我无法在我的控制器操作中访问当前登录的用户（Blazor ASP.NET Core 托管的 .NET 6 和 IdentityServer JWT）

Question

我使用 Individual Authentication VS 2022 模板创建了一个托管的 ASP.NET 核心 Blazor WASM 应用程序，除了必须从 Blazor UI 切换到 .cshtml 进行身份验证之外，该模板还包括 Duende Identity Server 配置看来，它已经做到了人们对它的期望。我遇到的一个大问题是，我似乎无法从我的控制器中访问当前登录的用户，既不使用 ControllerBase 中的用户属性，也不通过 IHttpContextAccessor，Claims Principle 实例似乎都是通过调试模式检查时为 null，同时在客户端 WASM 上，我可以访问我的主题 ID、电子邮件或我在 ProfileService 中指定的任何内容（这不是很有用，除非我想通过以下方式从服务器获取用户使用参数或其他东西从客户端发送的主题 ID...我知道这将是灾难性的..)

这是我的 Client/Program.cs:

using System.Globalization;
using CurrieTechnologies.Razor.SweetAlert2;
using Microsoft.AspNetCore.Components.Web;
using Microsoft.AspNetCore.Components.WebAssembly.Authentication;
using Microsoft.AspNetCore.Components.WebAssembly.Hosting;
using Microsoft.JSInterop;
using Proj.Client;
using Proj.Client.Auth;
using Proj.Client.Helpers;
using Proj.Client.Repository;

var builder = WebAssemblyHostBuilder.CreateDefault(args);
var services = builder.Services;
builder.RootComponents.Add<App>("#app");
builder.RootComponents.Add<HeadOutlet>("head::after ");

services.AddHttpClient<IHttpService>("Proj.ServerAPI",
    client => client.BaseAddress = new Uri(builder.HostEnvironment.BaseAddress))
    .AddHttpMessageHandler<BaseAddressAuthorizationMessageHandler>();


// Supply HttpClient instances that include access tokens when making requests to the server project
services.AddScoped(sp => sp.GetRequiredService<IHttpClientFactory>().CreateClient("Proj.ServerAPI"));

// SERVICES
services.AddOptions();
services.AddLocalization();

// builder.Services.AddScoped<DialogService>();
// builder.Services.AddScoped<NotificationService>();
// builder.Services.AddScoped<TooltipService>();
// builder.Services.AddScoped<ContextMenuService>();

services.AddApiAuthorization()
    .AddAccountClaimsPrincipalFactory<CustomUserFactory>();
var host = builder.Build();
var js = host.Services.GetRequiredService<IJSRuntime>();
var culture = await js.InvokeAsync<string>("getFromLocalStorage", "culture");
CultureInfo selectedCulture;
selectedCulture = culture == null ? new CultureInfo("en") : new CultureInfo(culture);

CultureInfo.DefaultThreadCurrentCulture = selectedCulture;
CultureInfo.DefaultThreadCurrentUICulture = selectedCulture;

await host.RunAsync();

和 Server/Program.cs:

using System.IdentityModel.Tokens.Jwt;
using Duende.IdentityServer.Services;
using Microsoft.AspNetCore.ApiAuthorization.IdentityServer;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Identity.UI.Services;
using Microsoft.EntityFrameworkCore;
using Proj.Server.Data;
using Proj.Server.DbInitializer;
using Proj.Server.Models;
using Proj.Server.Services;
using Proj.Server.Utils;

var builder = WebApplication.CreateBuilder(args);
var services = builder.Services;
// Add services to the container.
var connectionString = builder.Configuration.GetConnectionString("MySQLConnectionLocal");

var serverVersion = new MySqlServerVersion(ServerVersion.AutoDetect(connectionString));

services.AddDbContext<ApplicationDbContext>(
    dbContextOptions => dbContextOptions
        .UseMySql(connectionString, serverVersion)
        // The following three options help with debugging, but should
        // be changed or removed for production.
        .LogTo(Console.WriteLine, LogLevel.Information)
        .EnableSensitiveDataLogging()
        .EnableDetailedErrors()
);

services.AddAutoMapper(typeof(MappingConfig));
services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
services.AddDatabaseDeveloperPageExceptionFilter();
services.AddDefaultIdentity<ApplicationUser>(options =>
    {
        options.SignIn.RequireConfirmedAccount = true;
        options.Stores.MaxLengthForKeys = 80;
        options.User.RequireUniqueEmail = true;
        options.Tokens.ProviderMap.Add("CustomEmailConfirmation",
            new TokenProviderDescriptor(
                typeof(CustomEmailConfirmationTokenProvider<ApplicationUser>)));
        options.Tokens.EmailConfirmationTokenProvider = "CustomEmailConfirmation";
    })
    .AddRoles<IdentityRole>()
    .AddEntityFrameworkStores<ApplicationDbContext>();

services.AddTransient<CustomEmailConfirmationTokenProvider<ApplicationUser>>();

services.AddTransient<IEmailSender, EmailSender>();
services.Configure<AuthMessageSenderOptions>(builder.Configuration);

services.AddHttpContextAccessor();

services.AddIdentityServer()
    .AddApiAuthorization<ApplicationUser, ApplicationDbContext>()
    .AddDeveloperSigningCredential();

builder.Services.AddTransient<IProfileService, ProfileService>();
builder.Services.AddTransient<IFileStorageService, InAppStorageService>();
builder.Services.AddDataProtection();

