Identity Server 4 授权
1.生成 jwt token
/// <summary> /// jwt token /// </summary> public static class JwtHelper { //密钥 必须是32字节 private static string SecretKey = "4046341C6E174E11B296AB4628E5AC99"; public static string LogonCachePrefixKey = "LogonCachePrefixKey"; /// <summary> /// 生成token /// </summary> /// <returns></returns> public static string GetAccessToken(User user , List<string> userAuthoritys , Dictionary<long, string> fabs , Dictionary<long, string> rtAreas , Dictionary<long, string> nonRTAreas , IConfiguration configuration) { string jwtIssuer = configuration["Startup:JwtSettings:Issuer"]; string jwtAudience = configuration["Startup:JwtSettings:Audience"]; string jwtSecretKey = configuration["Startup:JwtSettings:SecretKey"]; string validMinutes = configuration["Startup:JwtSettings:AccessTokenValidMinutes"]; var tokenHandler = new JwtSecurityTokenHandler(); byte[] byteKey = Encoding.UTF8.GetBytes(jwtSecretKey); var authTime = DateTime.Now;//授权时间 var expiresAt = GetAccessTokenExpiresAt(authTime,validMinutes); var claims = GetClaimsByuser(user , userAuthoritys , fabs , rtAreas , nonRTAreas , jwtIssuer, jwtAudience, authTime); var tokenDescripor = new SecurityTokenDescriptor { Subject = new ClaimsIdentity(claims), Expires = expiresAt, SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(byteKey), SecurityAlgorithms.HmacSha256Signature) }; SecurityToken securityToken = tokenHandler.CreateToken(tokenDescripor); string token = tokenHandler.WriteToken(securityToken); return token; } private static DateTime GetAccessTokenExpiresAt(DateTime authTime, string validMinutes) { double minutes = 20; double.TryParse(validMinutes, out minutes); return authTime.AddMinutes(minutes); } private static DateTime GetRefreshTokenExpiresAt(string validMinutes) { double minutes = 24*60; double.TryParse(validMinutes, out minutes); return DateTime.Now.AddMinutes(minutes); } public static int GetRefreshTokenExpiresAtNumber(IConfiguration configuration) { int number = 24 * 60; int.TryParse(configuration["Startup:JwtSettings:RefreshTokenValidMinutes"], out number); return number; } public static string GetRefreshToken(User user, HttpContext httpContext, IConfiguration configuration,string isForMems) { string validMinutes = configuration["Startup:JwtSettings:RefreshTokenValidMinutes"]; if (user == null) return string.Empty; var obj = new RefreshTokenDto() { UserName = user.UserName, UserID = user.UserID, ClientIP = httpContext.GetClientIP(), IsForMems = isForMems, ExpiresAt = GetRefreshTokenExpiresAt(validMinutes), LastLoginTime = user.LastLoginTime }; var jsonStr = JsonConvert.SerializeObject(obj); return AESEncrypt(jsonStr); } public static RefreshTokenDto GetLogonUsers(HttpContext httpContext, IConfiguration configuration, User user) { var expiresAt = GetRefreshTokenExpiresAt(configuration["Startup:JwtSettings:RefreshTokenValidMinutes"]); return new RefreshTokenDto() { UserID = user.UserID, UserName = user.UserName, ClientIP = httpContext.GetClientIP(), ExpiresAt = expiresAt, LastLoginTime = user.LastLoginTime, }; } public static string GetLogonUserKey(HttpContext httpContext, string userID) { return $"{LogonCachePrefixKey} - {userID} - {httpContext.GetClientIP()}"; } public static RefreshTokenDto GetRefreshTokenDataByToken(string refreshToken) { if (string.IsNullOrEmpty(refreshToken) == false) { var json = AESDEncrypt(refreshToken); var obj = JsonConvert.DeserializeObject<RefreshTokenDto>(json); return obj; } return null; } public static bool CheckRefreshToken(HttpContext httpContext, string refreshToken) { var tokenData = GetRefreshTokenDataByToken(refreshToken); if (tokenData != null) { var clientIP = httpContext.GetClientIP(); //验证 IP 、时间 if(tokenData.ClientIP.Equals(clientIP) && tokenData.ExpiresAt.CompareTo(DateTime.Now) > 0) { return true; } } return false; } private static IList<Claim> GetClaimsByuser(User user , List<string> userAuthoritys , Dictionary<long, string> fabs , Dictionary<long, string> rtAreas , Dictionary<long, string> nonRTAreas , string jwtIssuer, string jwtAudience, DateTime authTime) { string timeStamp = Datetime2Unix(authTime).ToString(); var claims = new List<Claim>(); if (user != null) { claims.Add(new Claim(JwtClaimTypes.Issuer, jwtIssuer)); claims.Add(new Claim(JwtClaimTypes.Audience, jwtAudience)); claims.Add(new Claim(JwtClaimTypes.Id, user.UserID)); claims.Add(new Claim(JwtClaimTypes.Name, user.UserName)); claims.Add(new Claim(JwtClaimTypes.Expiration, timeStamp)); } if (userAuthoritys != null && userAuthoritys.Count > 0) { foreach (var item in userAuthoritys) { claims.Add(new Claim(SPCPermissions.SPCPermissionPolicyName, item));//策略授权 } } return claims; } private static double Datetime2Unix(DateTime time) { DateTime startTime = TimeZoneInfo.ConvertTimeFromUtc(new DateTime(1970, 1, 1), TimeZoneInfo.Local); return (time - startTime).TotalSeconds; } //AES加密 private static string AESEncrypt(string str) { byte[] keyArray = UTF8Encoding.UTF8.GetBytes(SecretKey); byte[] toEncryptArray = UTF8Encoding.UTF8.GetBytes(str); RijndaelManaged rDel = new RijndaelManaged(); rDel.Key = keyArray; rDel.Mode = CipherMode.ECB; rDel.Padding = PaddingMode.PKCS7; ICryptoTransform cTransform = rDel.CreateEncryptor(); byte[] resultArray = cTransform.TransformFinalBlock(toEncryptArray, 0, toEncryptArray.Length); return Convert.ToBase64String(resultArray, 0, resultArray.Length); } //AES解密 private static string AESDEncrypt(string str) { byte[] keyArray = UTF8Encoding.UTF8.GetBytes(SecretKey); byte[] toEncryptArray = Convert.FromBase64String(str); RijndaelManaged rDel = new RijndaelManaged(); rDel.Key = keyArray; rDel.Mode = CipherMode.ECB; rDel.Padding = PaddingMode.PKCS7; ICryptoTransform cTransform = rDel.CreateDecryptor(); byte[] resultArray = cTransform.TransformFinalBlock(toEncryptArray, 0, toEncryptArray.Length); return UTF8Encoding.UTF8.GetString(resultArray); } }
2.注册服务
public class Startup { private IServiceCollection _services; public Startup(IConfiguration configuration, IWebHostEnvironment env) { Configuration = configuration; Env = env; } public IConfiguration Configuration { get; } public IWebHostEnvironment Env { get; } // This method gets called by the runtime. Use this method to add services to the container. public void ConfigureServices(IServiceCollection services) { services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>(); Encoding.RegisterProvider(CodePagesEncodingProvider.Instance); //redis注入 //services.AddRedisCacheSetup(); services.Configure<CookiePolicyOptions>(options => { options.MinimumSameSitePolicy = SameSiteMode.None; options.Secure = CookieSecurePolicy.SameAsRequest; }); //允许跨域注入 //services.AddCorsSetup(); services.AddCors(option => { option.AddPolicy(Configuration["Startup:Cors:PolicyName"], policy => { policy.WithOrigins(Configuration["Startup:Cors:IPs"] .Split(",", StringSplitOptions.RemoveEmptyEntries) .ToArray()) .SetIsOriginAllowedToAllowWildcardSubdomains(); policy.SetPreflightMaxAge(TimeSpan.FromMinutes(HttpContextExtensions.GePreflightExpireTime(Configuration)));//预检缓存最大时间 policy.AllowAnyHeader(); policy.AllowAnyMethod(); policy.AllowCredentials(); }); }); //swagger注入 //services.AddSwaggerAnalysisSetup(); ConfigureSwaggerServices(services); services.AddAuthentication(b => { b.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme; b.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme; }) .AddJwtBearer(a => { //jwt token参数设置 a.TokenValidationParameters = new TokenValidationParameters { NameClaimType = JwtClaimTypes.Name, //ClockSkew = TimeSpan.FromSeconds(10), //Token颁发机构 ValidIssuer = Configuration["Startup:JwtSettings:Issuer"], //颁发给谁 ValidAudience = Configuration["Startup:JwtSettings:Audience"], //这里的key要进行加密 IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Startup:JwtSettings:SecretKey"])), }; a.Events = new JwtBearerEvents() { OnAuthenticationFailed = context => { context.Response.StatusCode = SPCJwtMiddleware.AuthenticationFailedCode; return Task.CompletedTask; }, OnForbidden = context => { context.Response.StatusCode = 200; context.Response.ContentType = "application/json;charset=utf-8"; return context.Response.WriteAsync(JsonConvert.SerializeObject(Dto.Common.SPCJsonResult.JsonErrorResult(SPCJwtMiddleware.ForbiddenCode, string.Empty))); }, OnChallenge = context => { context.HandleResponse(); return Task.CompletedTask; } }; }); services.AddAuthorization(b => { foreach (var item in SPCPermissions.GetStrings()) { b.AddPolicy(item, policy => policy.RequireClaim(SPCPermissions.SPCPermissionPolicyName, item)); } foreach (KeyValuePair<string,string[]> item in SPCPermissions.GetKeyValues()) { b.AddPolicy(item.Key, policy => policy.RequireClaim(SPCPermissions.SPCPermissionPolicyName, item.Value)); } }); //Session services.AddDistributedMemoryCache(); services.AddMemoryCache(); // session 设置 services.AddSession(options => { // 设置 Session 过期时间 options.IdleTimeout = TimeSpan.FromMinutes(SPCSessionExtensions.GetLoginExpireTime(Configuration)); // 跨域 谷歌浏览器 session id 丢失 options.Cookie.SameSite = SameSiteMode.None; options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest; options.Cookie.HttpOnly = true; }); string RouteName = Appsettings.app("AppSettings", "RouteName"); ; services.AddControllers(o => { // 全局异常过滤 o.Filters.Add(typeof(GlobalExceptionsFilter)); // 全局路由权限公约 //o.Conventions.Insert(0, new GlobalRouteAuthorizeConvention()); // 全局路由前缀，统一修改路由 o.Conventions.Insert(0, new GlobalRoutePrefixFilter(new RouteAttribute(RouteName))); }).ConfigureApiBehaviorOptions(options => { //FromBody //options.SuppressConsumesConstraintForFormFileParameters = true; //options.SuppressInferBindingSourcesForParameters = true; options.SuppressModelStateInvalidFilter = true; options.SuppressMapClientErrors = true; }) //全局配置Json序列化处理 .AddNewtonsoftJson(options => { //忽略循环引用 options.SerializerSettings.ReferenceLoopHandling = ReferenceLoopHandling.Ignore; //不使用驼峰样式的key options.SerializerSettings.ContractResolver = new DefaultContractResolver(); //设置时间格式 options.SerializerSettings.DateFormatString = "yyyy-MM-dd HH:mm:ss"; }); _services = services; NHSessionStorage.SetServiceProvider(services.BuildServiceProvider()); } // This method gets called by the runtime. Use this method to configure the HTTP request pipeline. public void Configure(IApplicationBuilder app, IWebHostEnvironment env , IHostApplicationLifetime applicationLeftTime) { // 记录请求与返回数据 app.UseReuestResponseLog(); // 记录ip请求 app.UseIPLogMildd(); if (env.IsDevelopment()) { app.UseDeveloperExceptionPage(); } // 封装Swagger展示 //app.UseSwaggerMildd(() => GetType().GetTypeInfo().Assembly.GetManifestResourceStream("WebAPI.index.html")); // CORS跨域 app.UseCors(Configuration["Startup:Cors:PolicyName"]); // 跳转https //app.UseHttpsRedirection(); // 使用静态文件 app.UseStaticFiles(); // 使用cookie app.UseCookiePolicy(); // 返回错误码 