微服务系列之授权认证(二) identity server 4

public class TestConfig
{
/// <summary>
/// Api资源
/// </summary>
/// <returns></returns>
public static IEnumerable<ApiResource> GetApiResources()
{
return new List<ApiResource>
{
new ApiResource(){
Name = "myapi",
ApiSecrets= new List<Secret>(){
new Secret(){
Description = "secret",
Value = "secret".Sha256()
}
},
Scopes = new List<Scope>(){
new Scope(){
Name = "apim"
}
}
},
};
}
/// <summary>
/// client
/// </summary>
/// <returns></returns>
public static IEnumerable<Client> GetClients()
{
return new List<Client>
{
new Client()
{
ClientId="client",//定义客户端ID
//AllowedGrantTypes = new List<string>()
//{
// GrantTypes.ResourceOwnerPassword.FirstOrDefault(),
// GrantType.ClientCredentials,
// GrantType.Hybrid
//},
//必须是单个指定授权类型，可能是内存模式问题。
AllowedGrantTypes = GrantTypes.ClientCredentials,
// 用于认证的密码
ClientSecrets =
{
new Secret("secret".Sha256())
},
AllowedScopes= {"apim"},
AccessTokenLifetime = 360000000
},
};
}
public static List<TestUser> GetTestUsers()
{
return new List<TestUser>
{
new TestUser()
{
SubjectId = "1",
Username = "test",
Password = "123456"
}
};
}
}

public void ConfigureServices(IServiceCollection services)
{
services.AddRazorPages();
#region 内存方式
services.AddIdentityServer()
.AddDeveloperSigningCredential()//添加证书加密方式，执行该方法，会先判断tempkey.rsa证书文件是否存在，如果不存在的话，就创建一个新的tempkey.rsa证书文件，如果存在的话，就使用此证书文件。
.AddInMemoryApiResources(TestConfig.GetApiResources())//把受保护的Api资源添加到内存中
.AddInMemoryClients(TestConfig.GetClients())//客户端配置添加到内存中
.AddTestUsers(TestConfig.GetTestUsers())//测试的用户添加进来
.AddDeveloperSigningCredential();
#endregion
}<br><br>

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Error");
}
app.UseStaticFiles();
app.UseRouting();<br>　　　　　　　　//添加中间件
　　　　　　//这个必须在UseRouting和UseEndpoints中间。如果IdentityServer服务端和API端要写在一起，
//那么这个必须在UseAuthorization和UseAuthentication的上面。
app.UseIdentityServer();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapRazorPages();
});
}

public class Startup
{
// This method gets called by the runtime. Use this method to add services to the container.
// For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
readonly string MyAllowSpecificOrigins = "_myAllowSpecificOrigins";
public void ConfigureServices(IServiceCollection services)
{
//配置认证
services.AddAuthentication("Bearer")
.AddJwtBearer(options =>
{
options.Authority = "http://localhost:5000";//刚才启动的授权认证服务
options.RequireHttpsMetadata = false;
options.TokenValidationParameters = new TokenValidationParameters //不验证jwt的aud信息
{
ValidateAudience = false
};
});
// 配置授权策略
services.AddAuthorization(options =>
{
//定义授权策略，这个名字可以随便起
options.AddPolicy("ApiScope", policy =>
{
policy.RequireAuthenticatedUser();
//
policy.RequireClaim("scope", "apim");//策略需要scope有apim
});
options.AddPolicy("ApiScope2", policy =>
{
policy.RequireAuthenticatedUser();
//
policy.RequireClaim("scope", "apim2");
});
});
services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();
services
.AddCors(options =>
{
options.AddPolicy(MyAllowSpecificOrigins,
builder => builder.AllowAnyOrigin()
.WithMethods("GET", "POST", "HEAD", "PUT", "DELETE", "OPTIONS")
);
}).AddMvc();
services.AddControllers();
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
app.Use((context, next) =>
{
context.Request.EnableBuffering();
return next();
});
app.UseRouting();
//跨域设置
app.UseCors(MyAllowSpecificOrigins);
//身份验证中间件 （身份验证必须在授权的前面）
app.UseAuthentication();
//授权验证中间件
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllers();
});
app.UseEndpoints(endpoints =>
{
endpoints.MapGet("/", async context =>
{
await context.Response.WriteAsync("Hello World!");
});
});
}
}

services.AddIdentityServer()
                    .AddConfigurationStore(options =>  //注入idenity相关资源上下文
                    {
                        options.ResolveDbContextOptions = (provider, builder) =>
                        {
                            builder.UseSqlServer(Configuration.GetSection("Database:ConnectString").Value,
                                sql => sql.MigrationsAssembly(migrationsAssembly));
                        };
                    })
                    .AddOperationalStore(options =>  //注入Token管理上下文
                    {
                        options.ConfigureDbContext = builder =>
                            builder.UseSqlServer(Configuration.GetSection("Database:ConnectString").Value,
                                sql => sql.MigrationsAssembly(migrationsAssembly));
                        options.EnableTokenCleanup = true;
                        options.TokenCleanupInterval = 3600;
                    })
                   .AddDeveloperSigningCredential();

private ConfigurationDbContext _dbContext;
        private PersistedGrantDbContext _grantdbContext; //这个就是identity资源上下文
        private IOptions<IdentityOption> _identityOption; //这个就是token上下文
        private IMediator _mediator;
        public ClientManager(ConfigurationDbContext dbContext, IOptions<IdentityOption> identityOption, PersistedGrantDbContext grantdbContext, IMediator mediator)
        {
            _dbContext = dbContext;
            _identityOption = identityOption;
            _grantdbContext = grantdbContext;
            _mediator = mediator;
        }