IdentityServer4系列(06)【使用reference token】

JWT token信息自包含，无法直接进行生命周期控制。Reference Token也是一种身份标识，在认证服务器有一个Token IntroSpection Endpoint,可以直接控制token的生命周期，缺点是与认证服务器通信很频繁，优点是安全性高。
在验证服务器的ApiResource方面需要配置API的密码。

        public static IEnumerable<ApiResource> GetApis()
        {
            return new ApiResource[]
            {
                new ApiResource("api1", "My API #1", new List<string>{ "location"}){
                    ApiSecrets = { new Secret("api1_secret".Sha256())} //此处为Reference Token设置
                } //把claim带到API资源中去
            };
        }

验证服务器的Client有一个属性需要设置:AccessTokenType = AccessTokenType.Reference

                new Client
                {
                    ClientId = "hybrid client",
                    ClientName = "ASP.NET Core Hybrid client",
                    ClientSecrets= { new Secret("hybrid_secret".Sha256())},
                    AllowedGrantTypes=GrantTypes.Hybrid,
                    AccessTokenType = AccessTokenType.Reference, //改变默认的JWT授权方式，此处为Reference Token设置
                    RedirectUris =
                    {
                        "http://localhost:7000/signin-oidc"
                    },
                    PostLogoutRedirectUris =
                    {
                        "http://localhost:7000/signout-callback-oidc"
                    },
                    AllowOfflineAccess = true,
                    AlwaysIncludeUserClaimsInIdToken=true,
                    AllowedScopes =
                    {
                        "api1",
                        IdentityServerConstants.StandardScopes.OpenId,
                        IdentityServerConstants.StandardScopes.Profile,
                        IdentityServerConstants.StandardScopes.Address,
                        IdentityServerConstants.StandardScopes.Email,
                        IdentityServerConstants.StandardScopes.Phone,
                        "roles",
                        "locations"
                    }
                }

API所在的Web需要安装组件IdentityServer4.AccessTokenValidation，然后在Startup.cs中配置如下：

services.AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
                .AddIdentityServerAuthentication(options => {
                    options.Authority = "http://localhost:5000";
                    options.ApiName = "api1";
                    options.RequireHttpsMetadata = false;
                    options.ApiSecret = "api1_secret";
                });

撤销token

在web端程序中：

        public async Task Logout()
        {
            #region reference token
            var client = new HttpClient();
            var disco = await client.GetDiscoveryDocumentAsync("http://localhost:5000/");
            if(disco.IsError)
            {
                throw new Exception(disco.Error);
            }
            //吊销access token
            var accessToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.AccessToken);
            if(!string.IsNullOrWhiteSpace(accessToken))
            {
                
                var revokeAccessTokenResposne = await client.RevokeTokenAsync(new TokenRevocationRequest {
                    Token = accessToken,
                    Address = disco.RevocationEndpoint,
                    ClientId = "hybrid client",
                    ClientSecret = "hybrid_secret"
                });
                if(revokeAccessTokenResposne.IsError)
                {
                    throw new Exception("Access Token Revocation Failed:" + revokeAccessTokenResposne.Error);
                }
            }
            //吊销reference token
            var refreshToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.RefreshToken);
            if(!string.IsNullOrWhiteSpace(refreshToken))
            {
                var revokeRefreshTokenResponse = await client.RevokeTokenAsync(new TokenRevocationRequest
                {
                    Token = refreshToken,
                    Address = disco.RevocationEndpoint,
                    ClientId= "hybrid client",
                    ClientSecret= "hybrid_secret"
                });
                if(revokeRefreshTokenResponse.IsError)
                {
                    throw new Exception("Refresh Token Revocation Failed:" + revokeRefreshTokenResponse.Error);
                }
            }
            #endregion
            //await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
            //await HttpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme);
        }