app.UseStatusCodePages(); // Routing app.UseRouting(); // 这种自定义授权中间件，可以尝试，但不推荐 // app.UseJwtTokenAuth(); // 先开启认证 app.UseAuthentication(); app.UseMiddleware<SPCJwtMiddleware>(); // 然后是授权中间件 app.UseAuthorization(); // 开启异常中间件，要放到最后 //app.UseExceptionHandlerMidd(); // 性能分析 app.UseMiniProfiler(); app.UseSwagger(); app.UseSwaggerUI(options => { typeof(ApiGroupNames).GetFields().Skip(1).ToList().ForEach(f => { var info = f.GetCustomAttributes(typeof(GroupInfoAttribute), false).OfType<GroupInfoAttribute>().FirstOrDefault(); options.SwaggerEndpoint($"/swagger/{f.Name}/swagger.json", f.Name); //options.SwaggerDoc(f.Name, new Microsoft.OpenApi.Models.OpenApiInfo //{ // Title = info?.Title, // Version = info?.Version, // Description = info?.Description //}); }); }); app.UseSession(); applicationLeftTime.ApplicationStarted.Register(() => { string resourcePath = Configuration["AppSettings:ResourcePath"]; string resourceName = Configuration["AppSettings:ResourceName"]; UtilCulture.InitialResource(resourceName, resourcePath, "en-US"); }); app.UseMiddleware<SPCCultureMiddleware>(); app.UseEndpoints(endpoints => { endpoints.MapControllers(); }); } private void ConfigureSwaggerServices(IServiceCollection services) { services.AddSwaggerGen(c => { //遍历ApiGroupNames所有枚举值生成接口文档，Skip(1)是因为Enum第一个FieldInfo是内置的一个Int值 typeof(ApiGroupNames).GetFields().Skip(1).ToList().ForEach(f => { var info = f.GetCustomAttributes(typeof(GroupInfoAttribute), false).OfType<GroupInfoAttribute>().FirstOrDefault(); c.SwaggerDoc(f.Name, new OpenApiInfo { //Title = info?.Title, //Version = info?.Version, //Description = info?.Description Title = $"{info?.Title} 接口文档——{RuntimeInformation.FrameworkDescription}", Description = $"{info?.Title} " + info?.Version, Contact = new OpenApiContact { Name = info?.Title, Email = "contact@fa-software.com", Url = new Uri("https://www.fa-software.com/") }, License = new OpenApiLicense { Name = info?.Title + " 官方简介", Url = new Uri("https://www.fa-software.com/") } }); }); // 使用 [ApiGroup(ApiGroupNames.UI)] 进行分组 c.DocInclusionPredicate((docName, apiDescription) => { if (docName == ApiGroupNames.SPC_API.ToString()) { return true; } //反射拿到值 var actionlist = apiDescription.ActionDescriptor.EndpointMetadata.Where(x => x is ApiGroupAttribute); if (actionlist.Count() > 0) { //判断是否包含这个分组 var actionfilter = actionlist.FirstOrDefault() as ApiGroupAttribute; return actionfilter.GroupName.Count(x => x.ToString() == docName) > 0; } return false; }); var basePath = Path.GetDirectoryName(typeof(Startup).Assembly.Location); var xmlPath = Path.Combine(basePath, "WebAPI.xml"); c.IncludeXmlComments(xmlPath, true); c.AddSecurityRequirement(new OpenApiSecurityRequirement() { { new OpenApiSecurityScheme() { Reference = new OpenApiReference() { Id = JwtBearerDefaults.AuthenticationScheme, Type = ReferenceType.SecurityScheme } }, Array.Empty<string>() } }); c.AddSecurityDefinition(JwtBearerDefaults.AuthenticationScheme, new OpenApiSecurityScheme() { Name = "Authorization", In = ParameterLocation.Header, Type = SecuritySchemeType.ApiKey, }); }); } }
基于策略的授权（角色授权就是特殊的策略授权）
services.AddAuthorization(b => { //设置一个值 foreach (var item in SPCPermissions.GetStrings()) { b.AddPolicy(item, policy => policy.RequireClaim(SPCPermissions.SPCPermissionPolicyName, item)); } //设置多个值或关系 foreach (KeyValuePair<string,string[]> item in SPCPermissions.GetKeyValues()) { b.AddPolicy(item.Key, policy => policy.RequireClaim(SPCPermissions.SPCPermissionPolicyName, item.Value));//item.Value 为 string[] { "r1", "r2" }
} });
原理不懂请参考：https://www.cnblogs.com/wangjunwei/p/10964604.html#autoid-7-0-0
