.Net Identity OAuth 2.0 SecurityStamp 使用

起源：

近期帮别人做项目，涉及到OAuth认证，服务端主动使token失效，要使对应用户不能再继续访问，只能重新登陆，或者重新授权。

场景：

这种场景OAuth2.0是支持的，比如用户修改了密码，那所有之前保留在各个客户端的token均失效，要求用户重新提供凭证。

原因：

在之前的项目中，一旦授权服务AuthorizationServer发放了token，所有的资源服务只会通过统一的加密解密算法，解析出token中的信息包括用户身份等，就直接使用了。这样因为不和数据库或外部存储介质交互，所以效率会比较高。以下是在所有资源服务、包括认证服务Web.config中的配置，machineKey必须相同。

  <system.web>
    <compilation debug="true" targetFramework="4.5" />
    <httpRuntime targetFramework="4.5" />
    <machineKey decryptionKey="B7E121C5839A624E" validation="SHA1" validationKey="C2B8DF31AB96asd428066DFDA1A479542825F3B48865C4E47AF6A026F2" />
  </system.web>

这样效率是提高了，但是每次验证不与后端(尤指存储)交互，所以token一旦发出，除非客户端主动清除或着超出有效时间，否则都有效，有一定的失窃风险。

分析：

.Net在IdentityServer3.0在用户表中使用SecurityStamp字段，作为安全标识，去识别是否失效。默认情况是没有开启验证的，否则就像之前说的每次都会和数据库交互，降低性能。关于SecurityStamp的说明，大家可以看一下这篇文章：

What is ASP.NET Identity's IUserSecurityStampStore<TUser> interface?

This is meant to represent the current snapshot of your user's credentials. So if nothing changes, the stamp will stay the same. But if the user's password is changed, or a login is removed (unlink your google/fb account), the stamp will change. This is needed for things like automatically signing users/rejecting old cookies when this occurs, which is a feature that's coming in 2.0.

    Edit: Updated for 2.0.0. So the primary purpose of the SecurityStamp is to enable sign out everywhere. The basic idea is that whenever something security related is changed on the user, like a password, it is a good idea to automatically invalidate any existing sign in cookies, so if your password/account was previously compromised, the attacker no longer has access.

In 2.0.0 we added the following configuration to hook the OnValidateIdentity method in the CookieMiddleware to look at the SecurityStamp and reject cookies when it has changed. It also automatically refreshes the user's claims from the database every refreshInterval if the stamp is unchanged (which takes care of things like changing roles etc)

文章中给出的代码如下:

app.UseCookieAuthentication(new CookieAuthenticationOptions {
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
    LoginPath = new PathString("/Account/Login"),
    Provider = new CookieAuthenticationProvider {
        // Enables the application to validate the security stamp when the user logs in.
        // This is a security feature which is used when you change a password or add an external login to your account.
        OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
            validateInterval: TimeSpan.FromMinutes(),
            regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
    }
});

虽然这篇文章大致讲明白了，这是个什么东西和怎么用，但是仔细想想，还是有问题，因为我们是使用Bearer方式，这里只是Cookie，所以还差点什么。在资源服务中的配置如下：

namespace ResourceServer
{
    public partial class Startup
    {
        public void ConfigureAuth(IAppBuilder app)
        {
            app.UseOAuthBearerAuthentication(new Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationOptions());
        }
    }
}

所以我们应该更改的是OAuthBearerAuthenticationOptions这个对象。有找到文章参考如下：

Using bearer tokens (ASP.NET Identity 2.0) with WCF Data Services

总结：

在资源服务中，引入Microsoft.AspNet.Identity.Owin包，在Startup中，更改如下代码：

    public partial class Startup
    {
        public void ConfigureAuth(IAppBuilder app)
        {
            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions()
            {
                Provider = new OAuthBearerAuthenticationProvider()
                {
                    OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<UserManager, User>(
                        validateInterval: TimeSpan.FromMinutes(),
                        regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
                }
            });
        }
    }

查看SecurityStampValidator类的源码：

public static Func<CookieValidateIdentityContext, Task> OnValidateIdentity<TManager, TUser, TKey>(
            TimeSpan validateInterval, Func<TManager, TUser, Task<ClaimsIdentity>> regenerateIdentityCallback,
            Func<ClaimsIdentity, TKey> getUserIdCallback)
            where TManager : UserManager<TUser, TKey>
            where TUser : class, IUser<TKey>
            where TKey : IEquatable<TKey>
        {
            .....
　　　　　　　　　　　　　　 var user = await manager.FindByIdAsync(userId).WithCurrentCulture();
                        var reject = true;
                        // Refresh the identity if the stamp matches, otherwise reject
                        if (user != null && manager.SupportsUserSecurityStamp)
                        {
                            var securityStamp =
                                context.Identity.FindFirstValue(Constants.DefaultSecurityStampClaimType);
                            if (securityStamp == await manager.GetSecurityStampAsync(userId).WithCurrentCulture())
                            {
                                reject = false;
                                // Regenerate fresh claims if possible and resign in
                                if (regenerateIdentityCallback != null)
                                {
                                    var identity = await regenerateIdentityCallback.Invoke(manager, user).WithCurrentCulture();
                                    if (identity != null)
                                    {
                                        // Fix for regression where this value is not updated
                                        // Setting it to null so that it is refreshed by the cookie middleware
                                        context.Properties.IssuedUtc = null;
                                        context.Properties.ExpiresUtc = null;
                                        context.OwinContext.Authentication.SignIn(context.Properties, identity);
                                    }
                                }
                            }
                        }
  　　　　　　　　　　.....
            };
        }

它会自己判断token中解析出来的securityStamp是否与数据库之前保存的一致，至此，完全解决。

问题：

• 我们之前说过的，每次请求认证都会请求数据库，降低性能。
• 资源服务不能独立，必须与用户库绑定。