Identity Server 4 检查预期范围 openid 失败

Question

我第一次尝试在 ASP.NET Core 中设置身份服务器。我已经设置了使用数据库的所有内容，并创建了一个脚本来创建测试客户端、测试用户和资源。我可以请求客户端令牌并请求用户令牌，这些都可以正常工作，但是在调用 connect/userinfo 端点时，我收到了 Forbidden 响应和以下错误；

    IdentityServer4.Validation.TokenValidator[0]
          Checking for expected scope openid failed
          {
            "ValidateLifetime": true,
            "AccessTokenType": "Jwt",
            "ExpectedScope": "openid",
            "Claims": {
              "nbf": 1556641697,
              "exp": 1556645297,
              "iss": "https://localhost:5001",
              "aud": [
                "https://localhost:5001/resources",
                "customAPI"
              ],
              "client_id": "newClient",
              "sub": "75f86dd0-512e-4c9d-b298-1afa120c7d47",
              "auth_time": 1556641697,
              "idp": "local",
              "role": "admin",
              "scope": "customAPI.read",
              "amr": "pwd"
            }
          }

我不确定是什么导致了这个问题。这是我用来设置测试实体的脚本；

private static void InitializeDbTestData(IApplicationBuilder app)
        {
            using (var scope = app.ApplicationServices.GetService<IServiceScopeFactory>().CreateScope())
            {
                scope.ServiceProvider.GetRequiredService<PersistedGrantDbContext>().Database.Migrate();
                scope.ServiceProvider.GetRequiredService<ConfigurationDbContext>().Database.Migrate();
                scope.ServiceProvider.GetRequiredService<ApplicationDbContext>().Database.Migrate();

                var context = scope.ServiceProvider.GetRequiredService<ConfigurationDbContext>();

                // API Client
                Client client = new Client
                {
                    ClientId = "newClient",
                    ClientName = "Example Client Credentials Client Application",
                    AllowedGrantTypes = GrantTypes.ResourceOwnerPasswordAndClientCredentials,
                    ClientSecrets = new List<Secret>
                    {
                        new Secret("123456789".Sha256())
                    },
                    AllowedScopes = new List<string> {"customAPI.read"}
                };


                context.Clients.Add(client.ToEntity());
                context.SaveChanges();

                // Identity Resources
                IList<IdentityResource> identityResources = new List<IdentityResource>
                {
                    new IdentityResources.OpenId(),
                    new IdentityResources.Profile(),
                    new IdentityResources.Email(),
                    new IdentityResource
                    {
                        Name = "role",
                        UserClaims = new List<string> {"role"}
                    }
                };

                foreach (IdentityResource identityResource in identityResources)
                {
                    context.IdentityResources.Add(identityResource.ToEntity());
                }

                // API Resource
                ApiResource resource = new ApiResource
                {
                    Name = "customAPI",
                    DisplayName = "Custom API",
                    Description = "Custom API Access",
                    UserClaims = new List<string> {"role"},
                    ApiSecrets = new List<Secret> {new Secret("scopeSecret".Sha256())},
                    Scopes = new List<Scope>
                    {
                        new Scope("customAPI.read"),
                        new Scope("customAPI.write")
                    }
                };

                context.ApiResources.Add(resource.ToEntity());
                context.SaveChanges();


                var userManager = scope.ServiceProvider.GetRequiredService<UserManager<IdentityUser>>();

                // User
                IdentityUser user = new IdentityUser
                {
                    UserName = "JohnDoe",
                    Email = "john@doe.co.uk",
                };

                IList<Claim> claims = new List<Claim>
                {
                    new Claim(JwtClaimTypes.Email, user.Email),
                    new Claim(JwtClaimTypes.Role, "admin")
                };

                userManager.CreateAsync(user, "112222224344").Wait();
                userManager.AddClaimsAsync(user, claims).Wait();
            }
        }

我确定我在设置客户端/用户时设置了错误，谁能查明是什么？

Answer 1

看不到您的客户端代码，但错误提示您在申请令牌时没有请求 openid 范围。对 Useinfo 端点有效的令牌必须包含 openid 范围。