Core篇——初探IdentityServer4(OpenID Connect模式)

Core篇——初探IdentityServer4（OpenID Connect客户端验证）

目录

1、Oauth2协议授权码模式介绍
2、IdentityServer4的OpenID Connect客户端验证简单实现

Oauth2协议授权码模式介绍

• 授权码模式是Oauth2协议中最严格的认证模式，它的组成以及运行流程是这样
  1、用户访问客户端，客户端将用户导向认证服务器
  2、用户在认证服务器输入用户名密码选择授权，认证服务器认证成功后，跳转至一个指定好的"跳转Url"，同时携带一个认证码。
  3、用户携带认证码请求指定好的"跳转Url"再次请求认证服务器（这一步后台完成，对用户不可见），此时，由认证服务器返回一个Token
  4、客户端携带token请求用户资源
• 

• OpenId Connect运行流程为
  1、用户访问客户端，客户端将用户导向认证服务器
  2、用户在认证服务器输入用户名密码认证授权
  3、认证服务器返回token和资源信息
• 

IdentityServer4的OpenID Connect客户端验证简单实现

Server部分

• 添加一个Mvc项目，配置Config.cs文件

•    public class Config
       {
           //定义要保护的资源（webapi）
           public static IEnumerable<ApiResource> GetApiResources()
           {
               return new List<ApiResource>
               {
                   new ApiResource("api1", "My API")
               };
           }
           //定义可以访问该API的客户端
           public static IEnumerable<Client> GetClients()
           {
               return new List<Client>
               {
                   new Client
                   {
                       ClientId = "mvc",
                       // no interactive user, use the clientid/secret for authentication
                       AllowedGrantTypes = GrantTypes.Implicit,  //简化模式
                       // secret for authentication
                       ClientSecrets =
                       {
                           new Secret("secret".Sha256())
                       },
                       RequireConsent =true,                                  //用户选择同意认证授权
                       RedirectUris={ "http://localhost:5001/signin-oidc" },  //指定允许的URI返回令牌或授权码(我们的客户端地址)
                       PostLogoutRedirectUris={ "http://localhost:5001/signout-callback-oidc" },//注销后重定向地址 参考https://identityserver4.readthedocs.io/en/release/reference/client.html
                       LogoUri="https://ss1.bdstatic.com/70cFuXSh_Q1YnxGkpoWK1HF6hhy/it/u=3298365745,618961144&fm=27&gp=0.jpg",
                       // scopes that client has access to
                       AllowedScopes = {                       //客户端允许访问个人信息资源的范围
                           IdentityServerConstants.StandardScopes.Profile,
                           IdentityServerConstants.StandardScopes.OpenId,
                           IdentityServerConstants.StandardScopes.Email,
                           IdentityServerConstants.StandardScopes.Address,
                           IdentityServerConstants.StandardScopes.Phone
                       }
                   }
               };
           }
           public static List<TestUser> GeTestUsers()
           {
               return new List<TestUser>
               {
                   new TestUser
                   {
                       SubjectId = "",
                       Username = "alice",
                       Password = "password"
                   },
                   new TestUser
                   {
                       SubjectId = "",
                       Username = "bob",
                       Password = "password"
                   }
               };
           }
           //openid  connect
           public static IEnumerable<IdentityResource> GetIdentityResources()
           {
               return new List<IdentityResource>
               {
                   new IdentityResources.OpenId(),
                   new IdentityResources.Profile(),
                   new IdentityResources.Email()
               };
           }
       }

  Config

• 添加几个ViewModel 用来接收解析跳转URL后的参数

•      public class InputConsentViewModel
       {
           public string Button { get; set; }
           public IEnumerable<string> ScopesConsented { get; set; }
  
