Amazon 和 Evernote 的身份验证设置

Question

如果您参考https://docs.microsoft.com/en-us/aspnet/core/migration/1x-to-2x/identity-2x?view=aspnetcore-2.2，您可以看到您可以为各种提供者配置 OpenID Connect (OIDC) 身份验证，如下所示：

脸书

services.AddAuthentication()
        .AddFacebook(options =>
        {
            options.AppId = Configuration["auth:facebook:appid"];
            options.AppSecret = Configuration["auth:facebook:appsecret"];
        });

谷歌

services.AddAuthentication()
        .AddGoogle(options =>
        {
            options.ClientId = Configuration["auth:google:clientid"];
            options.ClientSecret = Configuration["auth:google:clientsecret"];
        });

微软

services.AddAuthentication()
        .AddMicrosoftAccount(options =>
        {
            options.ClientId = Configuration["auth:microsoft:clientid"];
            options.ClientSecret = Configuration["auth:microsoft:clientsecret"];
        });

我的问题是，是否有人需要我提供支持 Amazon 和 Evernote OIDC 的设置？

Answer 1

您可以找到 Login with Amazon 参考 here
Amazon 仍然不支持 OIDC，但支持 OAuth。但是，dotnet 的默认 OAuthHandler 不提供 UserInfoEndpoint 处理。这就是为什么您必须实现对UserInfoEndpoint 的调用（可以从 oidc 获取它）或破解 OIDC 以使其认为它有 id_token ，但它没有。我已经通过了第二条路线。有点肮脏的把戏，但我已经确定了我的用户。

.AddOpenIdConnect("lwa", "LoginWithAmazon", options =>
{
  options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;
  options.SignOutScheme = IdentityServerConstants.SignoutScheme;

  options.Authority = "https://www.amazon.com/";
  options.ClientId = "amzn1.application-oa2-client.xxxxxxxxxxxxxx";
  options.ClientSecret = "xxxxxxxxxxxxxxxxx";
  options.ResponseType = "code";
  options.ResponseMode = "query";
  options.SaveTokens = true;
  options.CallbackPath = "/signin-amazon";
  options.SignedOutCallbackPath = "/signout-callback-amazon";
  options.RemoteSignOutPath = "/signout-amazon";
  options.Scope.Clear();
  options.Scope.Add("profile");
  options.GetClaimsFromUserInfoEndpoint = true;

  var rsa = RSA.Create();
  var key = new RsaSecurityKey(rsa){KeyId = "1"};

  var jwtClaims = new List<Claim>
                    {
                        new Claim(JwtClaimTypes.IssuedAt, "now"),
                        new Claim(JwtClaimTypes.JwtId, Guid.NewGuid().ToString()),
                        new Claim(JwtClaimTypes.Subject, Guid.NewGuid().ToString())
                    };

  var jwt = new JwtSecurityToken(
                    "issuer",
                    "audience",
                    jwtClaims,
                    DateTime.UtcNow,
                    DateTime.UtcNow.AddHours(1),
                    new SigningCredentials(key, "RS256"));

  var handler = new JwtSecurityTokenHandler();
  handler.OutboundClaimTypeMap.Clear();
  var token = handler.WriteToken(jwt);

  options.Configuration = new OpenIdConnectConfiguration
  {
      AuthorizationEndpoint = "https://www.amazon.com/ap/oa",
      TokenEndpoint = "https://api.amazon.com/auth/o2/token",
      UserInfoEndpoint = "https://api.amazon.com/user/profile"
  };

  options.TokenValidationParameters = new TokenValidationParameters
  {
      ValidateTokenReplay = false,
      ValidateIssuer = false,
      ValidateAudience = false,
      ValidateLifetime = false,
      IssuerSigningKey = key
  };

