Question

我正在将Identity Server 4与Angular客户端一起使用。

在双方中，我都添加了相同的作用域：

'openid profile offline_access email api'

但是我得到一个错误：

Sorry, there was an error : invalid_scope
Invalid scope

我检查了著名的OpenID配置，然后看到：

"scopes_supported": [
  "openid",
  "profile",
  "api",
  "offline_access"

]

因此电子邮件范围不显示吗？

这可能是问题吗？为什么会这样？

我的Identity Server 4客户端定义为：

new Client {

  ClientId = "spa",
  ClientSecrets = { new Secret("secret".Sha256()) },
  AllowedGrantTypes = GrantTypes.Code,
  RequirePkce = true,
  RequireClientSecret = false,
  AllowAccessTokensViaBrowser = true,
  AllowOfflineAccess = true,

  AllowedScopes = { 
    IdentityServerConstants.StandardScopes.OpenId,
    IdentityServerConstants.StandardScopes.Profile, 
    IdentityServerConstants.StandardScopes.Email, 
    IdentityServerConstants.StandardScopes.OfflineAccess,
    "api" 
  },  

  RedirectUris = new List<String> { 
    "https://localhost:5001",
    "https://localhost:5001/index.html",
    "https://localhost:5001/silent-refresh.html" 
  },

  PostLogoutRedirectUris = new List<String> { 
    "https://localhost:5001/" 
  },

  AllowedCorsOrigins = new List<String> { 
    "https://localhost:5001" 
  }

}

Answer 1

您需要添加一个IdentityResource：

    public static IEnumerable<IdentityResource> GetIdentityResources()
    {
        return new List<IdentityResource>
        {
            new IdentityResources.OpenId(),
            new IdentityResources.Profile(),
            new IdentityResources.Email()
        };
    }

然后在startup.cs中添加以下内容：

var identityServerBuilder = services.AddIdentityServer(...)
.AddInMemoryIdentityResources(GetIdentityResources())

即使添加到客户端，Identity Server 4中也缺少电子邮件范围

1 个答案: