在 OpenIdDict 中使用客户端凭据时，指定的令牌无效答案

【问题标题】：The specified token is invalid is Invalid when using Client Credentials in OpenIdDict在 OpenIdDict 中使用客户端凭据时，指定的令牌无效
【发布时间】：2023-03-09 03:39:01
【问题描述】：

使用 Asp.Net Core 5 和 OpenIdDict 我有授权代码和客户端凭据的配置：

services.AddOpenIddict()
  
  .AddCore(x => {
    x.UseEntityFrameworkCore().UseDbContext<Context>().ReplaceDefaultEntities<Application, Authorization, Scope, Token, Int32>();
  })

  .AddServer(x => {

    x.SetAuthorizationEndpointUris("/connect/authorize")
     .SetLogoutEndpointUris("/connect/logout")
     .SetTokenEndpointUris("/connect/token")
     .SetUserinfoEndpointUris("/connect/userinfo")
     .SetIntrospectionEndpointUris("/.well-known/openid-configuration");

    x.RegisterScopes(OpenIddictConstants.Scopes.Profile, OpenIddictConstants.Scopes.Email, OpenIddictConstants.Scopes.OfflineAccess);

    x.AllowAuthorizationCodeFlow()
     .AllowRefreshTokenFlow()
     .AllowClientCredentialsFlow();

    x.AddDevelopmentEncryptionCertificate().AddDevelopmentSigningCertificate();

    x.UseAspNetCore()
     .EnableAuthorizationEndpointPassthrough()
     .EnableLogoutEndpointPassthrough()
     .EnableTokenEndpointPassthrough()
     .EnableUserinfoEndpointPassthrough()
     .EnableStatusCodePagesIntegration();
    })

  .AddValidation(x => {
    x.UseLocalServer();
    x.UseAspNetCore();
  });

在我拥有的 API 上：

 services.AddOpenIddict()
  .AddValidation(x => {
    x.SetIssuer("https://localhost:5000");
      x.AddAudiences("api");
      x.UseIntrospection().SetClientId("api").SetClientSecret("SecretAPI");
      x.UseSystemNetHttp();
      x.UseAspNetCore();
    });

然后我有客户端和 API 应用程序：

  OpenIddictApplicationDescriptor mvc = new OpenIddictApplicationDescriptor {
    ClientId = "mvc",
    ClientSecret = "SecretMVC",
    ConsentType = OpenIddictConstants.ConsentTypes.Explicit,
      Permissions = {
        OpenIddictConstants.Permissions.Endpoints.Token,
        OpenIddictConstants.Permissions.GrantTypes.ClientCredentials,
        OpenIddictConstants.Permissions.Prefixes.Scope + "api"
      }
    };

      
  OpenIddictApplicationDescriptor api = new OpenIddictApplicationDescriptor {
    ClientId = "api",
    ClientSecret = "SecretAPI",
    Permissions = {
      OpenIddictConstants.Permissions.Endpoints.Introspection
    }
  };

我能够使用 Insomnia Rest Client 和 Client Credentials 获取访问令牌。

但是当我使用给定的访问令牌调用 API 时，我收到以下错误：

Bearer error = "invalid_token", error_description = "The specified token is invalid."

为什么会这样？

更新

在日志上我有以下内容：

[12:09:52 Debug] OpenIddict.Validation.OpenIddictValidationDispatcher
The event OpenIddict.Validation.OpenIddictValidationEvents+HandleIntrospectionResponseContext was marked as rejected by OpenIddict.Validation.OpenIddictValidationHandlers+HandleErrorResponse`1[[OpenIddict.Validation.OpenIddictValidationEvents+HandleIntrospectionResponseContext, OpenIddict.Validation, Version=3.0.0.0, Culture=neutral, PublicKeyToken=35a561290d20de2f]].

[12:09:52 Debug] OpenIddict.Validation.OpenIddictValidationDispatcher
An error occurred while introspecting the token.
OpenIddict.Abstractions.OpenIddictExceptions+GenericException: An error occurred while handling the introspection response.
  Error: invalid_request
  Error description: The specified HTTP method is not valid.
  Error URI:
   at OpenIddict.Validation.OpenIddictValidationService.<>c__DisplayClass5_0.<<IntrospectTokenAsync>g__HandleIntrospectionResponseAsync|3>d.MoveNext()
--- End of stack trace from previous location ---
   at OpenIddict.Validation.OpenIddictValidationService.IntrospectTokenAsync(Uri address, String token, String type, CancellationToken cancellationToken)
   at OpenIddict.Validation.OpenIddictValidationService.IntrospectTokenAsync(Uri address, String token, String type, CancellationToken cancellationToken)
   at OpenIddict.Validation.OpenIddictValidationHandlers.IntrospectToken.HandleAsync(ProcessAuthenticationContext context)

[12:09:52 Debug] OpenIddict.Validation.OpenIddictValidationDispatcher
The event OpenIddict.Validation.OpenIddictValidationEvents+ProcessAuthenticationContext was successfully processed by OpenIddict.Validation.OpenIddictValidationHandlers+IntrospectToken.

【问题讨论】：

我相信您会在日志中找到此问题的根本原因。
我在使用 Serilog 时错过了日志中的错误，只是发现记录器配置不正确。所以现在我发现了以下内容：“自省令牌时发生错误 - 指定的 HTTP 方法无效”。你知道这个bug的由来吗？我刚刚用更多日志信息更新了我的问题。谢谢

标签： asp.net-core openiddict asp.net-core-5.0

【解决方案1】：

您将自省端点配置为与 OIDC 提供者配置端点共享相同的地址，从而防止自省请求被识别为有效的 POST 请求。

修复 SetIntrospectionEndpointUris("/.well-known/openid-configuration") 以使用不同的地址，它应该可以工作。

【讨论】：