.net core 3.1 Identity Server4 (Hybrid模式)

• .net core 3.1 Identity Server4 (Hybrid模式)
  • Hybrid 模式的理解
    • code与id_token
    • code与token
    • code，token与id token
  • 项目演示
    • 在授权服务器中添加客户端信息(老客套了)
    • 创建Hybrid客户端项目(AiDaSi.OcDemo.HybridMvc)
  • 处理Claims
  • 退出设置
    • 服务器上设置退出
    • 客户端上设置退出
  • RBAC（角色控制）
    • 在授权服务器中定义角色
    • 在客户端中更新角色
    • 解决问题一
    • 解决问题二
    • 解决未授权问题
  • ABAC
    • 添加服务器端政策授权Claim
    • 添加客户端端政策授权
    • 运行测试
    • 自定义客户端政策处理

Hybrid 模式的理解

code与id_token

code与token

code，token与id token

项目演示

在授权服务器中添加客户端信息(老客套了)

1. new Client
2. {
3. ClientId="hybrid_client",
4. ClientSecrets = {new Secret("hybrid_client_secret".Sha256()) },
5. AllowedGrantTypes = GrantTypes.Hybrid,
6. RequirePkce = false,
7. RedirectUris =
8. {
9. "https://localhost:6027/signin-oidc"
10. },
11. BackChannelLogoutUri = "https://localhost:6027/logout",
12. PostLogoutRedirectUris =
13. {
14. "https://localhost:6027/signout-callback-oidc"
15. },
16. // 是否需要将token放入到Claim中
17. AlwaysIncludeUserClaimsInIdToken = false,
18. // 获取或设置一个值，该值指示是否允许脱机访问. 默认值为 false。
19. AllowOfflineAccess = true,
20. AllowedScopes =
21. {
22. "ApiOne",
23. IdentityServerConstants.StandardScopes.OpenId,
24. IdentityServerConstants.StandardScopes.Profile,
25. "rc.bc"
26. }
27. }

创建Hybrid客户端项目(AiDaSi.OcDemo.HybridMvc)

1. <ItemGroup>
2. <PackageReference Include="IdentityModel" Version="4.5.0" />
3. <PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="3.1.9" />
4. </ItemGroup>

1. public Startup(IConfiguration configuration)
2. {
3. Configuration = configuration;
4. // 我们关闭了JWT的Claim 类型映射, 以便允许well-known claims
5. JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
6. }
8. public IConfiguration Configuration { get; }
10. public void ConfigureServices(IServiceCollection services)
11. {
12. services.AddControllersWithViews();
13. services.AddHttpClient();
14. JwtSecurityTokenHandler.DefaultMapInboundClaims = false;
16. services.AddSingleton<IDiscoveryCache>(r =>
17. {
18. var factory = r.GetRequiredService<IHttpClientFactory>();
19. return new DiscoveryCache("https://localhost:7200", () => factory.CreateClient());
20. });
23. services.AddAuthentication(options =>
24. {
25. options.DefaultScheme = "Cookies";
26. options.DefaultChallengeScheme = "oidc";
27. })
28. .AddCookie("Cookies") // 我们用作Cookies作为首选方式
29. .AddOpenIdConnect("oidc", options =>
30. {
33. options.Authority = "https://localhost:7200";
34. options.RequireHttpsMetadata = false;
36. options.ClientId = "hybrid_client";
37. options.ClientSecret = "hybrid_client_secret";
39. options.ResponseType = "code id_token";
41. options.GetClaimsFromUserInfoEndpoint = true;
42. options.SaveTokens = true;
46. options.Scope.Clear(); // 清理范围
47. options.Scope.Add("ApiOne");
48. options.Scope.Add("openid");
49. options.Scope.Add("profile");
50. options.Scope.Add("rc.bc");
51. options.Scope.Add("offline_access");// 脱机访问令牌
53. });
56. }
58. public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
59. {
60. if (env.IsDevelopment())
61. {
62. app.UseDeveloperExceptionPage();
63. }
64. else
65. {
66. app.UseExceptionHandler("/Home/Error");
67. }
68. app.UseStaticFiles();
70. app.UseRouting();
72. app.UseAuthentication();
74. app.UseAuthorization();
77. app.UseEndpoints(endpoints =>
78. {
79. endpoints.MapControllerRoute(
80. name: "default",
81. pattern: "{controller=Home}/{action=Index}/{id?}");
82. });
83. }