           public bool RemeberConsent { get; set; }
           public string ReturnUrl { get; set; }
       }
       //解析跳转url后得到的应用权限等信息
       public class ConsentViewModel:InputConsentViewModel
       {
           public string ClientId { get; set; }
           public string ClientName { get; set; }
           public string ClientUrl { get; set; }
           public string ClientLogoUrl { get; set; }
           public IEnumerable<ScopeViewModel> IdentityScopes { get; set; }
           public IEnumerable<ScopeViewModel> ResourceScopes { get; set; }
       }
       //接收Scope
       public class ScopeViewModel
       {
           public string Name { get; set; }
           public string DisplayName { get; set; }
           public string Description { get; set; }
           public bool Emphasize { get; set; }
           public bool Required { get; set; }
           public bool Checked { get; set; }
       }
       public class ProcessConsentResult
       {
           public string RedirectUrl { get; set; }
           public bool IsRedirectUrl => RedirectUrl != null;
           public string ValidationError { get; set; }
           public ConsentViewModel ViewModel { get; set; }
       }

  ViewModel

• 配置StartUp，将IdentityServer加入到DI容器,这里有个ConsentService，用来处理解析跳转URL的数据，这个Service在下面实现。

         public void ConfigureServices(IServiceCollection services)
         {
             services.AddIdentityServer()
                 .AddDeveloperSigningCredential()  //添加登录证书
                 .AddInMemoryIdentityResources(Config.GetIdentityResources())  //添加IdentityResources
                 .AddInMemoryApiResources(Config.GetApiResources())
                 .AddInMemoryClients(Config.GetClients())
                 .AddTestUsers(Config.GeTestUsers());
             services.AddScoped<ConsentService>();
             services.AddMvc();
         }
         public void Configure(IApplicationBuilder app, IHostingEnvironment env)
         {
             if (env.IsDevelopment())
             {
                 app.UseDeveloperExceptionPage();
             }
             else
             {
                 app.UseExceptionHandler("/Home/Error");
             }
             app.UseStaticFiles();
             app.UseIdentityServer();//引用IdentityServer中间件
             app.UseMvc(routes =>
             {
                 routes.MapRoute(
                     name: "default",
                     template: "{controller=Home}/{action=Index}/{id?}");
             });
         }

Startup配置IdentityServer

• 添加一个ConsentService，用来根据Store拿到Resource

•      public class ConsentService
       {
           private readonly IClientStore _clientStore;
           private readonly IResourceStore _resourceStore;
           private readonly IIdentityServerInteractionService _identityServerInteractionService;
  
           public ConsentService(IClientStore clientStore,
               IResourceStore resourceStore,
               IIdentityServerInteractionService identityServerInteractionService)
           {
               _clientStore = clientStore;
               _resourceStore = resourceStore;
               _identityServerInteractionService = identityServerInteractionService;
           }
  
           public async Task<ConsentViewModel> BuildConsentViewModel(string returnUrl)
           {
               //根据return url 拿到ClientId 等信息
               var request = await _identityServerInteractionService.GetAuthorizationContextAsync(returnUrl);
               if (returnUrl == null)
                   return null;
               var client = await _clientStore.FindEnabledClientByIdAsync(request.ClientId);
               var resources = await _resourceStore.FindEnabledResourcesByScopeAsync(request.ScopesRequested);//根据请求的scope 拿到resources
  
               return CreateConsentViewModel(request, client, resources);
           }
  
           private ConsentViewModel CreateConsentViewModel(AuthorizationRequest request, Client client, Resources resources)
           {
               var vm = new ConsentViewModel();
               vm.ClientName = client.ClientName;
               vm.ClientLoggoUrl = client.LogoUri;
               vm.ClientUrl = client.ClientUri;
               vm.RemeberConsent = client.AllowRememberConsent;
  
               vm.IdentityScopes = resources.IdentityResources.Select(i => CreateScopeViewModel(i));
               //api resource
               vm.ResourceScopes = resources.ApiResources.SelectMany(i => i.Scopes).Select(x => CreateScopeViewModel(scope: x));
               return vm;
           }
           //identity 1个scopes
           private ScopeViewModel CreateScopeViewModel(IdentityResource identityResource)
           {
               return new ScopeViewModel
               {
                   Name = identityResource.Name,
                   DisplayName = identityResource.DisplayName,
                   Description = identityResource.Description,
                   Required = identityResource.Required,
                   Checked = identityResource.Required,
                   Emphasize = identityResource.Emphasize
               };
           }
           //apiresource
           private ScopeViewModel CreateScopeViewModel(Scope scope)
           {
               return new ScopeViewModel
               {
                   Name = scope.Name,
                   DisplayName = scope.DisplayName,
                   Description = scope.Description,
                   Required = scope.Required,
                   Checked = scope.Required,
                   Emphasize = scope.Emphasize
               };
           }
       }

