asp.net core网关Ocelot的简单介绍& Ocelot集成Identity认证

文章简介

•  Ocelot网关简介

•  Ocelot集成Idnetity认证处理

Ocelot网关简介

Ocelot是一个基于netcore实现的API网关，本质是一组按特定顺序排列的中间件。Ocelot内部实现了路由转发，限流，熔断，请求聚合，服务发现（集成consul，eureka等），负载均衡，认证（集成Identity）功能。

这里简单介绍下ocelot的配置文件，也就是说以下图为例，请求地址为localhost:18002/users会被转发到localhost:18000/api/users

更多关于Ocelot的介绍可以看https://www.cnblogs.com/jesse2013/p/net-core-apigateway-ocelot-docs.html这篇博客或者https://ocelot.readthedocs.io/en/latest/index.html官方文档。

Ocelot集成Identity认证

　　这里我们实现一个Ocelot集成Idnetity做认证的Demo；我们这里客户端请求ocelot网关服务，ocelot网关服务集成Idnetity获取token，再通过返回的token请求用户信息服务，如下图所示。这里扩展一个知识点，我们的Identity服务使用扩展认证，这个认证需要实现IExtensionGrantValidator接口的ValidateAsync方法，从http请求上下文中获取自定义参数，获取方法为context.Request.Raw。（oauth2默认的认证方式有password，authcode等，扩展认证文档=》http://docs.identityserver.io/en/latest/topics/extension_grants.html?highlight=IExtensionGrantValidator）

 

 首先我们创建三个服务，分别为Ocelot网关服务（端口号设置为18002），Identity认证服务（端口号设置为18001），UserInfo用户信息服务（端口号设置为18000），如下图所示=》

 

• 首先我们配置User.API服务，这个服务很简单，开放一个返回用户信息的端口，关键代码如下所示 =》 

namespace User.API.Controllers
{
    [Route("api/users")]
    public class UserController : BaseController
    {
        private readonly UserContext _userContext;
        private ILogger<UserController> _logger;
        public UserController(UserContext userContext, ILogger<UserController> logger)
        {
            _userContext = userContext;
            _logger = logger;
        }
        [HttpGet]
        public async Task<IActionResult> Get()

        {
            var user = await _userContext.Set<AppUser>()
                .AsNoTracking()
                .Include(u => u.userProperties)
                .FirstOrDefaultAsync(t => t.Id == 1);
            if (user == null)
            {
                _logger.LogError("登录用户为空");
                throw new UserOperationException("用户登录异常");
            }
            return Json(user);
        }
..... other

        [Route("check_or_create")]
        [HttpPost]
        public async Task<IActionResult> CheckOrCreate(string phone)
        {
            var user = await _userContext.Users.SingleOrDefaultAsync(u => u.Phone == phone);

            if (user == null)
            {
                user = new AppUser { Phone = phone };
                _userContext.Users.Add(new AppUser { Phone = phone });
                await _userContext.SaveChangesAsync();
            }
            return Ok(new {
                user.Id,
                user.Name,
                user.Company,
                user.Title,
                user.Avatar
            });
        }

• 然后配置我们的Identity认证服务，引入IdnttiyServer4 nuget包，添加Ids4配置文件Config.cs。注意：这里的client_grant_type为sms_auth_code

    public class Config
    {
        public static IEnumerable<Client> GetClients()
        {
            return new List<Client>{
                new Client{
                    ClientId = "android",
                    ClientSecrets = new List<Secret>
                    {
                        new Secret("secret".Sha256())
                    },
                    RefreshTokenExpiration  = TokenExpiration.Sliding,
                    AllowOfflineAccess = true,
                    RequireClientSecret = false,
                    AllowedGrantTypes = new List<string>{"sms_auth_code"},
                    AlwaysIncludeUserClaimsInIdToken = true,
                    AllowedScopes = new List<string>
                    {
                        "gateway_api",
                        IdentityServerConstants.StandardScopes.OfflineAccess,
                        IdentityServerConstants.StandardScopes.OpenId,
                        IdentityServerConstants.StandardScopes.Profile
                    }
                }
            };
        }
        public static IEnumerable<IdentityResource> GetIdentityResources()
        {
            return new List<IdentityResource>
            {
                new IdentityResources.OpenId(),
                new IdentityResources.Profile()
            };
        }
        public static IEnumerable<ApiResource> GetApiResources()
        {
            return new List<ApiResource>
            {
                new ApiResource("gateway_api","user service")
            };
        }
    }