1. {
2. "profiles": {
3. "AiDaSi.OcDemo.HybridMvc": {
4. "commandName": "Project",
5. "launchBrowser": true,
6. "applicationUrl": "https://localhost:6027",
7. "environmentVariables": {
8. "ASPNETCORE_ENVIRONMENT": "Development"
9. }
10. }
11. }
12. }

1. public class HomeController : Controller
2. {
3. private readonly ILogger<HomeController> _logger;
4. private IHttpClientFactory _httpClientFactory;
6. public HomeController(ILogger<HomeController> logger, IHttpClientFactory httpFactory)
7. {
8. _logger = logger;
9. _httpClientFactory = httpFactory;
10. }
12. public IActionResult Index()
13. {
14. return View();
15. }
18. [Authorize]
19. public async Task<IActionResult> Privacy()
20. {
21. var accessToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.AccessToken);
22. var idToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.IdToken);
23. var refreshToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.RefreshToken);
24. var code = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.Code);
26. ViewData["accessToken"] = accessToken;
27. ViewData["idToken"] = idToken;
28. ViewData["refreshToken"] = refreshToken;
29. ViewData["code"] = code;
30. // 获取接口数据
31. var httpClient = _httpClientFactory.CreateClient();
32. //httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
33. httpClient.SetBearerToken(accessToken);
34. // 验证Token是否失效
35. string tokenStr = accessToken;
36. var handler = new JwtSecurityTokenHandler();
37. var payload = handler.ReadJwtToken(tokenStr).Payload;
38. var expclaim = payload.Claims.FirstOrDefault(x => x.Type == "exp");
39. DateTime dateTime = expclaim.Value.unixtime();
40. int compNum = DateTime.Compare(DateTime.Now, dateTime);
41. //判断当前时间是否大于token的过期时间，如果有就刷新token，这样就能达到无缝衔接
42. if (compNum > 0)
43. {
44. await RenewTokensAsync();
45. return RedirectToAction();
46. }
47. var Result = await httpClient.GetAsync("http://localhost:5280/WeatherForecast");
48. if (Result.IsSuccessStatusCode)
49. {
50. ViewData["Apione"] = await Result.Content.ReadAsStringAsync();
51. }
52. return View();
53. }
56. private async Task<string> RenewTokensAsync()
57. {
58. var client = _httpClientFactory.CreateClient();
59. var disco = await client.GetDiscoveryDocumentAsync("https://localhost:7200");
60. if (disco.IsError)
61. {
62. // 我们这里将Cookie清空掉
63. foreach (var item in Request.Cookies)
64. {
65. Response.Cookies.Delete(item.Key);
66. }
67. // 报错
68. return await Task.FromResult(disco.Error);
69. // throw new Exception(disco.Error);
70. }
72. var refreshToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.RefreshToken);
74. // 刷新token的操作
75. var tokenResponse = await client.RequestRefreshTokenAsync(new RefreshTokenRequest
76. {
77. Address = disco.TokenEndpoint,
78. ClientId = "client_id_mvc",
79. ClientSecret = "mvc_secret",
80. RefreshToken = refreshToken
81. });
83. #region 第一种写法
84. if (tokenResponse.IsError)
85. {
87. // 我们这里将Cookie清空掉
88. foreach (var item in Request.Cookies)
89. {
90. Response.Cookies.Delete(item.Key);
91. }
92. return await Task.FromResult(tokenResponse.Error);
93. // 报错
94. // throw new Exception(tokenResponse.Error);
95. }
97. var expiresAt = DateTime.UtcNow + TimeSpan.FromSeconds(tokenResponse.ExpiresIn);
99. var tokens = new[]
100. {
101. new AuthenticationToken
102. {
103. Name = OpenIdConnectParameterNames.IdToken,
104. Value = tokenResponse.IdentityToken
105. },
106. new AuthenticationToken
107. {
108. Name = OpenIdConnectParameterNames.AccessToken,
109. Value = tokenResponse.AccessToken
110. },
111. new AuthenticationToken
112. {
113. Name = OpenIdConnectParameterNames.RefreshToken,
114. Value = tokenResponse.RefreshToken
115. },
116. new AuthenticationToken
117. {
118. Name = "expires_at",
119. Value = expiresAt.ToString("o", CultureInfo.InvariantCulture)
120. }
121. };
123. // 获取身份认证的结果，包含当前的pricipal和properties
124. var currentAuthenticateResult =
125. await HttpContext.AuthenticateAsync(CookieAuthenticationDefaults.AuthenticationScheme);
127. // 把新的tokens存起来
128. currentAuthenticateResult.Properties.StoreTokens(tokens);
130. // 登录
131. await HttpContext.SignInAsync(CookieAuthenticationDefaults.AuthenticationScheme,
132. currentAuthenticateResult.Principal, currentAuthenticateResult.Properties);
134. return tokenResponse.AccessToken;
135. #endregion
137. #region 第二种写法
139. //下面将修改上下文
140. var authInfo = await HttpContext.AuthenticateAsync("Cookies");
142. authInfo.Properties.UpdateTokenValue("access_token", tokenResponse.AccessToken);
143. authInfo.Properties.UpdateTokenValue("id_token", tokenResponse.IdentityToken);
144. authInfo.Properties.UpdateTokenValue("refresh_token", tokenResponse.RefreshToken);
145. //二次认证（更新token）
146. await HttpContext.SignInAsync("Cookies", authInfo.Principal, authInfo.Properties);
148. #endregion
151. }
154. [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
155. public IActionResult Error()
156. {
157. return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });
158. }
159. }