  ConsentService

• 添加一个ConsentController，用来显示授权登录页面，以及相应的跳转登录逻辑。

 public class ConsentController : Controller
     {
         private readonly ConsentService _consentService;
         public ConsentController(ConsentService consentService)
         {
             _consentService = consentService;
         }

         public async Task<IActionResult> Index(string returnUrl)
         {
             //调用consentService的BuildConsentViewModelAsync方法，将跳转Url作为参数传入，解析得到一个ConsentViewModel
             var model =await _consentService.BuildConsentViewModelAsync(returnUrl);
             if (model == null)
                 return null;
             return View(model);
         }
         [HttpPost]
         public async Task<IActionResult> Index(InputConsentViewModel viewModel)
         {
             //用户选择确认按钮的时候，根据选择按钮确认/取消，以及勾选权限
             var result = await _consentService.PorcessConsent(viewModel);
             if (result.IsRedirectUrl)
             {
                 return Redirect(result.RedirectUrl);
             }
             if (!string.IsNullOrEmpty(result.ValidationError))
             {
                 ModelState.AddModelError("", result.ValidationError);
             }
             return View(result.ViewModel);
         }
     }

ConsentController

• 配置服务端的登录Controller

•      public class AccountController : Controller
       {
           private readonly TestUserStore _user;  //放入DI容器中的TestUser(GeTestUsers方法)，通过这个对象获取
           public AccountController(TestUserStore user)
           {
               _user = user;
           }        public IActionResult Login(string returnUrl = null)
           {
               ViewData["ReturnUrl"] = returnUrl;
               return View();
           }
  
           [HttpPost]
           public async Task<IActionResult> Login(LoginViewModel loginViewModel,string returnUrl)
           {
               //用户登录
               if (ModelState.IsValid)
               {
                   ViewData["ReturnUrl"] = returnUrl;
                   var user =  _user.FindByUsername(loginViewModel.Email);
                   if (user == null)
                   {
                       ModelState.AddModelError(nameof(loginViewModel.Email), "Email not exists");
                   }
                   else
                   {
                       var result = _user.ValidateCredentials(loginViewModel.Email, loginViewModel.Password);
                       if(result)
                       {
                           var props = new AuthenticationProperties()
                           {
                               IsPersistent = true,
                               ExpiresUtc = DateTimeOffset.UtcNow.AddMinutes()
                           };
                           await Microsoft.AspNetCore.Http.AuthenticationManagerExtensions.SignInAsync(   //Id4扩展方法和HttpContext扩展方法重名，这里强制使用命名空间方法
                               this.HttpContext,
                               user.SubjectId,
                               user.Username,
                               props);
                           return RedirectToLoacl(returnUrl);
                       }
                       else
                       {
                           ModelState.AddModelError(nameof(loginViewModel.Email), "Wrong password");
                       }
                   }
               }
  
