IdentityServer4 手动验签及日志记录
IdentityServer4的基础知识和使用方式网上有很多特别优秀的文章，如果有对其不了解的推荐阅读一下下面的两篇文章
http://www.ruanyifeng.com/blog/2014/05/oauth_2_0.html
https://www.cnblogs.com/stulzq/p/8119928.html
当然如果你英文可以的话，官方文档还是要读上一读的。
这篇文章主要介绍一下手动实现Api的token校验,及认证授权过程中相关的日志记录
如果是在.net core的api中，token校验的实现方式是相当简单的：
services.AddAuthentication("Bearer")
.AddJwtBearer("Bearer", options =>
{
options.Authority = "http://testlocal.com:56428";
options.RequireHttpsMetadata = false;
options.Audience = "api1";
options.Events = new MyJwtBearerEvents();
});
可以同过实现JwtBearerEvents接口，来记录Token校验过程的相关日志。Token校验失败api返回401。
但是如果不想要返回401呢，或者在是.net framework中同样使用IdentityServer4，就需要我们手动实现token的校验
从HttpHeader中取出Token
net FrameWork
if (header.Authorization == null || header.Authorization.Parameter == null)
{
return new ValidTokenResult(false, "not exit token");
}
string tokenStr = header.Authorization.Parameter;
net Core
if (header == null || !header.ContainsKey("Authorization"))
result = new OpenApiResponse(CodeEnum.NotExistToken, "not exit token");
else
string tokenStr = header["Authorization"];
解析token字符串
internal TokenModel GetTokenModel(string jwttoken)
{
string[] arrys = jwttoken.Split('.');
try
{
string headstr = Base64Helper.DecodeBase64Url(arrys[0]);
string paylodstr = Base64Helper.DecodeBase64Url(arrys[1]);
TokenHeader head = JsonHelper.DeserializeObject<TokenHeader>(headstr);
TokenPayload paylod = JsonHelper.DeserializeObject<TokenPayload>(paylodstr);
return new TokenModel() { Header = head, Plyload = paylod, TokenRaw = jwttoken, secred = arrys[2] };
}
catch (Exception ex)
{
ToolFactory.LogHelper.Error("解析tokenHead报错,jwttoken:" + jwttoken, ex);
throw;
}
}
请求授权中心获取jwk配置：
.获取token配置：授权地址+.well-known/openid-configuration
.获取token配置：根据上一步返回的jwks_uri，请求：jwks_uri，返回的结果如下：
{
"keys": [
{
"kty": "RSA",
"use": "sig",
"kid": "237271f420de7fdd3736231f59890a79",
"e": "AQAB",
"n": "vos7SOZyO5fZu9o8RVGpsOaIHXXCluky7hSWxSYTZvIl5QkjV3k15O1k6mtidVv0KmNdBBeFvo0aijHr6M93Xe-3NLIqyQTuXLIjHNJd4VdJXkzsA5jo3ScVgIhKJwTvd0Lu7eLAWRj8ArgWaPrizfuuP6zw20vzr_cdiz6CQIJ6FmWKI5LAAI2tPr6y08Ekb0B6BKtifGPL6q0cVHo_U9mNCBjITwwl8fF-denix4RXULwWJJD19VBQAQZdZSxeXjhYCW4GnkRHtSmwabaS1qihp6GvrC0ch5d3MZZiqi7imX0R7dOdF9Jdl-vl7oe98G79DzsunystV6nElndenw",
"alg": "RS256"
}
]
}
Token签名验证
-
验证header中的kid和jwk中的kid是否匹配
//调用接口获取jwk的相关信息，jwk包括公钥等用于验签token的信息 var jwk = await GetCacheJwkConfig().ConfigureAwait(false); var defaultkey = jwk.keys.Where(t => t.kid == tokenModel.Header.kid).FirstOrDefault(); if (defaultkey == null) { return new ValidTokenResult(false, "token valid kid err"); } -
RSA验证签名。授权中心用私钥签名、我们客户端用公钥验签
var signValid = ValidateJwtTokenSigned(token, defaultkey.e, defaultkey.n); if (!signValid.Success) { signValid.Message = "token valid sign err " + signValid.Message; return signValid; } public ValidTokenResult ValidateJwtTokenSigned(string token, string exponent, string modulus) { try { string[] arrs = token.Split('.'); string payload = arrs[0] + "." + arrs[1]; byte[] encodedBytes = Encoding.UTF8.GetBytes(payload); byte[] singbytes = Base64Helper.DecodeBase64UrlToByte(arrs[2]); RSAParameters param = new RSAParameters() { Exponent = Base64Helper.DecodeBase64UrlToByte(exponent), Modulus = Base64Helper.DecodeBase64UrlToByte(modulus) }; using (RSACryptoServiceProvider _rsa = new RSACryptoServiceProvider()) { _rsa.ImportParameters(param); bool result = _rsa.VerifyData(encodedBytes, SHA256.Create(), singbytes); return new ValidTokenResult(result, ""); } } catch (Exception ex) { ToolFactory.LogHelper.Error("token验证签名出错,jwttoken:" + token, ex); return new ValidTokenResult(false, ex.Message); } }
