IdentityServer4-HybridAndClientCredentials

一、服务器

Client设置：

  new Client
                 {
                     ClientId = "mvc1",
                     ClientName = "后台管理MVC客户端",
                     ClientSecrets = { new Secret("mvc1".Sha256()) },

                     AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
                     AllowOfflineAccess = true,
                     RequireConsent = false,
                     RedirectUris = { $"{ClientUrl}/signin-oidc",$"{LocalClientUrl}/signin-oidc"},
                     PostLogoutRedirectUris = { $"{ClientUrl}/signout-callback-oidc",$"{LocalClientUrl}/signout-callback-oidc"},

                     AllowedScopes =
                     {
                         IdentityServerConstants.StandardScopes.OpenId,
                         IdentityServerConstants.StandardScopes.Profile,
                         "IdServerAdmin_API"
                     },

                     AlwaysIncludeUserClaimsInIdToken = true
                 }

Startup.cs:

        /// <summary>
        /// 设置认证服务器
        /// </summary>
        /// <param name="services"></param>
        private void SetIdentityServer(IServiceCollection services)
        {
            #region 认证服务器
            var ServerUrl = Configuration.GetSection("AppSetting:ServerUrl").Value;
            var connectionString = Configuration.GetSection("AppSetting:ConnectionString").Value;

            //配置AccessToken的加密证书
            var rsa = new RSACryptoServiceProvider();
            //从配置文件获取加密证书
            rsa.ImportCspBlob(Convert.FromBase64String(Configuration["AppSetting:SigningCredential"]));
            var idServer = services.AddIdentityServer(options => {
                options.IssuerUri = ServerUrl;
                options.PublicOrigin = ServerUrl;

                options.Discovery.ShowApiScopes = true;
                options.Discovery.ShowClaims = true;

                options.Events.RaiseSuccessEvents = true;
                options.Events.RaiseFailureEvents = true;
                options.Events.RaiseErrorEvents = true;

            });
            //设置加密证书
            idServer.AddSigningCredential(new RsaSecurityKey(rsa));
            idServer.AddInMemoryApiResources(Config.GetApiResources());
            idServer.AddInMemoryIdentityResources(Config.GetIdentityResources());
            idServer.AddInMemoryClients(Config.GetClients());

            services.AddTransient<IMyUserStore, MyUserStore>();
            services.AddTransient<IProfileService, MyProfile>();
            services.AddTransient<IResourceOwnerPasswordValidator, MyUserValidator>();

            #endregion
        }

　　

 public class MyProfile : IProfileService
     {
         private readonly IMyUserStore _myUserStore;
         public MyProfile(IMyUserStore myUserStore)
         {
             _myUserStore = myUserStore;
         }

         public Task GetProfileDataAsync(ProfileDataRequestContext context)
         {
             var subjectId = context.Subject.GetSubjectId();
             var user = _myUserStore.GetUserById(subjectId);

             var claims = new List<Claim>
             {
                 new Claim("role",  user.Role),
                 new Claim("userguid", user.SubjectId),
                 new Claim("abc", "这是自定义的值。……。。…。……。……")
             };

             var q = context.RequestedClaimTypes;
             context.AddRequestedClaims(claims);
             context.IssuedClaims.AddRange(claims);

             return Task.FromResult();
         }

         public Task IsActiveAsync(IsActiveContext context)
         {
             var user = _myUserStore.GetUserById(context.Subject.GetSubjectId());
             context.IsActive = (user != null);

             return Task.FromResult();
         }
     }

 public interface IMyUserStore
     {
         JUser Find(string username, string userpass);
         JUser GetUserById(string subjectId);
     }

     public class MyUserStore : IMyUserStore
     {
         readonly IOptions<AppSetting> _options;
         readonly IMemoryCache _memoryCache;

         private const string CACHENAME = "MyUserStore";

         public MyUserStore(IOptions<AppSetting> options, IMemoryCache m_memoryCache)
         {
             _options = options;
             _memoryCache = m_memoryCache;
         }

         public List<JUser> GetList(bool reload=true)
         {
             if (reload)
             {
                 _memoryCache.Remove(CACHENAME);
             }

             List<JUser> list;
             if (!_memoryCache.TryGetValue(CACHENAME, out list)){
                 using(MySqlConnection conn = new MySqlConnection(_options.Value.ConnectionString))
                 {
                     list = conn.Query<JUser>("select * from juser").ToList();

