如何在 ASP.NET Core 2 中使用 jwt 进行授权

Question

我在控制器中使用[Authorize] 属性进行身份验证，但是当我收到对TestMethod 的请求时，我收到错误：“500 Internal..”。

我做错了什么？？

我的代码来自StartUp.cs

services.AddAuthorization(options =>
{
    options.DefaultPolicy =
        new AuthorizationPolicyBuilder("Identity.Application")
        .RequireAuthenticatedUser()
        .Build();
});

services
    .AddAuthentication(option =>
    {
        option.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    })
    .AddJwtBearer(options =>
    {
        options.RequireHttpsMetadata = false;
        options.TokenValidationParameters =
            new Microsoft.IdentityModel.Tokens.TokenValidationParameters
            {
                SaveSigninToken = true,
                ValidateIssuer = true,
                ValidIssuer = "http://blabla/",
                ValidateAudience = true,
                ValidAudience = "http://blabla/",
                ValidateLifetime = true,
                IssuerSigningKey = blabla.bla(),
                ValidateIssuerSigningKey = true,
            };
    });

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme);
services.AddMvc();

还有来自控制器的代码

[Route("test"), HttpPost]
[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
public void Test() { }

你有想法吗？

我正在使用这些库来生成令牌：

System.IdentityModel.Tokens.Jwt;
Microsoft.IdentityModel.Tokens;

Answer 1

如果要使用 [Authorize] 属性需要制定策略：

     //new policy makes [Authorize] availible by claims

  services.AddAuthorization((options) => {
                options.AddPolicy("MyNewPolicy", policybuilder =>
                {               
                    policybuilder.RequireAuthenticatedUser();
                    policybuilder.RequireClaim("role", "someClaim");

                });
            });

//usage

        [Authorize(Roles = "someClaim")]
        public async Task<IActionResult> About(){


}

//to awnsr your comment add a list of claims to your user class ex:

   new TestUser
                {
                    SubjectId="1001",
                    Username="Frank",
                    Password="password",

                    Claims= new List<Claim>
                    {
                        new Claim("given_name","Frank"),
                        new Claim("family_name","Underwood"),
                        new Claim("address","1 addy rd unit 233"),                
                        new Claim("role", "someClaim")


                    }

                }

Answer 2

我在试用AddJwtBearer 时遇到了很多问题。最后我发现手动登录并没有那么难，工作起来很容易，也更容易调试。

基本上，我首先创建了一个帮助类来创建和验证令牌。这是该类的源代码：https://github.com/neville-nazerane/netcore-jwt-sample/blob/master/website/TokenGenerator.cs。您在TokenValidationParameters 中添加的所有内容都可以进入这个类。

一旦你有了，这里是一个样板认证方案：

public class TokenAuthenticationOptions : AuthenticationSchemeOptions
{
}

public class TokenAuthentication : AuthenticationHandler<TokenAuthenticationOptions>
{

    public const string SchemeName = "TokenAuth";

    public TokenAuthentication(IOptionsMonitor<TokenAuthenticationOptions> options, ILoggerFactory logger, 
                                UrlEncoder encoder, ISystemClock clock) 
                                    : base(options, logger, encoder, clock)
    {
    }

    protected override Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        return Task.Run(() => Authenticate());
    }

    private AuthenticateResult Authenticate()
    {
        string auth, token;
        auth = Context.Request.Headers["Authorization"];
        if (auth == null) return AuthenticateResult.Fail("No JWT token provided");
        var auths = auth.Split(" ");
        if (auths[0].ToLower() != "bearer") return AuthenticateResult.Fail("Invalid authentication");
        token = auths[1];

        try
        {
            var generator = new TokenGenerator();
            var principal = generator.Validate(token);
            return AuthenticateResult.Success(new AuthenticationTicket(principal, SchemeName));
        }
        catch
        {
            return AuthenticateResult.Fail("Failed to validate token");
        }
    }
}

最后，在你的启动中，你可以这样使用这个方案：

services.AddAuthentication(TokenAuthentication.SchemeName)
    .AddScheme<TokenAuthenticationOptions, TokenAuthentication>
            (TokenAuthentication.SchemeName, o => { });