至此，一个最基础的Token校验就完成了，当然后面仍需要判断token的超时时间及权限等信息
为了防止网络耗时引起的时间误差，我预留了30秒的时间
DateTime dtstart = TimeHelper.ConvertLongToDateTime(tokenModel.Plyload.nbf).AddSeconds(-30);
if (dtstart > DateTime.Now)
{
return new ValidTokenResult(false, "token nbf time err"+ tokenModel.Plyload.nbf);
}
DateTime dtend = TimeHelper.ConvertLongToDateTime(tokenModel.Plyload.exp).AddSeconds(30);
if (dtend < DateTime.Now)
{
return new ValidTokenResult(false, "token is timeout" + tokenModel.Plyload.exp);
}
if (!tokenModel.Plyload.scope.Contains(_options.Audience))
{
return new ValidTokenResult(false, "token has no permission for this api");
}
授权日志
授权的日志可通过实现IEventSink监听相关事件，需要设置相关的Eventsoptions为true
services.TryAddTransient<IEventSink, Auth.SeqEventSink>();
var migrationsAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name;
services.AddIdentityServer(o =>
{
o.Caching.ClientStoreExpiration = new TimeSpan(0, 0, 50);
o.UserInteraction.LoginUrl = "/IdSerAccount/Login"; //授权登陆界面
o.UserInteraction.ConsentUrl = "/IdSerConsent/Index"; //授权确认界面
o.UserInteraction.LogoutUrl = "/IdSerAccount/Logout"; //授权登出界面
o.Events.RaiseSuccessEvents = true;
o.Events.RaiseFailureEvents = true;
o.Events.RaiseErrorEvents = true;
})
EventSink：
public class SeqEventSink : IEventSink
{
public Task PersistAsync(Event evt)
{
return Task.Run(() =>
{
try
{
//登陆登出的日志忽略
if (evt.Id == EventIds.UserLoginSuccess || evt.Id == EventIds.UserLogoutSuccess)
return;
BIdentityEventLog iel = new BIdentityEventLog()
{
IEL_CREATION_DT = DateTime.Now,
IEL_EVENTY_TYPE = evt.EventType.ToString(),
IEL_EVENT_NAME = evt.Name,
IEL_EVENT_ID = evt.Id,
IEL_TIMESTAMP = evt.TimeStamp,
IEL_REMOTEIP_ADDRESS = evt.RemoteIpAddress,
IEL_CATEGORY = evt.Category
};
if (evt is ApiAuthenticationSuccessEvent)
{
var newevt = (evt as ClientAuthenticationFailureEvent);
iel.IEL_CLIENT_ID = newevt.ClientId;
}
else if (evt is ClientAuthenticationSuccessEvent)
{
var newevt = (evt as ClientAuthenticationSuccessEvent);
iel.IEL_CLIENT_ID = newevt.ClientId;
}
else if (evt is ConsentGrantedEvent)
{
var newevt = (evt as ConsentGrantedEvent);
iel.IEL_CLIENT_ID = newevt.ClientId;
}
else if (evt is InvalidClientConfigurationEvent)
{
var newevt = (evt as InvalidClientConfigurationEvent);
iel.IEL_CLIENT_ID = newevt.ClientId;
}
else if (evt is TokenIssuedFailureEvent)
{
var newevt = (evt as TokenIssuedFailureEvent);
iel.IEL_CLIENT_ID = newevt.ClientId;
iel.IEL_ERROR = newevt.Error;
iel.IEL_END_POINT = newevt.Endpoint;
}
else if (evt is TokenIssuedSuccessEvent)
{
var newevt = (evt as TokenIssuedSuccessEvent);
iel.IEL_CLIENT_ID = newevt.ClientId;
iel.IEL_END_POINT = newevt.Endpoint;
}
int ielId = AddIel(iel);
var jsonData = JsonConvert.SerializeObject(evt);
AddXie(new XIdentityEventLog() { XIE_IEL_ID = ielId, XIE_JSON = jsonData });
}
catch (Exception ex)
{
LogHelper.Error("授权事件记录失败:NAME" + evt.Name, ex);
LogHelper.Error("授权事件记录失败，{Name}, Details: {@details}", evt.Name, evt);
}
});
}
private int AddIel(BIdentityEventLog model)
{
。。。。
}
private int AddXie(XIdentityEventLog model)
{
。。。。
}
}