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Remove("role");
services.AddAuthentication()
    .AddIdentityServerJwt()
    .AddGoogle(googleOptions =>
    {
        googleOptions.ClientId = builder.Configuration["Authentication:Google:ClientId"];
        googleOptions.ClientSecret = builder.Configuration["Authentication:Google:ClientSecret"];
    }).AddFacebook(facebookOptions =>
    {
        facebookOptions.AppId = builder.Configuration["Authentication:Facebook:AppId"];
        facebookOptions.AppSecret = builder.Configuration["Authentication:Facebook:AppSecret"];
    });


services.Configure<DataProtectionTokenProviderOptions>(o =>
    o.TokenLifespan = TimeSpan.FromHours(3));

services.ConfigureApplicationCookie(o =>
{
    o.ExpireTimeSpan = TimeSpan.FromDays(5);
    o.SlidingExpiration = true;
});

services.AddControllersWithViews();
services.AddRazorPages();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseMigrationsEndPoint();
    app.UseWebAssemblyDebugging();
}
else
{
    app.UseExceptionHandler("/Error");
    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    app.UseHsts();
}

app.UseHttpsRedirection();

app.UseBlazorFrameworkFiles();
app.UseStaticFiles();

app.UseRouting();

app.UseIdentityServer();
app.UseAuthentication();
app.UseAuthorization();

app.MapRazorPages();
app.MapControllers();
app.MapFallbackToFile("index.html");

app.Run();

而且我认为 ProfileService 实现也很有用：


using IdentityModel;
using Duende.IdentityServer.Models;
using Duende.IdentityServer.Services;

namespace Proj.Server.Services;
public class ProfileService : IProfileService
{
    public ProfileService()
    {
    }

    public async Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        var nameClaim = context.Subject.FindAll(JwtClaimTypes.Name);
        context.IssuedClaims.AddRange(nameClaim);

        var subClaim = context.Subject.FindAll(JwtClaimTypes.Subject);
        context.IssuedClaims.AddRange(subClaim);

        var roleClaims = context.Subject.FindAll(JwtClaimTypes.Role);
        context.IssuedClaims.AddRange(roleClaims);

        await Task.CompletedTask;
    }

    public async Task IsActiveAsync(IsActiveContext context)
    {
        await Task.CompletedTask;
    }
}

如果有人能指出正确的方向，我将不胜感激，谢谢:)

Answer 1

设置AddApiAuthorization中的选项：

builder.Services.AddIdentityServer()
    .AddApiAuthorization<ApplicationUser, ApplicationDbContext>(options =>
    {
        const string OpenId = "openid";

        options.IdentityResources[OpenId].UserClaims.Add(JwtClaimTypes.Email);
        options.ApiResources.Single().UserClaims.Add(JwtClaimTypes.Email);

        options.IdentityResources[OpenId].UserClaims.Add(JwtClaimTypes.Id);
        options.ApiResources.Single().UserClaims.Add(JwtClaimTypes.Id);

        options.IdentityResources[OpenId].UserClaims.Add(JwtClaimTypes.Name);
        options.ApiResources.Single().UserClaims.Add(JwtClaimTypes.Name);

        options.IdentityResources[OpenId].UserClaims.Add(JwtClaimTypes.Role);
        options.ApiResources.Single().UserClaims.Add(JwtClaimTypes.Role);

    });

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Remove("role");

在您的控制器中：

var name = User.FindFirst(ClaimTypes.Name)?.Value;

Answer 2

原来也描述了我遇到的同样问题，通过删除

    .AddIdentityServerJwt()

来自行

services.AddAuthentication()
        .AddIdentityServerJwt()

一切都按预期开始工作... 现在我是初学者，我不确定我是否应该注释掉那条线，它可能很重要，所以如果有人知道更好的解决方案，一定要分享...... 谢谢

我无法在我的控制器操作中访问当前登录的用户（Blazor ASP.NET Core 托管的 .NET 6 和 IdentityServer JWT）

I cannot Access the currently logged in user in my controllers actions (Blazor ASP.NET Core hosted .NET 6 and IdentityServer JWT)

asp.net-core

jwt

blazor

identityserver4

blazor-webassembly