IdentityServer4之Client Credentials（客户端凭据许可）

2022-11-29 20:15:27

IdentityServer4之Client Credentials（客户端凭据许可）

参考

认证服务端配置

认证服务ApiResource配置

new ApiResource("api1", "api项目 一")

{

    ApiSecrets = { new Secret("api1pwd".Sha256()) }

},

认证服务Client配置

//client credentials client

new Client

{

    ClientId = "client",

    // no interactive user, use the clientid/secret for authentication

    AllowedGrantTypes = GrantTypes.ClientCredentials,
    //Jwt = 0；Reference = 1支持撤销；

    AccessTokenType = AccessTokenType.Reference,

    // secret for authentication

    ClientSecrets =

    {

        new Secret("secret".Sha256()),

        new Secret("abc".Sha256())

    },

    // scopes that client has access to

    AllowedScopes = { "api1" }

},

认证服务Startup配置

// configure identity server with in-memory stores, keys, clients and scopes

services.AddIdentityServer()

    .AddDeveloperSigningCredential()

    .AddInMemoryApiResources(Config.GetApiResources())

    .AddInMemoryClients(Config.GetClients());

配置完成启动访问http://localhost:5000/.well-known/openid-configuration

资源服务Api配置

资源服务器Startup配置

services.AddMvcCore()

    .AddAuthorization()

    .AddJsonFormatters();

services.AddAuthentication("Bearer")

    .AddIdentityServerAuthentication(options =>

    {

        options.Authority = "http://localhost:5000";

        options.RequireHttpsMetadata = false;

        options.ApiName = "api1";

        options.ApiSecret = "api1pwd";  //对应ApiResources中的密钥

    });

添加接口

[Route("[controller]")]

[Authorize]

public class IdentityController : ControllerBase

{

    [HttpGet]

    public IActionResult Get()

    {

        var info = from c in User.Claims select new { c.Type, c.Value };

        var list = info.ToList();

        list.Add(new { Type = "api1返回", Value = DateTime.Now.ToString("yyyy-MM-dd HH:mm:ss") });

        return new JsonResult(list);

    }

}

Client客户端

客户端与授权服务器进行身份验证并向令牌端点请求访问令牌。

授权服务器对客户端进行身份验证，如果有效，颁发访问令牌。

//credentials client

private void btnAuth_Click(object sender, EventArgs e)

{

    // discover endpoints from metadata

    Task<DiscoveryResponse> discoTask = DiscoveryClient.GetAsync(txtCCAuthSer.Text);

    discoTask.Wait();

    var disco = discoTask.Result;

    if (disco.IsError)

    {

        MessageBox.Show(disco.Error, "提示信息", MessageBoxButtons.OK, MessageBoxIcon.Information);

        txtCCResult.Text = string.Empty;

        txtAccessToken.Text = string.Empty;

        return;

    }

    // request token

    var tokenClient = new TokenClient(disco.TokenEndpoint, txtCCClient.Text, txtCCSecret.Text);

    Task<TokenResponse> tokenTask = tokenClient.RequestClientCredentialsAsync(txtCCScopes.Text);

    tokenTask.Wait();

    var tokenResponse = tokenTask.Result;

    if (tokenResponse.IsError)

    {

        MessageBox.Show(tokenResponse.Error, "提示信息", MessageBoxButtons.OK, MessageBoxIcon.Information);

        txtCCResult.Text = string.Empty;

        txtAccessToken.Text = string.Empty;

        return;

    }

    txtCCResult.Text = tokenResponse.Json.ToString();

    txtAccessToken.Text = tokenResponse.AccessToken;

}

调用Api

private void btnCallApi_Click(object sender, EventArgs e)

{

    // call api

    var client = new HttpClient();

    client.SetBearerToken(txtAccessToken.Text);

    var responseTask = client.GetAsync(txtCCApiUrl.Text);

    responseTask.Wait();

    var response = responseTask.Result;

    if (!response.IsSuccessStatusCode)

    {

        MessageBox.Show(response.StatusCode.ToString(), "提示信息", MessageBoxButtons.OK, MessageBoxIcon.Information);

        txtApiResult.Text = string.Empty;

    }

    else

    {

        var contentTask = response.Content.ReadAsStringAsync();

        contentTask.Wait();

        var content = contentTask.Result;

        txtApiResult.Text = JArray.Parse(content).ToString();

    }

}

获取token过程解析

Jwt形式获取access_token

通过IdentityModel发送请求

监听请求数据

客户端身份验证两种方式
1、Authorization: Basic czZCaGRSa3F0Mzo3RmpmcDBaQnIxS3REUmJuZlZkbUl3。

POST /connect/token HTTP/1.1

Connection: Keep-Alive

Content-Type: application/x-www-form-urlencoded

Accept: application/json

Authorization: Basic Y2xpZW50OnNlY3JldA==

Expect: -continue

Host: localhost:

MS-ASPNETCORE-TOKEN: 08de58f6-58ee-4f05-8d95-3829dde6ae09

X-Forwarded-For: [::]:

X-Forwarded-Proto: http

Content-Length:

grant_type=client_credentials&scope=api1

2、client_id（客户端标识），client_secret（客户端秘钥）。