asp.net core系列 56 IS4使用OpenID Connect添加用户认证

public static IEnumerable<Client> GetClients()
{
return new List<Client>
{
new Client
{
ClientId = "client", // no interactive user, use the clientid/secret for authentication
AllowedGrantTypes = GrantTypes.ClientCredentials, // secret for authentication
ClientSecrets =
{
new Secret("secret".Sha256())
}, // scopes that client has access to
AllowedScopes = { "api1" }
},
// resource owner password grant client
new Client
{
ClientId = "ro.client",
AllowedGrantTypes = GrantTypes.ResourceOwnerPassword, ClientSecrets =
{
new Secret("secret".Sha256())
},
AllowedScopes = { "api1" }
},
// OpenID Connect implicit flow client (MVC)
new Client
{
ClientId = "mvc",
ClientName = "MVC Client",
AllowedGrantTypes = GrantTypes.Implicit, //OIDC中的流程始终是交互式的
//登录后要重定向到哪里
RedirectUris = { "http://localhost:5002/signin-oidc" }, // 注销后重定向到哪里
PostLogoutRedirectUris = { "http://localhost:5002/signout-callback-oidc" }, //与OAuth 2.0类似，OpenID Connect也使用范围概念，与OAuth相比，OIDC中的范围不代表API，而是代表用户ID，名称或电子邮件地址等身份数据。
AllowedScopes = new List<string>
{
//主题id，也是用户唯一ID(最低要求)
IdentityServerConstants.StandardScopes.OpenId,
//个人信息的claims，名称或电子邮件地址等身份数据
IdentityServerConstants.StandardScopes.Profile
}
}
};
}

public static IEnumerable<IdentityResource> GetIdentityResources()
{
return new List<IdentityResource>
{
new IdentityResources.OpenId(),
new IdentityResources.Profile(),
};
}

var builder = services.AddIdentityServer()
.AddInMemoryIdentityResources(Config.GetIdentityResources())
.AddInMemoryApiResources(Config.GetApis())
.AddInMemoryClients(Config.GetClients())
.AddTestUsers(Config.GetUsers());

public void ConfigureServices(IServiceCollection services)
{
services.AddMvc();
//关闭了JWT声明类型映射
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear(); //添加authentication 到服务集合中
services.AddAuthentication(options =>
{
//使用cookie本地登录用户
options.DefaultScheme = "Cookies";
//用户登录时，使用OpenID连接协议。
options.DefaultChallengeScheme = "oidc";
})
//添加对cookie的处理支持
.AddCookie("Cookies")
//oidc处理程序
.AddOpenIdConnect("oidc", options =>
{
//受信任的IdentityServer服务地址
options.Authority = "http://localhost:5000";
options.RequireHttpsMetadata = false;
//客户端标识
options.ClientId = "mvc";
//将IdentityServer中的令牌持久化到cookie中（客户端浏览器中）
options.SaveTokens = true; });
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Home/Error");
} //每个请求都能执行身份验证服务
app.UseAuthentication(); app.UseStaticFiles();
app.UseMvcWithDefaultRoute();
}

//身份验证握手，采用oidc，重定向到IdentityServer进行登录
[Authorize]
public IActionResult Secure()
{
ViewData["Message"] = "Secure page."; return View();
}

@using Microsoft.AspNetCore.Authentication<h2>Claims</h2><dl>
<!-- 显示用户声明-->
@foreach (var claim in User.Claims)
{
<dt>@claim.Type</dt>
<dd>@claim.Value</dd>
}
</dl><h2>Properties</h2><dl>
<!-- 显示身份认中的cookie -->
@foreach (var prop in (await Context.AuthenticateAsync()).Properties.Items)
{
<dt>@prop.Key</dt>
<dd>@prop.Value</dd>
}
</dl>

public IActionResult Logout()
{
return SignOut("Cookies", "oidc");
}