　　编写我们的自定义自定义验证服务类，我们验证客户端传入的手机号&验证码是否正确（Demo逻辑中只需要填写正确手机号就可以了）

    public class SmsAuthCodeGrantType : IExtensionGrantValidator
    {
        private IUserService _userService;
        private IAuthCodeService _authCodeService;
        public SmsAuthCodeGrantType(IUserService userService, IAuthCodeService authCodeService)
        {
            _userService = userService;
            _authCodeService = authCodeService;
        }
        public string GrantType => "sms_auth_code";
        /// <summary>
        /// 
        /// </summary>
        /// <param name="context"></param>
        /// <returns></returns>
        public async Task ValidateAsync(ExtensionGrantValidationContext context)
        {
            var phone = context.Request.Raw["phone"];
            var code = context.Request.Raw["auth_code"];
            var errorValidationResult = new GrantValidationResult(TokenRequestErrors.InvalidGrant);


            if (string.IsNullOrWhiteSpace(phone) || string.IsNullOrWhiteSpace(code))
            {
                context.Result = errorValidationResult;
                return;
            }
            //检查验证码
            if (!_authCodeService.Validate(phone, code))
            {
                context.Result = errorValidationResult;
                return;
            }
            //完成用户注册
            var userinfo = await _userService.CheckOrCreate(phone);
            if (userinfo== null)
            {
                context.Result = errorValidationResult;
                return;
            }
            var claims = new Claim[]
            {
                new Claim("name",userinfo.Name??string.Empty),
                new Claim("company",userinfo.Company??string.Empty),
                new Claim("title",userinfo.Tiltle??string.Empty),
                new Claim("avatar",userinfo.Avatar??string.Empty),
            }; 
            context.Result = new GrantValidationResult(userinfo.Id.ToString(), 
                GrantType,
                claims);
        }
    }

　　其他的验证服务和与User.API服务通信的服务类和返回的UserInfoDto

    public class UserInfo
    {
        public int Id { get; set; }
        public string Name { get; set; }
        public string Company { get; set; }
        public string Tiltle { get; set; }
        public string Avatar { get; set; }
    }

    public interface IAuthCodeService
    {
        /// <summary>
        /// 根据手机号验证验证码
        /// </summary>
        /// <param name="phone"></param>
        /// <param name="authCode"></param>
        /// <returns></returns>
        bool Validate(string phone, string authCode);
    }

    public class TestAuthCodeService : IAuthCodeService
    {
        public bool Validate(string phone, string authCode)
        {
            return true;
        }
    }

    public interface IUserService
    {
        /// <summary>
        /// 检查手机号是否注册，未注册就注册
        /// </summary>
        /// <param name="phone"></param>
        Task<UserInfo> CheckOrCreate(string phone);
    }

    public class UserService : IUserService
    {
        private HttpClient _httpClient;
        private string _userServiceUrl = "http://localhost:18000";
        public UserService(HttpClient httpClient)
        {
            _httpClient = httpClient;
        }

        public async Task<UserInfo> CheckOrCreate(string phone)
        {
            var from = new Dictionary<string, string>
            {
                { "phone",phone }
            };
            var content = new FormUrlEncodedContent(from);
            var response = await _httpClient.PostAsync(_userServiceUrl + "/api/users/check_or_create", content);
            if (response.StatusCode == System.Net.HttpStatusCode.OK)
            {
                var result = await response.Content.ReadAsStringAsync();
                var userinfo = JsonConvert.DeserializeObject<UserInfo>(result);

