Identity Server 4 授权码流示例

Question

我正在尝试使用授权码流（Authorization Code Flow）实现Identity Server 4和AspNet Core的集成。

问题是，IdentityServer4在Github上的存储库有几个示例，但没有一个是使用授权码流的。

是否有人有一个示例，演示如何使用Identity Server 4和MVC客户端来实现授权码流？

- Rafael Miceli

Answer 1

这是一个使用Identity Server 4和MVC客户端来实现授权代码流的示例。

IdentityServer4可以使用client.cs文件来注册我们的MVC客户端，包括ClientId、ClientSecret、允许的授权类型（在此情况下为Authorization Code）和客户端的RedirectUri。

public class Clients
{
    public static IEnumerable<Client> Get()
    {
        var secret = new Secret { Value = "mysecret".Sha512() };

        return new List<Client> {
            new Client {
                ClientId = "authorizationCodeClient2",
                ClientName = "Authorization Code Client",
                ClientSecrets = new List<Secret> { secret },
                Enabled = true,
                AllowedGrantTypes = new List<string> { "authorization_code" }, //DELTA //IdentityServer3 wanted Flow = Flows.AuthorizationCode,
                RequireConsent = true,
                AllowRememberConsent = false,
                RedirectUris =
                  new List<string> {
                       "http://localhost:5436/account/oAuth2"
                  },
                PostLogoutRedirectUris =
                  new List<string> {"http://localhost:5436"},
                AllowedScopes = new List<string> {
                    "api"
                },
                AccessTokenType = AccessTokenType.Jwt
            }
        };
    }
}

这个类被引用在IdentityServer4项目中的Startup.cs文件的ConfigurationServices方法中：

    public void ConfigureServices(IServiceCollection services)
    {
        ////Grab key for signing JWT signature
        ////In prod, we'd get this from the certificate store or similar
        var certPath = Path.Combine(PlatformServices.Default.Application.ApplicationBasePath, "SscSign.pfx");
        var cert = new X509Certificate2(certPath);

        // configure identity server with in-memory stores, keys, clients and scopes
        services.AddDeveloperIdentityServer(options =>
            {
                options.IssuerUri = "SomeSecureCompany";
            })
            .AddInMemoryScopes(Scopes.Get())
            .AddInMemoryClients(Clients.Get())
            .AddInMemoryUsers(Users.Get())
            .SetSigningCredential(cert);

        services.AddMvc();
    }

以下是上述提到的Users和Scopes类的参考:

public static class Users
{
    public static List<InMemoryUser> Get()
    {
        return new List<InMemoryUser> {
            new InMemoryUser {
                Subject = "1",
                Username = "user",
                Password = "pass123",
                Claims = new List<Claim> {
                    new Claim(ClaimTypes.GivenName, "GivenName"),
                    new Claim(ClaimTypes.Surname, "surname"), //DELTA //.FamilyName in IdentityServer3
                    new Claim(ClaimTypes.Email, "[e-mail]"),
                    new Claim(ClaimTypes.Role, "Badmin")
                }
            }
        };
    }
}

public class Scopes
{
    // scopes define the resources in your system
    public static IEnumerable<Scope> Get()
    {
        return new List<Scope> {
            new Scope
            {
                Name = "api",
                DisplayName = "api scope",
                Type = ScopeType.Resource,
                Emphasize = false,
            }
        };
    }
}

MVC 应用程序需要两个控制器方法。第一个方法启动服务提供商（SP-启动）工作流程。它创建一个状态值，将其保存在基于 cookie 的身份验证中间件中，然后将浏览器重定向到标识提供者（IdP） - 在本例中是我们的 IdentityServer4 项目。

public ActionResult SignIn()
{
    var state = Guid.NewGuid().ToString("N");

    //Store state using cookie-based authentication middleware
    this.SaveState(state);

    //Redirect to IdP to get an Authorization Code
    var url = idPServerAuthUri +
        "?client_id=" + clientId +
        "&response_type=" + response_type +
        "&redirect_uri=" + redirectUri +
        "&scope=" + scope +
        "&state=" + state;

    return this.Redirect(url); //performs a GET
}

以下是前面使用的常量和SaveState方法作为参考：

//Client and workflow values
private const string clientBaseUri = @"http://localhost:5436";
private const string validIssuer = "SomeSecureCompany";
private const string response_type = "code";
private const string grantType = "authorization_code";

//IdentityServer4
private const string idPServerBaseUri = @"http://localhost:5000";
private const string idPServerAuthUri = idPServerBaseUri + @"/connect/authorize";
private const string idPServerTokenUriFragment = @"connect/token";
private const string idPServerEndSessionUri = idPServerBaseUri + @"/connect/endsession";

//These are also registered in the IdP (or Clients.cs of test IdP)
private const string redirectUri = clientBaseUri + @"/account/oAuth2";
private const string clientId = "authorizationCodeClient2";
private const string clientSecret = "mysecret";
private const string audience = "SomeSecureCompany/resources";
private const string scope = "api";


//Store values using cookie-based authentication middleware
private void SaveState(string state)
{
    var tempId = new ClaimsIdentity("TempCookie");
    tempId.AddClaim(new Claim("state", state));

    this.Request.GetOwinContext().Authentication.SignIn(tempId);
}

第二个MVC操作方法是在用户输入凭据并勾选任何授权框后由IdenityServer4调用的。该操作方法：

• 从查询字符串中获取Authorization Code和State
• 验证状态
• 向IdentityServer4回POST，以交换Authorization Code获取访问令牌

