Identityserver4，资源所有者密码在资源服务器中返回401

Question

IDENTITYSERVER4具有自定义用户存储库的资源所有者密码流

通过以下方式创建一个Identityserver link 但在资源服务器端，我无法授权API。

成功获取访问令牌。

在 启动.c 文件

中

 public void ConfigureServices(IServiceCollection services)
        {

        services.AddIdentityServer(options =>
            {
                options.Events.RaiseSuccessEvents = true;
                options.Events.RaiseFailureEvents = true;
                options.Events.RaiseErrorEvents = true;
            })
         .AddDeveloperSigningCredential()
        .AddInMemoryIdentityResources(QuickstartIdentityServer.Config.GetIdentityResources())
        .AddInMemoryApiResources(QuickstartIdentityServer.Config.GetApiResources())
        .AddInMemoryClients(QuickstartIdentityServer.Config.GetClients())
        .AddCustomUserStore();


    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }

        app.UseIdentityServer();
    }

来到 Config.cs 文件

  public static IEnumerable<Client> GetClients()
    {
        // client credentials client
        return new List<Client>
        {
            new Client
            {
                ClientId = "client",
                AllowedGrantTypes = GrantTypes.ResourceOwnerPasswordAndClientCredentials,
                AccessTokenType = AccessTokenType.Jwt,
                AccessTokenLifetime = 3600, //86400,
                IdentityTokenLifetime = 3600, //86400,
                UpdateAccessTokenClaimsOnRefresh = false,
                SlidingRefreshTokenLifetime = 30,
                AllowOfflineAccess = true,
                RefreshTokenExpiration = TokenExpiration.Absolute,
                RefreshTokenUsage = TokenUsage.OneTimeOnly,
                AlwaysSendClientClaims = true,
                Enabled = true,
                ClientSecrets = 
                {
                    new Secret("secret".Sha256())
                },
                AllowedScopes = { "api1", "openid"}
            }
        };
    }

现在在资源服务器startup.cs文件中

  public void ConfigureServices(IServiceCollection services)
    {
        services.AddMvcCore().AddAuthorization().AddJsonFormatters();
        services.AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
       .AddIdentityServerAuthentication(options =>
       {
           options.Authority = "http://localhost:5001"; //This is the identity server url where we are getting accesstoken.
           options.RequireHttpsMetadata = false;
           options.ApiName = "openid";

       });

    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        app.UseAuthentication();

        app.UseMvc();

    }

在提到的API中

[Route("api/")]
[Authorize(AuthenticationSchemes = IdentityServerAuthenticationDefaults.AuthenticationScheme)]
public class TestController : Controller


    // GET: api/v1/users/5
    [HttpGet("Hello")]
    public async Task<IActionResult> getMessage()
    {

        return Ok("Hello");
    }

}

当我将相同的accessstoken传递给上面的API时，如下所示，获得401.我是否需要传递任何内容。或者我错过了任何验证。

请帮帮我。

谢谢。

Answer 1

我认为你应该更新资源服务器startup.cs文件的ConfigureServices方法，如下所示：

 // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddMvcCore()
            .AddAuthorization()
            .AddJsonFormatters();

        services.AddAuthentication("Bearer")
            .AddIdentityServerAuthentication(options =>
            {
                options.Authority = "http://localhost:5001";
                options.RequireHttpsMetadata = false;
                options.ApiName = "openid";
            });


        // services.AddMvc();
    }

Answer 2

显然，由于问题的性质，我无法重现您的问题但是因为您可以获得访问令牌，但仍然有401;我认为这意味着您获得的访问令牌对您发送请求的API无效。 我的猜测是glyphicon-未正确配置，例如.AddInMemoryApiResources(QuickstartIdentityServer.Config.GetApiResources())需要返回GetApiResources()，ApiResource包含Scopes，openid是您用于请求访问令牌的范围。 希望这是有道理的。