授权与认证

使用JWT进行授权验证的步骤

服务注册与参数配置

新建一个.Net6类库，在类库下新建Helper文件夹,并创建Appsetting类，该类用于帮助读取Appsetting.json中的系统配置参数

通过Nuget安装Microsoft.Extensions.Configuration；Microsoft.Extensions.Caching.Abstractions；Microsoft.Extensions.Configuration.Json；Microsoft.Extensions.Configuration.Binder并完成Appsettings类

public class AppSettings
{
    static IConfiguration Configuration { get; set; }
    static string ContentPath { get; set; }
 
    public AppSettings()
    {
        string path = "appsettings.json";
        Configuration = new ConfigurationBuilder().SetBasePath(ContentPath).Add(new JsonConfigurationSource { Path = path, Optional = false, ReloadOnChange = true }).Build();
    }
    public AppSettings(IConfiguration configuration)
    {
        Configuration = configuration;
    }
    public static string app(params string[] sections)
    {
        try
        {
            if (sections.Any())
            {
                return Configuration[string.Join(":", sections)];
            }
        }
        catch (Exception ex)
        {
 
        }
        return "";
    }
 
    public static List<T>app<T>(params string[] sections)
    {
        List<T> list=new List<T>();
        Configuration.Bind(string.Join(":", sections), list);
        return list;
    }
 
 
}

在Helper文件夹下继续新建JwtHelper类

public class JWTHelper
{
    public static string IssueJwt(TokenModelJwt tokenModel)
    {
        string iss = AppSettings.app(new string[] { "Audience", "Issuer" });
        string aud = AppSettings.app(new string[] { "Audience", "Audience" });
        string secret = AppSettings.app(new string[] { "Audience", "Secret" });
        var claims = new List<Claim> {
            new Claim(JwtRegisteredClaimNames.Jti,  tokenModel.Uid.ToString()),
            new Claim(JwtRegisteredClaimNames.Iat,$"{new DateTimeOffset(DateTime.Now).ToUnixTimeSeconds()}"),
            new Claim(JwtRegisteredClaimNames.Nbf,$"{new DateTimeOffset(DateTime.Now).ToUnixTimeSeconds()}"),
            new Claim(JwtRegisteredClaimNames.Exp,$"{new DateTimeOffset(DateTime.Now.AddSeconds(1000)).ToUnixTimeSeconds()}"),
            new Claim(ClaimTypes.Expiration,DateTime.Now.AddSeconds(1000).ToString()),
            new Claim(JwtRegisteredClaimNames.Iss,iss),
            new Claim(JwtRegisteredClaimNames.Aud,aud)
        };
        claims.AddRange(tokenModel.Role.Split(',').Select(s => new Claim(ClaimTypes.Role, s)));
        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(secret));
        var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
 
        var jwt = new JwtSecurityToken(issuer: iss, claims: claims, signingCredentials: creds);
        var jwtHandler = new JwtSecurityTokenHandler();
        var encodedJwt = jwtHandler.WriteToken(jwt);
        return encodedJwt;
    }
 
    public static TokenModelJwt SerializeJwt(string jwtStr)
    {
        var jwtHandler = new JwtSecurityTokenHandler();
        TokenModelJwt tokenModelJwt = new TokenModelJwt();
        if (!string.IsNullOrEmpty(jwtStr) && jwtHandler.CanReadToken(jwtStr))
        {
            JwtSecurityToken jwtToken = jwtHandler.ReadJwtToken(jwtStr);
            object role;
            jwtToken.Payload.TryGetValue(ClaimTypes.Role, out role);
            tokenModelJwt = new TokenModelJwt
            {
                Uid = Convert.ToInt32(jwtToken.Id),
                Role = role == null ? "" : role.ToString()
            };
        }
        return tokenModelJwt;
    }
 
}

设计登录接口

    [ApiController]
    [Route("api/[controller]")]
    public class LoginController : Controller
    {
        [HttpGet]
        public async Task<object> GetJwtStr(string name, string pass)
        {
            TokenModelJwt tokenModelJwt = new TokenModelJwt { Uid = 1, Role = "Admin" };
            var jwtStr = JWTHelper.IssueJwt(tokenModelJwt);
            return Ok(new { success = true, token = jwtStr });
        }
    }
}

使用Swagger作为文档，已经实现了录入Token令牌的功能

在Nuget中搜索Swashbuckle.AspNetCore.Filters，在 ConfigureServices中的AddSwaggerGen服务中增加以下代码

builder.Services.AddSwaggerGen(c =>
{
    c.OperationFilter<AddResponseHeadersFilter>();
    c.OperationFilter<AppendAuthorizeToSummaryOperationFilter>();
    c.OperationFilter<SecurityRequirementsOperationFilter>();
    c.AddSecurityDefinition("oauth2", new OpenApiSecurityScheme
    {
        Description = "JWT授权",
        Name = "Authorization",
        In = ParameterLocation.Header,
        Type = SecuritySchemeType.ApiKey
    });
});

基于策略的授权机制

builder.Services.AddAuthorization(option =>
{
    option.AddPolicy("Client", policy => policy.RequireRole("Client").Build());
    option.AddPolicy("Admin", policy => policy.RequireRole("Admin").Build());
    option.AddPolicy("SystemOrAdmin", policy => policy.RequireRole("Admin", "System"));
    option.AddPolicy("SystemAndAdmin", policy => policy.RequireRole("Admin").RequireRole("System"));
});

直接在API上设置该接口所对应的角色权限信息

[ApiController]
 [Route("[controller]")]
 [Authorize(Policy = "Admin")]
 public class WeatherForecastController : ControllerBase
 {
     private static readonly string[] Summaries = new[]
     {"Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"};
 
     private readonly ILogger<WeatherForecastController> _logger;
 
     public WeatherForecastController(ILogger<WeatherForecastController> logger)
     {
         _logger = logger;
     }
 
     [HttpGet(Name = "GetWeatherForecast")]
     public IEnumerable<WeatherForecast> Get()
     {
         return Enumerable.Range(1, 5).Select(index => new WeatherForecast
         {
             Date = DateTime.Now.AddDays(index),
             TemperatureC = Random.Shared.Next(-20, 55),
             Summary = Summaries[Random.Shared.Next(Summaries.Length)]
         })
         .ToArray();
     }
 }

配置认证服务

只需要在configureService中添加“统一认证”即可

builder.Services.AddAuthentication(x =>
{
    x.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    x.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(o =>
{
    var audienceConfig = builder.Configuration["Audience:Audience"];
    var symmetricKeyBase64 = builder.Configuration["Audience:Secret"];
    var iss = builder.Configuration["Audience:Issuer"];
    var keyByteArray = Encoding.ASCII.GetBytes(symmetricKeyBase64);
    var signingKey = new SymmetricSecurityKey(keyByteArray);
    o.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = signingKey,
        ValidateIssuer = true,
        ValidIssuer = iss,
        ValidateAudience = true,
        ValidAudience = audienceConfig,
        ValidateLifetime = true,
        ClockSkew = TimeSpan.Zero,
        RequireExpirationTime = true
    };
});