.Get(gs_email);

var result = request.Execute();

Console.WriteLine("Full Name: {0}", result.Name.FullName);
Console.WriteLine("Email:     {0}", result.PrimaryEmail);
Console.WriteLine("ID:        {0}", result.Id);
Console.WriteLine("Is Admin:  {0}", result.IsAdmin);
Console.WriteLine("Is Suspended:  {0}", result.Suspended);

如何验证使用 Google 登录的用户是否仍然有效？

How to validate if a user logged in with Google is still valid?

authentication

google-authentication

refresh-token

asp.net-core-3.1