IdentityServer4（一）使用客户端凭证方式

这个篇文章主要是记录自己参考官方文档搭建身份认证的过程

使用的.NET Core2.2

参考地址：https://identityserver4.readthedocs.io/en/latest/quickstarts/1_client_credentials.html

1.第一步，创建一个webapi的工程，要使用IDS4（IdentityServer4）做身份认证首先得在程序管理控制台导入IDS4的NuGet包：Install-Package IdentityServer4

2.因为客户端凭证的方式会在api根目录下生成一个tempkey.rsa文件，所以需要在在Starut.cs构造函数中注入IHostingEnvironment

         public IHostingEnvironment Environment { get; }
         public Startup(IConfiguration configuration, IHostingEnvironment environment)
         {
             Configuration = configuration;
             Environment = environment;
         }

3.导入IDS4的包之后我们需要在ConfigureServices中添加如下内容：

 var builder = services.AddIdentityServer()
                 .AddInMemoryIdentityResources(Config.GetIdentityResources())
                 .AddInMemoryApiResources(Config.GetApis())
                 .AddInMemoryClients(Config.GetClients())
                 //.AddTestUsers(Config.GetUsers());

             services.AddMvcCore()
                         .AddAuthorization()
                         .AddJsonFormatters();
             #region 客户端凭证的方式需要添加此处代码生成证书
             if (Environment.IsDevelopment())
             {
                 builder.AddDeveloperSigningCredential();
             }
             else
             {
                 throw new Exception("need to configure key material");
             }
             #endregion

             services.AddAuthentication("Bearer")
                 .AddJwtBearer("Bearer", options =>
                 {
                     options.Authority = "http://localhost:5000";
                     //开发环境禁用了https，默认为开开启
                     options.RequireHttpsMetadata = false;

                     options.Audience = "api1";
                 });

4.在Configure中添加identityServer中间件：

//在UseMvc之前即可
app.UseIdentityServer();

然后我们在VaulesController中修改下代码，在后面客户端的时候用来测试

    [Route("api/[controller]")]
    [Authorize]
    [ApiController]
    public class ValuesController : ControllerBase
    {
        // GET api/values
        [HttpGet]
        public ActionResult Get()
        {
            return new JsonResult(from c in User.Claims select new { c.Type, c.Value });
        }
    }

客户端需要导入IdentityModel Nuget包

下面代码中GetDiscoveryDocumentAsync()方法主要是从API服务的http://localhost:5000/.well-known/openid-configuration获取访问token的接口，即TokenEndpoint，debug可看到TokenEndpoint=http://localhost:5000/connect/token,经过验证直接将Addres赋值为http://localhost:5000/connect/token也是可以正常获取token的,查看IdentityModel源码也是在url中追加了/.well-known/openid-configuration

  var  _client = new HttpClient(); 

  var disco = _client.GetDiscoveryDocumentAsync("http://localhost:5000").Result;
  if (disco.IsError)
    {
      Console.WriteLine(disco.Error);
    }

 var tokenResponse = _client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
         {

           Address = disco.TokenEndpoint,
             //Address="http://localhost:5000/connect/token",//直接使用获取token的地址
           ClientId = "client",
           ClientSecret = "secret",
           Scope = "api1"
         }).Result;

  if (tokenResponse.IsError)
        {
          Console.WriteLine(tokenResponse.Error);
          Console.ReadKey();
          return;
        }
  Console.WriteLine("============================客户端获取token================================================");
  Console.WriteLine(tokenResponse.Json);

  _client.SetBearerToken(tokenResponse.AccessToken);
   var response = _client.GetAsync("http://localhost:5000/api/Values").Result;
   if (!response.IsSuccessStatusCode)
      {
        Console.WriteLine(response.StatusCode);
      }
      else
      {
        var content = response.Content.ReadAsStringAsync().Result;
        Console.WriteLine(JArray.Parse(content));
      }

以下是运行之后的结果