IdentityServer4专题之七：Authorization Code认证模式
（1）identityserver4授权服务器端
public static class Config
{
public static IEnumerable<IdentityResource> GetIdentityResources()
{
return new IdentityResource[]
{
new IdentityResources.OpenId(),
new IdentityResources.Profile(),
new IdentityResources.Email(),
new IdentityResources.Phone(),
new IdentityResources.Address(),
};
}
public static IEnumerable<ApiResource> GetApis()
{
return new ApiResource[]
{
new ApiResource("api1", "My API #1")
};
}
public static IEnumerable<Client> GetClients()
{
return new[]
{
new Client
{
ClientId="mvc client",
ClientName="ASP.NET Core MVC Client",
AllowedGrantTypes=GrantTypes.CodeAndClientCredentials,
ClientSecrets={new Secret( "mvc secret".Sha256())},
RedirectUris={"http://localhost:5002/signin-oidc"},
FrontChannelLogoutUri="http://localhost:5002/signout-oidc",
PostLogoutRedirectUris={"http://localhost:5002/signout-callback-oidc"},
AlwaysIncludeUserClaimsInIdToken=true,//将用户所有的claims包含在IdToken内
AllowOfflineAccess=true,//offline_access，其实指的是能否用refreshtoken重新申请令牌
AllowedScopes =
{
"api1",
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile,
IdentityServerConstants.StandardScopes.Address,
IdentityServerConstants.StandardScopes.Phone,
IdentityServerConstants.StandardScopes.Email
}
}
};
}
}
（2）客户端，还是需要安装IdentityModel库，
在startup.cs的ConfigurServices一节，需要做如下添加：
//关闭默认映射，否则它可能修改从授权服务返回的各种claim属性
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
//添加认证服务，并设置其有关选项
services.AddAuthentication(options =>
{
//客户端应用设置使用"Cookies"进行认证
options.DefaultScheme =CookieAuthenticationDefaults.AuthenticationScheme ;
//identityserver4设置使用"oidc"进行认证
options.DefaultChallengeScheme =OpenIdConnectDefaults.AuthenticationScheme ;
}).AddCookie(CookieAuthenticationDefaults.AuthenticationScheme)
//对使用的OpenIdConnect进行设置，此设置与Identityserver的config.cs中相应client配置一致才可能登录授权成功
.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options=> {
options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.Authority = "http://localhost:5000";
options.RequireHttpsMetadata = false;
options.ClientId = "mvc client";
options.ClientSecret = "mvc secret";
options.SaveTokens = true;
options.ResponseType = "code";
options.Scope.Clear();
options.Scope.Add("api1");
options.Scope.Add(OidcConstants.StandardScopes.OpenId);//"openid"
options.Scope.Add(OidcConstants.StandardScopes.Profile);//"profile"
options.Scope.Add(OidcConstants.StandardScopes.Address);
options.Scope.Add(OidcConstants.StandardScopes.Email);
options.Scope.Add(OidcConstants.StandardScopes.Phone);
// 与identity server的AllowOfflineAccess=true,对应。offline_access，指的是能否用refreshtoken重新申请令牌
options.Scope.Add(OidcConstants.StandardScopes.OfflineAccess);
});
在Confiure一节，app.UseMvc之前添加如下内容：
app.UseAuthentication();
然后，在controller中使用时，按如下方式： 通常需如下引用
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Net.Http;
using System.Threading.Tasks;
using IdentityModel.Client;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using MvcClient.Models;
//获取AccessToken、IdToken、RefreshToken时：
[Authorize]
public async Task<IActionResult> Privacy()
{
var accessToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.AccessToken);
var idToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.IdToken);
var refreshToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.RefreshToken);
var authorizationCode = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.Code);
ViewData["idToken"] = idToken;
ViewData["refreshToken"] = refreshToken;
ViewData["accessToken"] = accessToken;
return View();
}
//访问Api资源时
public async Task<IActionResult> AccessApi()
{
var client = new HttpClient();
var disco = await client.GetDiscoveryDocumentAsync("http://localhost:5000");
ViewData["disco"] = disco.Error;
if (disco.IsError)
{
ViewData["disco"] = disco.Error;
return View();
}
var accessToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.AccessToken);
client.SetBearerToken(accessToken);
var response = await client.GetAsync("http://localhost:5001/api/values");
if (!response.IsSuccessStatusCode)
{
ViewData["response_error"] = response.StatusCode;
return View();
}
ViewData["response-content"] = await response.Content.ReadAsStringAsync();
return View();
}
从客户端及identityserver4登出时：
public async Task<IActionResult> Logout()
{
await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
await HttpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme);
return View();
}
如果登出需要跳转回到客户端应用网站，则需在将IdentityServer4的命名空间IdentityServer4.Quickstart.UI下的AccountOptions类中
public static bool AutomaticRedirectAfterSignOut = true;
这样，从identityserver登出后，将自动跳转到客户应用页面。
