在 Identity Server 4.0.3 中，如何正确授予给定客户端对 ApiResource 的访问权限？

Question

以前我们可以定义以下配置，它会起作用：

public static IEnumerable<ApiScope> GetApiScopes() =>
    new List<ApiScope>
    {
        new ApiScope(
            name: "Scope1",
            displayName: "scope1 description",
            userClaims: new[] { "claim1" }),
        new ApiScope(
            name: "Scope2",
            displayName: "scope2 description",
            userClaims: new[] { "claim2", "claim3", "claim4"}),
        new ApiScope(
            name: "Scope3",
            displayName: "scope3 description",
            userClaims: new[] { "claim5" }),
        new ApiScope(
            name: "Scope4",
            displayName: "scope4 description",
            userClaims: new[] { "claim6" })
    };
    
public static IEnumerable<ApiResource> GetApiResources() =>
    new List<ApiResource>
    {
        new ApiResource("MyApi", "MyApi description")
        {
            ApiSecrets = { new Secret("secret").Sha256() },
            Scopes =
            {
                "Scope1",
                "Scope2",
                "Scope3",
                "Scope4"
            }
        }
    };
    
public static IEnumerable<Client> GetClients() =>
    new List<Client>
    {
        new Client
        {
            Enabled = true,
            ClientId = "client",
            ClientSecrets = "secret"
            AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
            AllowOfflineAccess = true,
            AccessTokenType = AccessTokenType.Reference,
            RequireConsent = false,
            RequirePkce = false,
            UpdateAccessTokenClaimsOnRefresh = true,
            RefreshTokenExpiration = TokenExpiration.Absolute,
            AbsoluteRefreshTokenLifetime = 123456,
            RefreshTokenUsage = TokenUsage.ReUse,
            AccessTokenLifetime = 600000,
            AllowedScopes = { "MyApi" }, // This previously worked, now it doesn't
        }
    };

但是由于各种变化，有点解释here，你不能再做上面的事情了，因为"MyApi"写在Client.AllowedScopes不是一个范围——也就是说你不能像你一样请求访问资源之前通过提供他们的名字来完成

相反，要使上述内容在 Identity Server 4.0.3 中正常工作，您必须执行以下 hack，我认为这是非常错误的，因此问题如下：

public static IEnumerable<ApiScope> GetApiScopes() =>
    new List<ApiScope>
    {
        new ApiScope(
            name: "Scope1",
            displayName: "scope1 description",
            userClaims: new[] { "claim1" }),
        new ApiScope(
            name: "Scope2",
            displayName: "scope2 description",
            userClaims: new[] { "claim2", "claim3", "claim4"}),
        new ApiScope(
            name: "Scope3",
            displayName: "scope3 description",
            userClaims: new[] { "claim5" }),
        new ApiScope(
            name: "Scope4",
            displayName: "scope4 description",
            userClaims: new[] { "claim6" }),
        // Wrapper
        new ApiScope(
            name: "MyApi",
            displayName: "",
            // Manually add all claims from above scopes. 
                        // If you end up in the future changing one of the above scopes's required claims,
                        // well, make sure you do the same here...
            userClaims: new[] { "claim1", "claim2", "claim3", "claim4", "claim5", "claim6"})        
    };
    
public static IEnumerable<ApiResource> GetApiResources() =>
    new List<ApiResource>
    {
        new ApiResource("MyApi", "MyApi description")
        {
            ApiSecrets = { new Secret("secret").Sha256() },
            Scopes =
            {
                "MyApi"
            }
        }
    };
    
public static IEnumerable<Client> GetClients() =>
    new List<Client>
    {
        new Client
        {
            Enabled = true,
            ClientId = "client",
            ClientSecrets = "secret"
            AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
            AllowOfflineAccess = true,
            AccessTokenType = AccessTokenType.Reference,
            RequireConsent = false,
            RequirePkce = false,
            UpdateAccessTokenClaimsOnRefresh = true,
            RefreshTokenExpiration = TokenExpiration.Absolute,
            AbsoluteRefreshTokenLifetime = 123456,
            RefreshTokenUsage = TokenUsage.ReUse,
            AccessTokenLifetime = 600000,
                        // now works because we have a fake "MyApi" scope,
                        // encapsulating our previously well-defined structure of scopes
            AllowedScopes = { "MyApi" }, 
        }
    };

将整个ApiResource 的作用域包装到一个作用域中并定义所述作用域中存在的所有声明是零意义的。

有人能说明一下吗 - 实现我们在过去版本的 Identity Server4 中实现的目标的正确方法是什么？

编辑：基本上我想问的是 - 您如何要求为特定资源授予一组特定范围？ （如果它们中的任何一个都不存在于令牌中 - 使其无效）

Answer 1

之前这样做的原因是因为在以前的版本中，资源定义自动包含了同名的范围。

请注意，这里的 MyApi 是作用域名称，等于资源名称。

AllowedScopes = { "MyApi" }

但是令牌中包含资源名称作为受众，这很令人困惑。因此，如果客户端至少有一个范围是资源的一部分，则它可以访问该资源。在资源内，应验证范围以确保客户端有权使用资源的特定部分，例如：

services
    .AddAuthorization(options =>
    {
        options.AddPolicy("Scope1", p => p.RequireClaim("scope", "Scope1"));

在您的情况下，客户端似乎可以访问整个资源，而不管指定的范围。

所以你应该做的是，验证资源中的范围并在客户端定义中命名允许的范围：

AllowedScopes = { "Scope1", "Scope2", "Scope3", "Scope4" }

如果允许所有范围，则省略该行。这将自动包含所有允许的范围。

---

根据 cmets 更新。

您可以通过以下方式验证在 api 中接收不记名令牌的范围：

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddIdentityServerAuthentication(options =>
    {
        options.JwtBearerEvents = new JwtBearerEvents
        {
            OnTokenValidated = async context =>
            {
                // To verify if required scopes are included:
                var requiredScopes = new List<string> { "scope1" , "scope2", "scope3", "scope4" };
                var foundScopes = context.Principal.Claims.Count(c => c.Type == "scope" && allowedScopes.Contains(c.Value));

                if (foundScopes != requiredScopes.Count)
                {
                    context.Fail("Invalid number of scopes");
                }
            }
        };
    });