IdentityServer4 实践 使用客户端凭据保护API

1-创建公共类库 IDS4.Core

1.1-引用 IdentityServer4 

1.2-创建 Config.cs 配置类

using IdentityServer4.Models;

namespace IDS4.Core.ClientCredentials
{
    /// <summary>
    /// 配置文件（使用客户端凭据）
    /// </summary>
    public static class Config
    {
        private const string api_scope_one = "api1";

        public static IEnumerable<ApiScope> ApiScopes =>
                                               new List<ApiScope>
                                               {
                                                    new ApiScope(api_scope_one, "第一个API")
                                               };

        public static IEnumerable<Client> Clients =>
                                                new List<Client>
                                                {
                                                    new Client
                                                    {
                                                        //可以将 ClientId 和 ClientSecret 视为应用程序本身的登录名和密码
                                                        ClientId = "client",

                                                        // 没有交互式用户，使用 clientid/secret 进行身份验证
                                                        AllowedGrantTypes = GrantTypes.ClientCredentials,

                                                        // 用于身份验证的密钥
                                                        ClientSecrets =
                                                        {
                                                            new Secret("secret".Sha256())
                                                        },

                                                        // 客户端有权访问的范围
                                                        AllowedScopes = { api_scope_one }
                                                    }
                                                };

    }
}

2-创建身份服务器（ Identity Server）IDS4.Server

PS:使用站点空模板

2.1-引用IDS4.Core

 

2.2-配置ConfigService

builder.Services.AddIdentityServer()
    // 这仅适用于没有证书可以使用的开发场景。
    .AddDeveloperSigningCredential()
    .AddInMemoryApiScopes(IDS4.Core.ClientCredentials.Config.ApiScopes)
    .AddInMemoryClients(IDS4.Core.ClientCredentials.Config.Clients);

2.3-配置ConfigApp

var app = builder.Build();
app.UseIdentityServer();

Ps:完整的Program.cs

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddIdentityServer()
    // 这仅适用于没有证书可以使用的开发场景。
    .AddDeveloperSigningCredential()
    .AddInMemoryApiScopes(IDS4.Core.ClientCredentials.Config.ApiScopes)
    .AddInMemoryClients(IDS4.Core.ClientCredentials.Config.Clients);


var app = builder.Build();
app.UseIdentityServer();

app.MapGet("/", () => "Hello World!");

app.Run();

2.4-端口 5010

http://localhost:5010

3-创建API站点 IDS4.API

PS:选 ASP.Net Core Web API 模板

3.1-引用 Microsoft.AspNetCore.Authentication.JwtBearer 类库

3.2-配置ConfigService

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
    {
        //验证传入的令牌以确保它来自受信任的发行者
        options.Authority = "http://localhost:5010";
        // 禁用HTTPS
        options.RequireHttpsMetadata = false;
        options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
        {
            //验证令牌是否有效与此 API 一起使用（又名 audience 受众）
            ValidateAudience = false
        };
    });

3.3-配置ConfigApp

app.UseAuthentication();

Ps:完整的Program.cs

using Microsoft.AspNetCore.Authentication.JwtBearer;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.

builder.Services.AddControllers();
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
    {
        //验证传入的令牌以确保它来自受信任的发行者
        options.Authority = "http://localhost:5010";
        // 禁用HTTPS
        options.RequireHttpsMetadata = false;
        options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
        {
            //验证令牌是否有效与此 API 一起使用（又名 audience 受众）
            ValidateAudience = false
        };
    });
// Learn more about configuring Swagger/OpenAPI at https://aka.ms/aspnetcore/swashbuckle
builder.Services.AddEndpointsApiExplorer();
builder.Services.AddSwaggerGen();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (app.Environment.IsDevelopment())
{
    app.UseSwagger();
    app.UseSwaggerUI();
}

app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

app.Run();

3.4-端口 5011

http://localhost:5011

 

3.5-添加 IdentityController 控制器

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

// For more information on enabling Web API for empty projects, visit https://go.microsoft.com/fwlink/?LinkID=397860

namespace IDS4.API.Controllers
{
    [Route("api/[controller]")]
    [ApiController]
    [Authorize]
    public class IdentityController : ControllerBase
    {
        [HttpGet]
        public IActionResult Get()
        {
            return new JsonResult(from c in User.Claims select new { c.Type, c.Value });
        }
    }
}

4-创建客户端 IDS4.Web

 

 

4.1-引用 IdentityModel 类库

4.2-从元数据中发现端点

 var client = new HttpClient();
            var disco = await client.GetDiscoveryDocumentAsync(new DiscoveryDocumentRequest
            {
                Address = "http://localhost:5010",
                Policy = new DiscoveryPolicy { RequireHttps = false } //禁用Https
            });
if(disco==null || disco.IsError)
{
   Console.WriteLine(disco.Error);
  return;
}

就是解析 http://localhost:5010/.well-known/openid-configuration 这个地址

4.3-请求令牌

// 请求令牌
var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
{
    Address = disco.TokenEndpoint,

    ClientId = "client",
    ClientSecret = "secret",
    Scope = "api1"
});

if (tokenResponse.IsError)
{
    Console.WriteLine(tokenResponse.Error);
    return;
}

Console.WriteLine(tokenResponse.Json);

4.4-调用API

// 调用api
var apiClient = new HttpClient();
apiClient.SetBearerToken(tokenResponse.AccessToken);

var response = await apiClient.GetAsync("https://localhost:6001/identity");
if (!response.IsSuccessStatusCode)
{
    Console.WriteLine(response.StatusCode);
}
else
{
    var content = await response.Content.ReadAsStringAsync();
    Console.WriteLine(JArray.Parse(content));
}

Ps:完整的Index.cshtml.cs 的get 方法

public async Task OnGet()
        {
            var client = new HttpClient();
            var disco = await client.GetDiscoveryDocumentAsync(new DiscoveryDocumentRequest
            {
                Address = "http://localhost:5010",
                Policy = new DiscoveryPolicy { RequireHttps = false } //禁用Https
            });
            if (disco != null)
            {
                if (disco.IsError)
                    ViewData["data"] = disco.Error;
                else
                {
                    var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
                    {
                        Address = disco.TokenEndpoint,
                        ClientId = "client",
                        ClientSecret = "secret",
                        Scope = "api1"
                    });
                    if (tokenResponse != null)
                    {
                        if (tokenResponse.IsError)
                            ViewData["data"] = tokenResponse.Json;
                        else
                        {
                            var apiClient = new HttpClient();
                            apiClient.SetBearerToken(tokenResponse.AccessToken);

                            var response = await apiClient.GetAsync("http://localhost:5011/api/identity");
                            if (!response.IsSuccessStatusCode)
                            {
                                Console.WriteLine(response.StatusCode);
                                ViewData["data"] = response.StatusCode;
                            }
                            else
                            {
                                var content = await response.Content.ReadAsStringAsync();
                                ViewData["data"] = content;
                                Console.WriteLine(JArray.Parse(content));
                            }
                        }
                    }
                    else
                    {
                        ViewData["data"] = "访问失败";
                    }
                }
            }
            else
            {
                ViewData["data"] = "访问失败";
            }
        }

4.5-Index.cshtml

PS:鉴权时序图