.NET CORE使用OpenIDConnect登陆

场景描述

B应用程序使用OID访问A站点，通过A站点的登录页输入账号密码来通过验证，获得token。

环境：.NET CORE 3.1

1.在Startup.cs中修改Configure函数、

 1  public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
 2         {
 3 
 4             if (env.IsDevelopment())
 5             {
 6                 app.UseDeveloperExceptionPage();
 7             }
 8             else
 9             {
10                 app.UseExceptionHandler("/Home/Error");
11                 // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
12                 app.UseHsts();
13             }
14             app.UseDeveloperExceptionPage();
15 
16             app.UseHttpsRedirection();
17             app.UseStaticFiles();
18 
19             app.UseRouting();
20 
21             app.UseAuthentication();
22             app.UseAuthorization();
23 
24             app.UseEndpoints(endpoints =>
25             {
26                 endpoints.MapControllerRoute(
27                     name: "default",
28                     pattern: "{controller=Home}/{action=Index}/{id?}"
29                     );
30             });
31         }

2.修改ConfigureServices函数

Authority：A站点的验证地址

ClientId：在A站点注册的客户端ID

Scope：如果不执行Scope.Clear()，默认会有一个 openid profile的Scope，如果A站点没有这个scope或者不叫这个名字的话，就会很登陆报错。

CallbackPath：替代了在Framework中的 RedirectUri 属性，需要输入相对路径。如果必须要使用RedirectUri的话，可以在OnAuthenticationFailed事件中设置 context.ProtocolMessage.RedirectUri，不过这么做好像会导致登陆页面提交后无限循环访问登录页。

 

services.AddAuthentication(options =>
            {
                options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
                options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
            })
            .AddCookie()
            .AddOpenIdConnect(options =>
            {
                options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.RequireHttpsMetadata = true;
                options.SaveTokens = true;
                options.Authority = "https://XXXX";
                options.ClientId = "test_client";
                options.Scope.Clear();
                options.Scope.Add("openid");
                options.ResponseType = "id_token token";
                options.UseTokenLifetime = true;
                options.CallbackPath = new PathString("/home/index");
                //options.SignedOutRedirectUri = "https://localhost/home/index";
                options.Events.OnTokenValidated = context =>
                {
                    var token = context.SecurityToken.RawData;
                    return Task.FromResult(0);
                };
                options.Events.OnRemoteFailure = context =>
                {
                    return Task.FromResult(0);
                };
                options.Events.OnAuthenticationFailed = context =>
                {
                    
                    return Task.FromResult(0);
                };

            });