  AuthorizationCodeReceivedContext hook = null;
  options.Events = new OpenIdConnectEvents
  {
       OnAuthenticationFailed = async context =>
       {
           //context.SkipHandler();
       },
       OnAuthorizationCodeReceived = async context => { hook = context; },
       OnTokenResponseReceived = async context =>
       {
           context.TokenEndpointResponse.IdToken = token;
           hook.TokenEndpointResponse = context.TokenEndpointResponse;
       },
       OnUserInformationReceived = async context =>
       {
           var user = context.User;
           var claims = new[]
           {
               new Claim(JwtClaimTypes.Subject, user["user_id"].ToString()),
               new Claim(JwtClaimTypes.Email, user["email"].ToString()),
               new Claim(JwtClaimTypes.Name, user["name"].ToString())
           };
           context.Principal = new ClaimsPrincipal(new ClaimsIdentity(claims));
           context.Success();
       }
  };
})

Answer 2

很遗憾，Login with Amazon 和 Evernote 都不支持 Open ID Connect。其他提到的服务都可以，可以通过访问每个服务的相应配置站点来验证：Google、Microsoft。

还有一些其他的没有在 .Net 中预先配置并且可以与它一起使用： Salesforce

您可能已经注意到，Open ID Connect 的配置通常存储在带有“/.well-known/openid-configuration”后缀的站点上。这称为 OpenID Connect 元数据文档，它包含应用程序进行登录所需的大部分信息。这包括诸如要使用的 URL 和服务的公共签名密钥的位置等信息。

现在让我们为自定义 Open ID Connect 提供商进行 .Net 配置（我将使用 Salesforce，因为它支持 Open ID）：

services.AddAuthentication()
.AddFacebook(options =>
{
    options.AppId = Configuration["auth:facebook:appid"];
    options.AppSecret = Configuration["auth:facebook:appsecret"];
})
.AddOpenIdConnect("OpenIdConnectSalesforce", "Salesforce", options =>
{
    options.Authority = "https://login.salesforce.com";
    options.ClientId = Configuration["auth:salesforce:appid"];
    options.ClientSecret = Configuration["auth:salesforce:appsecret"];
    options.ResponseType = "code";
});

启动网络应用程序后，我们可以看到使用 Salesforce 登录的附加按钮：

对于 Evernote 和 Amazon，您可以分别使用它们的 SDK 和 API 来实现它们的登录方法。我相信他们支持 OAuth。

Answer 3

通过@d-f 扩展解决方案以使用 OAuth 处理程序。

.AddOAuth("lwa-oauth", "OauthLoginWithAmazon", options =>
{
    options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;

    options.ClientId = "amzn1.application-oa2-client.zzzzzzzzzzzz";
    options.ClientSecret = "4c0630b4166c901519a730835ezzzzzzzzzzzzzzzz";
    options.SaveTokens = true;
    options.CallbackPath = "/signin-amazon";
    options.Scope.Clear();
    options.Scope.Add("profile");

    options.AuthorizationEndpoint = "https://www.amazon.com/ap/oa";
    options.TokenEndpoint = "https://api.amazon.com/auth/o2/token";
    options.UserInformationEndpoint = "https://api.amazon.com/user/profile";

    options.Events = new OAuthEvents
    {
         OnCreatingTicket = async context =>
         {
            var accessToken = context.AccessToken;
            HttpResponseMessage responseMessage = 
                 await context.Backchannel.SendAsync(
                        new HttpRequestMessage(HttpMethod.Get, options.UserInformationEndpoint)
            {
              Headers = 
              {
                    Authorization = new AuthenticationHeaderValue("Bearer", accessToken)
              }
            });
            responseMessage.EnsureSuccessStatusCode();
            string userInfoResponse = await responseMessage.Content.ReadAsStringAsync();
            var user = JObject.Parse(userInfoResponse);
            var claims = new[]
            {
              new Claim(JwtClaimTypes.Subject, user["user_id"].ToString()),
              new Claim(JwtClaimTypes.Email, user["email"].ToString()),
              new Claim(JwtClaimTypes.Name, user["name"].ToString())
            };
            context.Principal = new ClaimsPrincipal(new ClaimsIdentity(claims));
            context.Success();
       }
   };
})