                     //添加超级用户
                     JUser jc = new JUser()
                     {
                         UserName = _options.Value.SuperUserName,
                         UserPass = StringHelper.GetMd5(_options.Value.SuperPassword),
                         SubjectId = "a36005e2-5984-41f5-aa91-8e93b479d88e",
                         Role = "IdServerAdmin"
                     };

                     list.Add(jc);
                 }
                 _memoryCache.Set(CACHENAME, list);
             }
             return list;
         }

         public JUser Find(string username, string userpass)
         {
             var list = GetList();
             return list.SingleOrDefault(p => p.UserName == username && p.UserPass == StringHelper.GetMd5(userpass));
         }

         public JUser GetUserById(string subjectId)
         {
             var list = GetList();
             return list.SingleOrDefault(p => p.SubjectId == subjectId);
         }

 public class MyUserValidator : IResourceOwnerPasswordValidator
     {
         readonly IMyUserStore _myUserStore;

         public MyUserValidator(IMyUserStore myUserStore)
         {
             _myUserStore = myUserStore;
         }

         public Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
         {
             var q = _myUserStore.Find(context.UserName, context.Password);

             if (q != null)
             {
                 //验证成功
                 //使用subject可用于在资源服务器区分用户身份等等
                 //获取：资源服务器通过User.Claims.Where(l => l.Type == "sub").FirstOrDefault();
                 var claims = new List<Claim>();
                 claims.Add(new Claim("role", q.Role));
                 claims.Add(new Claim("userguid", q.SubjectId));

                 context.Result = new GrantValidationResult(subject: $"{q.SubjectId}", authenticationMethod: "custom", claims: claims.AsEnumerable());
             }
             else
             {
                 //验证失败
                 context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, "无效的用户凭证");
             }
             return Task.FromResult();
         }
     }

二、客户端：

  /// <summary>
         /// 设置认证客户端
         /// </summary>
         /// <param name="services"></param>
         private void SetIdentityClient(IServiceCollection services)
         {
             var ServerUrl = Configuration.GetSection("AppSetting:ServerUrl").Value;
             var client_id = Configuration.GetSection("AppSetting:SuperClientId").Value;
             var cient_secret = Configuration.GetSection("AppSetting:SuperClientSecret").Value;

             //services.Configure<MvcOptions>(options =>
             //{
             //    // Set LocalTest:skipSSL to true to skip SSL requrement in
             //    // debug mode. This is useful when not using Visual Studio.
             //    options.Filters.Add(new RequireHttpsAttribute());
             //});

             JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

             var idClient = services.AddAuthentication(options =>
             {
                 options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                 options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
             })
             .AddCookie()
             .AddOpenIdConnect(options =>
             {
                 options.SignOutScheme = OpenIdConnectDefaults.AuthenticationScheme;
                 options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme; // cookie middle setup above
                 options.Authority = ServerUrl; // 认证服务器
                 options.RequireHttpsMetadata = true; // SSL Https模式
                 options.ClientId = client_id; // 客户端（位于认证服务器）
                 options.ClientSecret = cient_secret;  // 客户端（位于认证服务器）
                 options.ResponseType = "code id_token"; // means Hybrid flow (id + access token)

                 options.GetClaimsFromUserInfoEndpoint = false;
                 options.SaveTokens = true;
                 options.TokenValidationParameters = new TokenValidationParameters
                 {
                     NameClaimType = "name",
                     RoleClaimType = "role"
                 };

                 options.Scope.Clear();
                 options.Scope.Add("openid");
                 options.Scope.Add("profile");
                 options.Scope.Add("IdServerAdmin_API");

                 options.Events = new OpenIdConnectEvents()
                 {
                     OnMessageReceived = (context) =>
                     {
                         return Task.FromResult();
                     },

                     OnUserInformationReceived = (context) =>
                     {
                         return Task.FromResult();
                     },
                     OnRedirectToIdentityProvider = (context) =>
                     {
                         //设置重定向地址,解决生产环境nginx+https访问，还是有问题。。。。。。。
                         context.Properties.RedirectUri = $"{ClientUrl}/signin-oidc";
                         //context.ProtocolMessage.RedirectUri = $"{ClientUrl}/signin-oidc";
                         return Task.FromResult();
                     },

                     OnTokenValidated = (context) =>
                     {
                         //context.Properties.RedirectUri = $"{ClientUrl}/signin-oidc";
                         return Task.FromResult();
                     },
                 };
             });
         }