哈希密码身份服务器 4 时的 invalid_grant

Question

我有这样的配置

public class Config
    {
        public static IEnumerable<Client> GetClients(string[] originUris, string[] redirectUris, int tokenLifetime, int slientRefreshToken)
        {
            return new List<Client>
            {
                new Client
                {
                    ClientId = "eFMS",
                    ClientName = "eFMS Services",
                    AccessTokenLifetime =  tokenLifetime,
                    AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
                    RequireClientSecret = false,
                    RequireConsent = false,
                    AlwaysSendClientClaims = true,
                    AllowAccessTokensViaBrowser = true,
                    AccessTokenType = AccessTokenType.Jwt,
                    AllowOfflineAccess = true,
                    UpdateAccessTokenClaimsOnRefresh = true,
                    RefreshTokenExpiration = TokenExpiration.Sliding,
                    SlidingRefreshTokenLifetime = slientRefreshToken,
                    RedirectUris = redirectUris,
                    AllowedCorsOrigins= originUris,
                    AlwaysIncludeUserClaimsInIdToken = true,
                    AllowedScopes =
                    {
                        "openid", "profile", "offline_access", "efms_scope"
                    },
                }
            };
        }
        public static IEnumerable<ApiResource> GetApiResources()
        {
            return new List<ApiResource>
            {
                new ApiResource("efms_api", "eFMS D&T API")
                {
                    ApiSecrets = { new Secret("secret".Sha256()) }
                }
            };
        }
        public static IEnumerable<IdentityResource> GetIdentityResources()
        {
            return new List<IdentityResource>
            {
                new IdentityResources.OpenId(),
                new IdentityResources.Profile() { Required = true },
                new IdentityResource()
                {
                    Name = "efms_scope",
                    Description = "eFMS D&T API",
                    DisplayName = "eFMS D&T API",
                    UserClaims =
                    {
                        "userId","workplaceId","userName","email"
                    }
                }
            };
        }
    }

当我在邮递员中使用用户名：admin 进行测试时，通过：123456 返回令牌 enter image description here

但是如果我对密码进行哈希处理，结果是“invalid_grant”，并且当我调试代码时，不会执行 Task ValidateAsync(ResourceOwnerPasswordValidationContext context) 函数。请帮我解决这个问题

Answer 1

如果您正在配置 IdentityServer 的 AddTestUser，则在 IdentityServer4.Test.TestUserResourceOwnerPasswordValidator 中实现 ResourceOwnerPassword 授予密码验证，并在 TestUserStore.ValidateCredentials 中以纯文本（无哈希）比较密码：

    public bool ValidateCredentials(string username, string password)
    {
        var user = FindByUsername(username);
        if (user != null)
        {
            return user.Password.Equals(password);
        }

        return false;
    }

关于调试IdentityServer4.Test.TestUserResourceOwnerPasswordValidator.ValidateAsync(...)你是否取消选中“启用我的代码”：

如果您使用自己的IdentityServer4.Validation.IResourceOwnerPasswordValidator 实现，那么是否需要对密码进行哈希处理取决于您。