如何将 MVC4 客户端与 IdentityServer4 一起使用？

Question

有谁知道如何让 MVC 4 客户端应用程序使用 identityserver4 作为身份验证提供者？

我已经尝试过 identityserver3 的示例代码，但没有成功。根据对[Authorize] 操作的请求，它可能会重定向到identityserver4 登录端点并给出未知错误。

据我所知，我无法在 identityserver4 'start-up.cs' 和 MVC 客户端使用 OWIN 的 'startup.cs' 定义客户端。

更新

来自我的 IdentityServer4 应用程序的代码 - MVC 4 客户端定义

// OpenID Connect hybrid flow and client credentials client (MVC)
            new Client
            {
                ClientId = "mvc4",
                ClientName = "MVC 4 Client",
                AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,

                RequireConsent = false,

                ClientSecrets =
                {
                    new Secret("secret".Sha256())
                },

                RedirectUris = { "http://localhost:53173/signin-oidc" },
                PostLogoutRedirectUris = { "http://localhost:53173/signout-callback-oidc" },

                AllowedScopes =
                {
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Profile,
                    "api1"
                },
                AllowOfflineAccess = true
            }

还有来自我的 MVC 4 应用的“Startup.cs”的代码

public void Configuration(IAppBuilder app)
    {

        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = "Cookies"
        });

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            Authority = "http://localhost:5000/",
            RequireHttpsMetadata = false,

            ClientId = "mvc4",
            ClientSecret = "secret",
            ResponseType = "code id_token",

            Scope = "openid profile api1 offline_access",

            UseTokenLifetime = false,
            SignInAsAuthenticationType = "Cookies",
        });
    }

更新 2

我将 MVC 4 客户端的 Startup.cs 更改为：

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            AuthenticationType = "oidc",
            SignInAsAuthenticationType = "Cookies",

            Authority = "http://localhost:5000",
            RequireHttpsMetadata = false,
            RedirectUri = "http://localhost:53173/signin-oidc",

            ClientId = "mvc4",
            ClientSecret = "secret",
            ResponseType = "code id_token"
        });

它现在显示一个登录页面，登录用户，然后 IdentityServer 进入永无止境的循环：

更新 3

public void Configuration(IAppBuilder app)
    {
        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();            

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            AuthenticationType = "oidc",
            SignInAsAuthenticationType = "Cookies",

            Authority = "http://localhost:5000",
            RequireHttpsMetadata = false,
            RedirectUri = "http://localhost:53173/signin-oidc",

            ClientId = "mvc4",
            ClientSecret = "secret",
            ResponseType = "code id_token",

            Scope = "openid profile api1 offline_access",

            AuthenticationMode = AuthenticationMode.Active
        });
    }

按照建议添加了范围，但仍然存在循环；请求在 MVC4 客户端和 IdentityServer4 之间摆动。

更新 4

已解决 - 检查我的答案。

Answer 1

我终于搞定了。

首先，OWIN 中存在一个错误（Katana Bug #197），这使得它在处理令牌时相当“尴尬”。因此，一种解决方法是 nuget 包 Kentor.OwinCookieSaver 由 Kentor 提供。需要在 MVC4 客户端安装。

然后，修改客户端配置如下：-

 new Client
            {
                ClientId = "mvc4",
                ClientName = "MVC 4 Web Client",
                AllowedGrantTypes = {
                    GrantType.Hybrid,
                    GrantType.ClientCredentials
                },
                AllowAccessTokensViaBrowser = true,

                RequireConsent = false,

                ClientSecrets =
                {
                    new Secret("secret".Sha256())
                },

                RedirectUris = { "http://localhost:53173/signin-oidc" },
                PostLogoutRedirectUris = { "http://localhost:53173/signout-callback-oidc" },

                AllowedScopes =
                {
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Profile,
                    "api1"
                },
                AllowOfflineAccess = true
            }

在 MVC4 客户端修改“Startup.cs”的配置，如下所示

 public void Configuration(IAppBuilder app)
    {
        app.UseKentorOwinCookieSaver();

        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap = new Dictionary<string, string>();

        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = CookieAuthenticationDefaults.AuthenticationType
        });

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            AuthenticationType = "oidc",
            SignInAsAuthenticationType = "Cookies",

            Authority = "http://localhost:5000",
            RequireHttpsMetadata = false,
            RedirectUri = "http://localhost:53173/signin-oidc",

            ClientId = "mvc4",
            ClientSecret = "secret",
            ResponseType = OpenIdConnectResponseType.CodeIdTokenToken,

            Scope = "openid profile api1 offline_access",

            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = notification =>
                {
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("id_token", notification.ProtocolMessage.IdToken));
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("access_token", notification.ProtocolMessage.AccessToken));

                    return Task.FromResult(0);
                },

                RedirectToIdentityProvider = notification =>
                {
                    return Task.FromResult(0);
                }
            }
        });

重建解决方案 >> 清理并运行。现在您可以将 IdentityServer4 oidc 用于 MVC4 客户端。

Answer 2

我建议您检查所有 URL 并确保它们都是相同的，并且在身份或客户端配置中没有任何额外的 /。

还有一件事，我在“更新 2”中看不到你的范围。