               return View();
           }

  AccountController

• 接下来给Consent控制器的Index添加视图

•  @using mvcCookieAuthSample.ViewModels
   @model  ConsentViewModel
   <h2>ConsentPage</h2>
   @*consent*@
   <div class="row page-header">
       <div class="col-sm-10">
           @if (!string.IsNullOrWhiteSpace(Model.ClientLogoUrl))
           {
               <div>
                   <img src="@Model.ClientLogoUrl" style="width:50px;height:50px" />
               </div>
           }
           <h1>@Model.ClientName</h1>
           <p>希望使用你的账户</p>
       </div>
   </div>
   @*客户端*@
   <div class="row">
       <div class="col-sm-8">
           <div asp-validation-summary="All" class="danger"></div>
           <form asp-action="Index" method="post">
               <input type="hidden" asp-for="ReturnUrl"/>
               @if (Model.IdentityScopes.Any())
               {
                   <div class="panel">
                       <div class="panel-heading">
                           <span class="glyphicon glyphicon-user"></span>
                           用户信息
                       </div>
                       <ul class="list-group">
                           @foreach (var scope in Model.IdentityScopes)
                           {
                               @Html.Partial("_ScopeListitem.cshtml", scope);
                           }
                       </ul>
                   </div>
               }
               @if (Model.ResourceScopes.Any())
               {
                   <ul class="list-group">
                       @foreach (var scope in Model.ResourceScopes)
                       {
                           @Html.Partial("_ScopeListitem.cshtml", scope);
                       }</ul>
               }
               <div>
                   <label>
                       <input type="checkbox" asp-for="RemeberConsent"/>
                       <strong>记住我的选择</strong>
                   </label>
               </div>
               <div>
                   <button name="button" value="yes" class="btn btn-primary"  autofocus>同意</button>
                   <button name="button" value="no">取消</button>
                   @if (!string.IsNullOrEmpty(Model.ClientUrl))
                   {
                       <a href="@Model.ClientUrl" class="pull-right btn btn-default">
                           <span class="glyphicon glyphicon-info-sign" ></span>
                           <strong>@Model.ClientUrl</strong>
                       </a>
                   }
               </div>
           </form>
       </div>
   </div>
   //这里用到了一个分部视图用来显示用户允许授权的身份资源和api资源
   @using mvcCookieAuthSample.ViewModels
   @model ScopeViewModel;
   <li>
       <label>
           <input type="checkbox"
                  name="ScopesConsented"
                  id="scopes_@Model.Name"
                  value="@Model.Name"
                  checked=@Model.Checked
                  disabled=@Model.Required/>
           @if (Model.Required)
           {
               <input type="hidden" name="ScopesConsented" value="@Model.Name" />
           }
           <strong>@Model.Name</strong>
           @if (Model.Emphasize)
           {
               <span class="glyphicon glyphicon-exclamation-sign"></span>
           }
       </label>
       @if(string.IsNullOrEmpty(Model.Description))
       {
           <div>
               <label for="scopes_@Model.Name">@Model.Description</label>
           </div>
       }
   </li>

  Index.cshtml

• 添加客户端，依旧添加一个mvc项目，配置startup，Home/Index action打上Authorize标签。

•  public void ConfigureServices(IServiceCollection services)
           {
               services.AddAuthentication(options => {
                   options.DefaultScheme = "Cookies";
                   options.DefaultChallengeScheme = "oidc";//openidconnectservice
               })
               .AddCookie("Cookies")
               .AddOpenIdConnect("oidc",options=> {
                   options.SignInScheme = "Cookies";
                   options.Authority = "http://localhost:5000";    //设置认证服务器
                   options.RequireHttpsMetadata = false;
                   options.ClientId = "mvc";                       //openidconfig的配置信息
                   options.ClientSecret = "secret";
                   options.SaveTokens = true;
               });
               services.AddMvc();
           }
           public void Configure(IApplicationBuilder app, IHostingEnvironment env)
           {
               if (env.IsDevelopment())
               {
                   app.UseDeveloperExceptionPage();
                   app.UseBrowserLink();
               }
               else
               {
                   app.UseExceptionHandler("/Home/Error");
               }
               app.UseStaticFiles();
               app.UseAuthentication();
               app.UseMvc(routes =>
               {
                   routes.MapRoute(
                       name: "default",
                       template: "{controller=Home}/{action=Index}/{id?}");
               });
           }

  客户端配置Startup

设置服务端端口5000，运行服务器端；设置客户端端口5001，运行客户端。我们可以看到，localhost:5001会跳转至认证服务器

然后看下Url=》

使用config配置的testuser登录系统，选择允许授权的身份权限。登录成功后看到我们的Claims

总结

• 最后来总结一下
  用户访问客户端（5001端口程序），客户端将用户导向认证服务器（5000程序），用户选择允许授权的身份资源和api资源后台解析（这两个资源分别由Resources提供，resources 由IResourceStore解析returnurl后的Scopes提供），最后由ProfileService返回数条Claim。（查看ConsentService的各个方法）
•