                //int.TryParse(userId,out int UserIdInt);
                return userinfo;
            }
            return null;
        }
    }

　　配置Startup，注意要在我们的DI容器中注入自定义服务验证类（SmsAuthCodeGrantType）

    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddMvc();
            services.AddIdentityServer()
                .AddExtensionGrantValidator<SmsAuthCodeGrantType>()  
                .AddDeveloperSigningCredential()
                .AddInMemoryClients(Config.GetClients())
                .AddInMemoryIdentityResources(Config.GetIdentityResources())
                .AddInMemoryApiResources(Config.GetApiResources());  //identityserver 认证

            services.AddScoped<IAuthCodeService, TestAuthCodeService>()
                .AddScoped<IUserService, UserService>();
            services.AddSingleton(new HttpClient());
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            app.UseIdentityServer();
            app.UseMvc();
        }
    }

• 最后配置我们的网关Ocelot站点，首先添加nuget包IdentityServer4.AccessTokenValidation和Ocelot。添加配置文件ocelot.json,其实就是博客开头的配置文件截图,这里特别说明下AuthenticationOptions节点，AuthenticationOptions是ocelot集成Identity所需要配置节点，AuthenticationProviderKey需要跟startup的authenticationScheme匹配

{
  "ReRoutes": [
    {
      "DownstreamPathTemplate": "/api/users",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 18000
        }
      ],
      "UpstreamPathTemplate": "/users",
      "UpstreamHttpMethod": [ "Get" ],
      "AuthenticationOptions": {
        "AuthenticationProviderKey": "finbook",
        "AllowedScopes": []
      }
    },
    {
      "DownstreamPathTemplate": "/connect/token",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 18001
        }
      ],
      "UpstreamPathTemplate": "/connect/token",
      "UpstreamHttpMethod": [ "Post" ]
    }
  ],
  "GlobalConfiguration": {
    "BaseUrl": "http://localhost:18002"
  }
}

将配置文件加载到服务中，修改Program的CreateWebHostBuilder方法

    public class Program
    {
        public static void Main(string[] args)
        {
            CreateWebHostBuilder(args).Build().Run();
        }

        public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
            WebHost.CreateDefaultBuilder(args)
                .UseStartup<Startup>()
                .UseContentRoot(Directory.GetCurrentDirectory())
                .ConfigureAppConfiguration((hostingContext, config) =>
                {
                    config
                       .SetBasePath(hostingContext.HostingEnvironment.ContentRootPath)
                       //.AddJsonFile("appsettings.json", true, true)
                       //.AddJsonFile($"appsettings.{hostingContext.HostingEnvironment.EnvironmentName}.json", true, true)
                       .AddJsonFile("ocelot.json")
                       .AddEnvironmentVariables();
                })
                .UseUrls("http://+:18002");
    }

配置startup，在DI容器中加入Identity自定义认证，加入Ocelot，启用Ocelot中间件

    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
            //添加 认证信息
            var authenticationProviderKey = "finbook";
            services.AddAuthentication()
                .AddIdentityServerAuthentication(authenticationProviderKey, options =>
                {
                    options.Authority = "http://localhost:18001";
                    options.ApiName = "gateway_api";
                    options.SupportedTokens = IdentityServer4.AccessTokenValidation.SupportedTokens.Both;
                    options.ApiSecret = "secret";
                    options.RequireHttpsMetadata = false;
                });
            services.AddOcelot();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }
            //app.UseAuthentication();
            app.UseOcelot(); //.Wait()
            app.UseHttpsRedirection();
            app.UseMvc();
        }
    }

• 验证运行

首先获取token，访问ocelot网关的/connect/token地址，转发到Idnetity服务，注意下grant_type参数要和Identity服务中的配置相同

接下来根据获取到的token，请求用户信息

Demo地址=》https://github.com/madeinchinalmc/User.Api