1. @{
2. ViewData["Title"] = "Privacy Policy";
3. }
4. <h1>@ViewData["Title"]</h1>
7. <h2>Access Token：</h2>
8. <p>@ViewData["accessToken"]</p>
10. <h2>Id Token：</h2>
11. <p>@ViewData["idToken"]</p>
13. <h2>Refresh Token：</h2>
14. <p>@ViewData["refreshToken"]</p>
16. <h2>Code：</h2>
17. <p>@ViewData["code"]</p>
19. <h2>Apione：</h2>
20. <p>@ViewData["Apione"]</p>
22. <dl>
23. @foreach (var claim in User.Claims)
24. {
25. <dt>@claim.Type</dt>
26. <dd>@claim.Value</dd>
27. }
28. </dl>

1. public static class TimeHelper
2. {
3. //将unix时间戳转换成系统时间
4. public static DateTime unixtime(this string time)
5. {
6. DateTime dtStart = TimeZone.CurrentTimeZone.ToLocalTime(new DateTime(1970, 1, 1));
7. long lTime = long.Parse(time + "0000000");
8. TimeSpan toNow = new TimeSpan(lTime);
9. DateTime dtResult = dtStart.Add(toNow);
10. return dtResult;
11. }
12. //将系统时间转换成unix时间戳
13. public static long timeunix2(this DateTime dt)
14. {
15. DateTimeOffset dto = new DateTimeOffset(dt);
16. return dto.ToUnixTimeSeconds();
17. }
19. //将系统时间转换成unix时间戳
20. public static DateTime unixtime2(this double d)
21. {
22. System.DateTime time = System.DateTime.MinValue;
23. System.DateTime startTime = TimeZone.CurrentTimeZone.ToLocalTime(new System.DateTime(1970, 1, 1));
24. time = startTime.AddMilliseconds(d);
25. return time;
26. }

处理Claims

1. options.ClaimActions.Remove("nbf");
2. options.ClaimActions.Remove("amr");
3. options.ClaimActions.Remove("exp");

1. options.ClaimActions.DeleteClaim("sid");
2. options.ClaimActions.DeleteClaim("sub");
3. options.ClaimActions.DeleteClaim("idp");

退出设置

服务器上设置退出

客户端上设置退出

1. @if (User.Identity.IsAuthenticated)
2. {
3. <li class="nav-item">
4. <a class="nav-link text-dark" asp-area="" asp-controller="Home" asp-action="Logout">Logout</a>
5. </li>
6. }

1. public async Task<IActionResult> Logout()
2. {
3. return SignOut("Cookies", "oidc");
4. }

RBAC（角色控制）

在授权服务器中定义角色

1. new IdentityResource("roles","角色",new List<string>{ JwtClaimTypes.Role }),

在客户端中更新角色

1. public class RbacController : Controller
2. {
3. [Authorize]
4. public IActionResult Index()
5. {
6. return View();
7. }
8. [Authorize(Roles = "管理员")]
9. public IActionResult Admin()
10. {
11. return View("Index");
12. }
13. [Authorize(Roles = "普通")]
14. public IActionResult Common()
15. {
16. return View("Index");
17. }
18. [Authorize(Roles = "管理员,普通")]
19. public IActionResult Share()
20. {
21. return View("Index");
22. }
23. }

1. <div>
2. <h1> 是不是管理员:@User.IsInRole("管理员") </h1>
3. <h1> 是不是普通用户:@User.IsInRole("普通") </h1>
4. </div>

