使用 identityserver3 2.1.1 登录后更新声明

Question

我们需要在用户登录我们的网站后更新他们的声明。这是由我们系统的另一部分更改用户许可引起的。

但是我无法理解如何在没有 logout/login 的情况下更新声明。

现在这是我们的客户端设置

 app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            //user validation host
            Authority = UrlConstants.BaseAddress,

            //Client that the user is validating against
            ClientId = guid,//if not convertet to Gui the compare from the server fails
            RedirectUri = UrlConstants.RedirectUrl,
            PostLogoutRedirectUri = UrlConstants.RedirectUrl,
            ResponseType = "code id_token token",
            Scope = "openid profile email roles licens umbraco_api umbracoaccess",

            UseTokenLifetime = false,
            SignInAsAuthenticationType = "Cookies",
            Notifications = new OpenIdConnectAuthenticationNotifications
            {

                SecurityTokenValidated = async n =>
                {
                    _logger.Info("ConfigureAuth", "Token valdidated");

                    var id = n.AuthenticationTicket.Identity;
                    var nid = new ClaimsIdentity(
                               id.AuthenticationType,
                               Constants.ClaimTypes.GivenName,
                               Constants.ClaimTypes.Role);

                    // get userinfo data
                    var uri = new Uri(n.Options.Authority + "/connect/userinfo");
                    var userInfoClient = new UserInfoClient(uri,n.ProtocolMessage.AccessToken);
                    var userInfo = await userInfoClient.GetAsync();
                    userInfo.Claims.ToList().ForEach(ui => nid.AddClaim(new Claim(ui.Item1, ui.Item2)));

                    var licens = id.FindAll(LicenseScope.Licens);
                    nid.AddClaims(licens);

                    // keep the id_token for logout
                    nid.AddClaim(new Claim("id_token", n.ProtocolMessage.IdToken));

                    n.AuthenticationTicket = new AuthenticationTicket(
                        nid,
                        n.AuthenticationTicket.Properties);
                    _logger.Info("ConfigureAuth", "AuthenticationTicket created");



                },

                RedirectToIdentityProvider = async n =>
                {
                    // if signing out, add the id_token_hint
                    if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
                    {
                        var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token").Value;
                        _logger.Debug("ConfigureAuth", "id_token for logout set on request");
                        _logger.Debug("ConfigureAuth", "Old PostLogoutRedirectUri: {0}", n.ProtocolMessage.PostLogoutRedirectUri.ToString());
                        n.ProtocolMessage.IdTokenHint = idTokenHint;

                        var urlReferrer = HttpContext.Current.Request.UrlReferrer.ToString();
                        if (!urlReferrer.Contains("localhost"))
                        {
                            n.ProtocolMessage.PostLogoutRedirectUri = GetRedirectUrl();
                        }
                        else
                        {
                            n.ProtocolMessage.PostLogoutRedirectUri = urlReferrer;
                        }

                        _logger.Debug("ConfigureAuth", string.Format("Setting PostLogoutRedirectUri to: {0}", n.ProtocolMessage.PostLogoutRedirectUri.ToString()));
                    }
                    if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.AuthenticationRequest)
                    {
                        n.ProtocolMessage.RedirectUri = GetRedirectUrl2();
                        n.ProtocolMessage.AcrValues = GetCurrentUmbracoId();
                        _logger.Debug("ConfigureAuth", string.Format("Setting RedirectUri to: {0}", n.ProtocolMessage.RedirectUri.ToString()));
                    }
                },


            }
        });

我们在 SecurityTokenValidated 中获得自定义声明

 var licens = id.FindAll(LicenseScope.Licens);
                    nid.AddClaims(licens);

我不了解如何在不登录的情况下获取此信息？非常感谢任何帮助。

Answer 1

提醒您不要将声明放入可能在会话生命周期内发生变化的令牌中。

就是说 - 您可以随时设置新的 cookie。

进入 OWIN 身份验证管理器并调用 SignIn 方法。将要序列化的声明身份传递到 cookie 中。

例如

Request.GetOwinContext().Authentication.SignIn(newIdentity);

使用 identityserver3 2.1.1 登录后更新声明

Update claims after login with identityserver3 2.1.1

thinktecture-ident-server

claims

identityserver3