netCore微服务学习笔记（一）：IdentityServer4客户端授权

关于IdentityServer4介绍，可详见 https://www.cnblogs.com/sheng-jie/p/9430920.html；

1.搭建测试程序：

  新建net Core应用：

2.添加引用程序：通过NuGet安装 IdentityServer4 或者通过程序包管理执行 Install-Package IdentityServer4 安装依赖包。

 这里用的是3.14版本，使用4.1版本会出现问题HTTP : 400 { "error": "invalid_request" }，在这边卡了好久才解决；

 

3：编辑代码

 新建一个Config类，管理Identity资源，代码如下：

using IdentityServer4.Models;
using System.Collections.Generic;
namespace IdentityClientDemo
{
    public static class IdentityClientConfig
    {
        public static IEnumerable<IdentityResource> GetIdentityResourceResources()
        {
            return new List<IdentityResource>
            {
                new IdentityResources.OpenId(),
            };
        }
        // scopes define the API resources in your system
        public static IEnumerable<ApiResource> GetApiResources()
        {
            //api资源({资源名称}{描述})
            return new List<ApiResource>
            {
                new ApiResource("Api", "Api"),
            };
        }

        /// <summary>
        /// 添加客户端
        /// </summary>
        /// <returns></returns>
        public static IEnumerable<Client> GetClients()
        {
            return new List<Client>
            {
                new Client
                {
                    //客户端id,必须唯一
                    ClientId = "client",
                    AllowedGrantTypes = GrantTypes.ClientCredentials,//授权方式，这里采用的是客户端认证模式
                    ClientSecrets =
                    {
                        new Secret("secret".Sha256())
                    },
                    AllowedScopes =
                    {
                        "Api",
                    }
                }
            };
        }
    }
}

然后再startup.class中注入服务：

using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
namespace IdentityClientDemo
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {

            services.AddIdentityServer()
                 .AddDeveloperSigningCredential()
                .AddInMemoryApiResources(IdentityClientConfig.GetApiResources())//Api资源信息
                .AddInMemoryClients(IdentityClientConfig.GetClients());//客户端信息
            services.AddControllers();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseHttpsRedirection();

            app.UseRouting();

            app.UseAuthorization();
            app.UseIdentityServer();
            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }
}

修改launchSetting.json文件，编辑

 

 

 

3.运行测试：

  运行程序，在PostMan中输入网站https://localhost:44350/.well-known/openid-configuration，可看到下图：

 

 

 通过该路径"https://localhost:44350/connect/token",可以获取到token

　　

 

 

 其中body中的参数分别为：

 　　grant_type    ：对应api AllowedGrantTypes 类型表示授权模式

        client_id        ： 对应clentID 

        client_secret： 客户端秘钥

4.创建api服务程序：

  添加“IdentityServer4.AccessTokenValidation“引用，然后再startup.class中注入服务，

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
namespace IdentityServerDemo
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            
            services
             .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)//JwtBearerDefaults.AuthenticationScheme为“Beaer"
             .AddIdentityServerAuthentication("Bearer", options =>
             {
                 options.Authority = "http://localhost:44350";
                 //options.Authority = "http://localhost:5003";
                 options.RequireHttpsMetadata = false;
                 options.ApiName = "Api"; //服务的名称，对应Identity Server当中的Api资源名称
                 options.ApiSecret = "secret";
             }); 
            services.AddControllers();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseHttpsRedirection();

            app.UseRouting();
            //添加authentication中间件到http管道
            app.UseAuthentication();
            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }
}

5.测试：

api服务控制器添加authorize认证：

using System;
using System.Collections.Generic;
using System.Linq;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;

namespace IdentityServerDemo.Controllers
{
    [ApiController]
    [Route("[controller]")]
    [Authorize]
    public class WeatherForecastController : ControllerBase
    {
        private static readonly string[] Summaries = new[]
        {
            "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
        };

        private readonly ILogger<WeatherForecastController> _logger;

        public WeatherForecastController(ILogger<WeatherForecastController> logger)
        {
            _logger = logger;
        }

        [HttpGet]
        public IEnumerable<WeatherForecast> Get()
        {
            var rng = new Random();
            return Enumerable.Range(1, 5).Select(index => new WeatherForecast
            {
                Date = DateTime.Now.AddDays(index),
                TemperatureC = rng.Next(-20, 55),
                Summary = Summaries[rng.Next(Summaries.Length)]
            })
            .ToArray();
        }
    }
}

运行api服务程序，访问“WeatherForecastController”

 

 可以看到，目前是未授权状态。访问认证网站http://localhost:44350/connect/token，获取access_token 然后用配置的client向IdentityServer申请token来访问Api资源：http://localhost:44344/weatherforecast，结果如下图：

 

 可以看到，已经可以正常访问