授权与认证
使用JWT进行授权验证的步骤
服务注册与参数配置
新建一个.Net6类库,在类库下新建Helper文件夹,并创建Appsetting类,该类用于帮助读取Appsetting.json中的系统配置参数
通过Nuget安装Microsoft.Extensions.Configuration;Microsoft.Extensions.Caching.Abstractions;Microsoft.Extensions.Configuration.Json;Microsoft.Extensions.Configuration.Binder并完成Appsettings类
public class AppSettings { static IConfiguration Configuration { get; set; } static string ContentPath { get; set; } public AppSettings() { string path = "appsettings.json"; Configuration = new ConfigurationBuilder().SetBasePath(ContentPath).Add(new JsonConfigurationSource { Path = path, Optional = false, ReloadOnChange = true }).Build(); } public AppSettings(IConfiguration configuration) { Configuration = configuration; } public static string app(params string[] sections) { try { if (sections.Any()) { return Configuration[string.Join(":", sections)]; } } catch (Exception ex) { } return ""; } public static List<T>app<T>(params string[] sections) { List<T> list=new List<T>(); Configuration.Bind(string.Join(":", sections), list); return list; } }
在Helper文件夹下继续新建JwtHelper类
public class JWTHelper { public static string IssueJwt(TokenModelJwt tokenModel) { string iss = AppSettings.app(new string[] { "Audience", "Issuer" }); string aud = AppSettings.app(new string[] { "Audience", "Audience" }); string secret = AppSettings.app(new string[] { "Audience", "Secret" }); var claims = new List<Claim> { new Claim(JwtRegisteredClaimNames.Jti, tokenModel.Uid.ToString()), new Claim(JwtRegisteredClaimNames.Iat,$"{new DateTimeOffset(DateTime.Now).ToUnixTimeSeconds()}"), new Claim(JwtRegisteredClaimNames.Nbf,$"{new DateTimeOffset(DateTime.Now).ToUnixTimeSeconds()}"), new Claim(JwtRegisteredClaimNames.Exp,$"{new DateTimeOffset(DateTime.Now.AddSeconds(1000)).ToUnixTimeSeconds()}"), new Claim(ClaimTypes.Expiration,DateTime.Now.AddSeconds(1000).ToString()), new Claim(JwtRegisteredClaimNames.Iss,iss), new Claim(JwtRegisteredClaimNames.Aud,aud) }; claims.AddRange(tokenModel.Role.Split(',').Select(s => new Claim(ClaimTypes.Role, s))); var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secret)); var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256); var jwt = new JwtSecurityToken(issuer: iss, claims: claims, signingCredentials: creds); var jwtHandler = new JwtSecurityTokenHandler(); var encodedJwt = jwtHandler.WriteToken(jwt); return encodedJwt; } public static TokenModelJwt SerializeJwt(string jwtStr) { var jwtHandler = new JwtSecurityTokenHandler(); TokenModelJwt tokenModelJwt = new TokenModelJwt(); if (!string.IsNullOrEmpty(jwtStr) && jwtHandler.CanReadToken(jwtStr)) { JwtSecurityToken jwtToken = jwtHandler.ReadJwtToken(jwtStr); object role; jwtToken.Payload.TryGetValue(ClaimTypes.Role, out role); tokenModelJwt = new TokenModelJwt { Uid = Convert.ToInt32(jwtToken.Id), Role = role == null ? "" : role.ToString() }; } return tokenModelJwt; } }
设计登录接口
[ApiController] [Route("api/[controller]")] public class LoginController : Controller { [HttpGet] public async Task<object> GetJwtStr(string name, string pass) { TokenModelJwt tokenModelJwt = new TokenModelJwt { Uid = 1, Role = "Admin" }; var jwtStr = JWTHelper.IssueJwt(tokenModelJwt); return Ok(new { success = true, token = jwtStr }); } } }
使用Swagger作为文档,已经实现了录入Token令牌的功能
在Nuget中搜索Swashbuckle.AspNetCore.Filters,在 ConfigureServices中的AddSwaggerGen服务中增加以下代码
builder.Services.AddSwaggerGen(c => { c.OperationFilter<AddResponseHeadersFilter>(); c.OperationFilter<AppendAuthorizeToSummaryOperationFilter>(); c.OperationFilter<SecurityRequirementsOperationFilter>(); c.AddSecurityDefinition("oauth2", new OpenApiSecurityScheme { Description = "JWT授权", Name = "Authorization", In = ParameterLocation.Header, Type = SecuritySchemeType.ApiKey }); });
基于策略的授权机制
builder.Services.AddAuthorization(option => { option.AddPolicy("Client", policy => policy.RequireRole("Client").Build()); option.AddPolicy("Admin", policy => policy.RequireRole("Admin").Build()); option.AddPolicy("SystemOrAdmin", policy => policy.RequireRole("Admin", "System")); option.AddPolicy("SystemAndAdmin", policy => policy.RequireRole("Admin").RequireRole("System")); });
直接在API上设置该接口所对应的角色权限信息
[ApiController] [Route("[controller]")] [Authorize(Policy = "Admin")] public class WeatherForecastController : ControllerBase { private static readonly string[] Summaries = new[] {"Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"}; private readonly ILogger<WeatherForecastController> _logger; public WeatherForecastController(ILogger<WeatherForecastController> logger) { _logger = logger; } [HttpGet(Name = "GetWeatherForecast")] public IEnumerable<WeatherForecast> Get() { return Enumerable.Range(1, 5).Select(index => new WeatherForecast { Date = DateTime.Now.AddDays(index), TemperatureC = Random.Shared.Next(-20, 55), Summary = Summaries[Random.Shared.Next(Summaries.Length)] }) .ToArray(); } }
配置认证服务
只需要在configureService中添加“统一认证”即可
builder.Services.AddAuthentication(x => { x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme; x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme; }).AddJwtBearer(o => { var audienceConfig = builder.Configuration["Audience:Audience"]; var symmetricKeyBase64 = builder.Configuration["Audience:Secret"]; var iss = builder.Configuration["Audience:Issuer"]; var keyByteArray = Encoding.ASCII.GetBytes(symmetricKeyBase64); var signingKey = new SymmetricSecurityKey(keyByteArray); o.TokenValidationParameters = new TokenValidationParameters { ValidateIssuerSigningKey = true, IssuerSigningKey = signingKey, ValidateIssuer = true, ValidIssuer = iss, ValidateAudience = true, ValidAudience = audienceConfig, ValidateLifetime = true, ClockSkew = TimeSpan.Zero, RequireExpirationTime = true }; });
配置官方认证中间件
app.UseAuthentication()