稍后解决这个问题…

解决问题一

1. // 是否需要将所有token中的Data放入到Claim中
2. AlwaysIncludeUserClaimsInIdToken = false,

1. options.GetClaimsFromUserInfoEndpoint = true;
2. // 从json用户数据中选择一个具有给定键名和 将其添加为声明。如果索赔实体已包含索赔，则此项不起作用使用给定的ClaimType。如果找不到键或值为空的。
3. // 当授权服务器端 AlwaysIncludeUserClaimsInIdToken = false 时
4. options.ClaimActions.MapUniqueJsonKey("role", "role");

解决问题二

1. options.ClaimActions.MapUniqueJsonKey("bb.api.bc", "bb.api.bc");

解决未授权问题

1. public class UnAuthorizedController : Controller
2. {
3. /// <summary>
4. /// 未授权访问
5. /// /UnAuthorized/AccessDenied
6. /// </summary>
7. /// <param name="ReturnUrl"></param>
8. /// <returns></returns>
9. public IActionResult AccessDenied(string ReturnUrl)
10. {
11. ViewBag.ReturnUrl = ReturnUrl;
12. return View();
13. }
14. }

1. <div>
2. <h1> 你所访问的地址"@ViewBag.ReturnUrl"未进行授权 </h1>
3. <h1> <a href="@ViewBag.ReturnUrl">是否再次尝试</a></h1>
4. </div>

1. .AddCookie("Cookies",option=> {
2. //添加未授权的访问页面
3. option.AccessDeniedPath = "/UnAuthorized/AccessDenied";
4. })

ABAC

添加服务器端政策授权Claim

1. new IdentityResource("locations","地点",new List<string>{ "location" }),

添加客户端端政策授权

1. options.Scope.Add("locations");

1. options.ClaimActions.MapUniqueJsonKey("location", "location");

1. services.AddAuthorization(option =>
2. {
3. option.AddPolicy("BobInAllWhere", builder =>
4. {
5. // 需要身份验证的用户
6. builder.RequireAuthenticatedUser();
7. // 需要名为FamilyName的Claim值为"He"政策为有效
8. builder.RequireClaim(JwtClaimTypes.FamilyName, "He");
9. // 需要名为location的Claim值为"allwhere"政策为有效
10. builder.RequireClaim("location", "allwhere");
11. });
12. });

1. public class AbacController : Controller
2. {
3. /// <summary>
4. /// /Abac/Index
5. /// </summary>
6. /// <returns></returns>
7. [Authorize(Policy = "BobInAllWhere")]
8. public IActionResult Index()
9. {
10. return View();
11. }
12. }

1. 只有 Policy = "BobInAllWhere" 与 FamilyName = "He" 的可以访问

运行测试

自定义客户端政策处理

1. public class BobInAllWhereRequirement: IAuthorizationRequirement
2. {
3. public BobInAllWhereRequirement()
4. {
5. }
6. }

1. public class BobInAllWhereHandler : AuthorizationHandler<BobInAllWhereRequirement>
2. {
3. protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, BobInAllWhereRequirement requirement)
4. {
5. // 获取Claim中的familyName的值
6. var familyName = context.User.Claims.FirstOrDefault(c => c.Type == JwtClaimTypes.FamilyName)?.Value;
7. // 获取Claim中的location的值
8. var location = context.User.Claims.FirstOrDefault(c => c.Type == "location")?.Value;
9. // 判断familyName的值为He，location 的值为allwhere，并且要用户是登录的状态
10. if (familyName == "He" && location == "allwhere" && context.User.Identity.IsAuthenticated)
11. {
12. // 放行通过
13. context.Succeed(requirement);
14. return Task.CompletedTask;
15. }
16. // 验证失败，通不过
17. context.Fail();
18. return Task.CompletedTask;
19. }
20. }

1. services.AddAuthorization(option =>
2. {
3. //option.AddPolicy("BobInAllWhere", builder =>
4. //{
5. // // 需要身份验证的用户
6. // builder.RequireAuthenticatedUser();
7. // // 需要名为FamilyName的Claim值为"He"政策为有效
8. // builder.RequireClaim(JwtClaimTypes.FamilyName, "He");
9. // // 需要名为location的Claim值为"allwhere"政策为有效
10. // builder.RequireClaim("location", "allwhere");
11. //});
13. option.AddPolicy("BobInAllWhere", builder =>
14. {
15. builder.AddRequirements(new BobInAllWhereRequirement());
16. });
17. });
18. services.AddSingleton<IAuthorizationHandler, BobInAllWhereHandler>();