.net core IdentityServer4 使用客户端凭据保护API
1.准备IdentityServer4.Templates模板
1.1 CMD模式下运行
dotnet new -i IdentityServer4.Templates
1.2 选择文件运行
dotnet new is4empty -n IdentityServer
1.3 加入Visual Studio 支持
cd ..
dotnet new sln -n Quickstart
1.4 加入对应的IdentityServer
dotnet sln add .\IdentityServer\IdentityServer.csproj
2.修改IdentityServer4项目文件
2.1 首先修改Config.cs文件
public static class Config
{
public static IEnumerable<IdentityResource> IdentityResources =>
new IdentityResource[]
{
new IdentityResources.OpenId()
};
//定义如下API
public static IEnumerable<ApiScope> ApiScopes =>
new List<ApiScope>
{
new ApiScope("api1", "My API")
};
//定义客户端账户client 密码secret 运行接口范围api1
public static IEnumerable<Client> Clients =>
new List<Client>
{
new Client
{
ClientId = "client",
// no interactive user, use the clientid/secret for authentication
AllowedGrantTypes = GrantTypes.ClientCredentials,
// secret for authentication
ClientSecrets =
{
new Secret("secret".Sha256())
},
// scopes that client has access to
AllowedScopes = { "api1" }
}
};
}
2.2 项目端口修改为https://localhost:5001 修改项目下面的Properties文件夹下的launchSettings.json文件
{
"profiles": {
"SelfHost": {
"commandName": "Project",
"launchBrowser": true,
"environmentVariables": {
"ASPNETCORE_ENVIRONMENT": "Development"
},
"applicationUrl": "https://localhost:5001"
}
}
}
2.3 接着运行项目输入https://localhost:5001/.well-known/openid-configuration浏览器可看到下面界面
3.加入API项目并加入到sln中
3.1 创建API项目
dotnet new web -n Api
3.2 修改应用运行端口为6001修改项目下面的Properties文件夹下的launchSettings.json文件
"applicationUrl": "https://localhost:6001;http://localhost:6000"
3.3 创建一个接口
[Route("identity")]
[Authorize]
public class IdentityController : ControllerBase
{
[HttpGet]
public IActionResult Get()
{
return new JsonResult(from c in User.Claims select new { c.Type, c.Value });
}
}
3.4 修改Startup文件
services.AddAuthentication("Bearer1")
.AddJwtBearer("Bearer1", options =>
{
//该地址为认证的地址
options.Authority = "https://localhost:5001";
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateAudience = false
};
});
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
3.5 访问https://localhost:6001/identity
访问这个会发现无法访问
访问内置接口
4. 加入Client项目
4.1. 加入Client项目并加入到sln中
dotnet new console -n Client
4.2 安装外部包
dotnet add package IdentityModel
4.3 主函数中进行接口访问
var client = new HttpClient();
//访问认证接口获取token
var disco = await client.GetDiscoveryDocumentAsync("https://localhost:5001");
if (disco.IsError)
{
Console.WriteLine(disco.Error);
return;
}
var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
{
Address = disco.TokenEndpoint,
ClientId = "client",
ClientSecret = "secret",
Scope = "api1"
});
if (tokenResponse.IsError)
{
Console.WriteLine(tokenResponse.Error);
return;
}
//输出对应的token
Console.WriteLine(tokenResponse.Json);
var apiClient = new HttpClient();
//赋值token
apiClient.SetBearerToken(tokenResponse.AccessToken);
//调用接口
var response = await apiClient.GetAsync("https://localhost:6001/identity");
if (!response.IsSuccessStatusCode)
{
Console.WriteLine(response.StatusCode);
Console.ReadKey();
}
else
{
var content = await response.Content.ReadAsStringAsync();
Console.WriteLine(JArray.Parse(content));
Console.ReadKey();
}
4.4 如下结果