这是方法：

[HttpGet]
public async Task<ActionResult> oAuth2()
{
    var authorizationCode = this.Request.QueryString["code"];
    var state = this.Request.QueryString["state"];

    //Defend against CSRF attacks http://www.twobotechnologies.com/blog/2014/02/importance-of-state-in-oauth2.html
    await ValidateStateAsync(state);

    //Exchange Authorization Code for an Access Token by POSTing to the IdP's token endpoint
    string json = null;
    using (var client = new HttpClient())
    {
        client.BaseAddress = new Uri(idPServerBaseUri);
        var content = new FormUrlEncodedContent(new[]
        {
                new KeyValuePair<string, string>("grant_type", grantType)
            ,new KeyValuePair<string, string>("code", authorizationCode)
            ,new KeyValuePair<string, string>("redirect_uri", redirectUri)
            ,new KeyValuePair<string, string>("client_id", clientId)              //consider sending via basic authentication header
            ,new KeyValuePair<string, string>("client_secret", clientSecret)
        });
        var httpResponseMessage = client.PostAsync(idPServerTokenUriFragment, content).Result;
        json = httpResponseMessage.Content.ReadAsStringAsync().Result;
    }

    //Extract the Access Token
    dynamic results = JsonConvert.DeserializeObject<dynamic>(json);
    string accessToken = results.access_token;

    //Validate token crypto
    var claims = ValidateToken(accessToken);

    //What is done here depends on your use-case. 
    //If the accessToken is for calling a WebAPI, the next few lines wouldn't be needed. 

    //Build claims identity principle
    var id = new ClaimsIdentity(claims, "Cookie");              //"Cookie" matches middleware named in Startup.cs

    //Sign into the middleware so we can navigate around secured parts of this site (e.g. [Authorized] attribute)
    this.Request.GetOwinContext().Authentication.SignIn(id);

    return this.Redirect("/Home"); 
}

检查接收到的状态是否符合您的预期有助于防御CSRF攻击：http://www.twobotechnologies.com/blog/2014/02/importance-of-state-in-oauth2.html

此ValidateStateAsync方法将接收到的状态与保存在cookie中间件中的内容进行比较：

private async Task<AuthenticateResult> ValidateStateAsync(string state)
{
    //Retrieve state value from TempCookie
    var authenticateResult = await this.Request
        .GetOwinContext()
        .Authentication
        .AuthenticateAsync("TempCookie");

    if (authenticateResult == null)
        throw new InvalidOperationException("No temp cookie");

    if (state != authenticateResult.Identity.FindFirst("state").Value)
        throw new InvalidOperationException("invalid state");

    return authenticateResult;
}

这个ValidateToken方法使用微软的System.IdentityModel和System.IdentityModel.Tokens.Jwt库来检查JWT是否被正确签名。

private IEnumerable<Claim> ValidateToken(string token)
{
    //Grab certificate for verifying JWT signature
    //IdentityServer4 also has a default certificate you can might reference.
    //In prod, we'd get this from the certificate store or similar
    var certPath = Path.Combine(Server.MapPath("~/bin"), "SscSign.pfx");
    var cert = new X509Certificate2(certPath);
    var x509SecurityKey = new X509SecurityKey(cert);

    var parameters = new TokenValidationParameters
    {
        RequireSignedTokens = true,
        ValidAudience = audience,
        ValidIssuer = validIssuer,
        IssuerSigningKey = x509SecurityKey,
        RequireExpirationTime = true,
        ClockSkew = TimeSpan.FromMinutes(5)
    };

    //Validate the token and retrieve ClaimsPrinciple
    var handler = new JwtSecurityTokenHandler();
    SecurityToken jwt;
    var id = handler.ValidateToken(token, parameters, out jwt);

    //Discard temp cookie and cookie-based middleware authentication objects (we just needed it for storing State)
    this.Request.GetOwinContext().Authentication.SignOut("TempCookie");

    return id.Claims;
}

一个包含这些源文件的可行解决方案可以在GitHub上找到，链接为：https://github.com/bayardw/IdentityServer4.Authorization.Code

- bayardw

---

我遇到的一个大问题是，所有的教程/答案似乎都使用了一些较旧的IdentityServer版本。我知道这是一个直接针对版本4的问题；但即使在它们的文档页面上也存在差异。例如，它们不再有“AddInMemoryScopes”、“AddInMemoryUsers”，也没有标准的“User”类。 http://docs.identityserver.io/en/release/configuration/startup.html - Adrian

这个仓库有点过时了。能否将其更新以与.NET Core 2.0和Identity Server 4的最新版本兼容？ - Frostless

Answer 2

这是一个示例 - 它使用混合流而不是代码流。但是，如果您的客户端库支持它（aspnetcore中间件也支持），则更推荐使用混合流。 https://github.com/IdentityServer/IdentityServer4/tree/master/samples/Quickstarts/5_HybridFlowAuthenticationWithApiAccess

- leastprivilege

---

你的链接已损坏。因此，你应该将所有重要部分放在回答中。 - Baum mit Augen

你能解释一下为什么混合流程更受推荐，或者至少提供一些相关的证明吗？ - Rikki

因为它通过在id_token中包含代码的哈希值来防止代码剪切粘贴攻击。 - leastprivilege

链接已经失效。 - kovac

更新后的链接失效了。 - EM0