Question

我正在使用OAuth为我的应用程序生成令牌，特别是JWT。我的启动类中有这个代码：

private void ConfigureOAuthTokenGeneration(IAppBuilder app)
{

    // Configure the db context and user manager to use a single instance per request
    app.CreatePerOwinContext(DatabaseContext.Create);
    app.CreatePerOwinContext<UserService>(UserService.Create);
    app.CreatePerOwinContext<RoleService>(RoleService.Create);

    // Plugin the OAuth bearer JSON Web Token tokens generation and Consumption will be here
    var OAuthServerOptions = new OAuthAuthorizationServerOptions()
    {
        //For Dev enviroment only (on production should be AllowInsecureHttp = false)
        AllowInsecureHttp = true,
        TokenEndpointPath = new PathString("/oauth/token"),
        AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
        Provider = new OAuthProvider(),
        AccessTokenFormat = new CustomJwtFormat("http://localhost:58127")
    };

    // OAuth 2.0 Bearer Access Token Generation
    app.UseOAuthAuthorizationServer(OAuthServerOptions);
}

正如您所看到的，我已经设置了自定义 OAuthProvider ，而对于AccessTokenFormat，我使用的是 CustomJwtFormat 。 OAuthProvider 如下所示：

public class OAuthProvider : OAuthAuthorizationServerProvider
{

    /// <summary>
    /// Validate client authentication
    /// </summary>
    /// <param name="context">The current context</param>
    /// <returns></returns>
    public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
    {

        // Validate all requests (because our front end is trusted)
        context.Validated();

        // Return nothing
        return Task.FromResult<object>(null);
    }

    /// <summary>
    /// Validate user credentials
    /// </summary>
    /// <param name="context">The current context</param>
    /// <returns></returns>
    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {

        // Allow any origin
        var allowedOrigin = "*";

        // Add the access control allow all to our headers
        context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });

        // Get our user service
        var service = context.OwinContext.GetUserManager<UserService>();

        // Find out user
        var user = await service.FindAsync(context.UserName, context.Password);

        // If the user is not found
        if (user == null)
        {

            // Set an error
            context.SetError("invalid_grant", "The user name or password is incorrect.");

            // Return from the function
            return;
        }

        // If the user has not confirmed their account
        if (!user.EmailConfirmed)
        {

            // Set an error
            context.SetError("invalid_grant", "User did not confirm email.");

            // Return from the function
            return;
        }

        // Generate the identity for the user
        var oAuthIdentity = await user.GenerateUserIdentityAsync(service, "JWT");

        // Create a new ticket
        var ticket = new AuthenticationTicket(oAuthIdentity, null);

        // Add the ticked to the validated context
        context.Validated(ticket);
    }
}

非常直接。此外， CustomJwtFormat 类如下所示：

/// <summary>
/// JWT Format
/// </summary>
public class CustomJwtFormat : ISecureDataFormat<AuthenticationTicket>
{

    // Create our private property
    private readonly string issuer;

    /// <summary>
    /// Default constructor
    /// </summary>
    /// <param name="issuer">The issuer</param>
    public CustomJwtFormat(string issuer)
    {
        this.issuer = issuer;
    }

    /// <summary>
    /// Method to create our JWT token
    /// </summary>
    /// <param name="data">The Authentication ticket</param>
    /// <returns></returns>
    public string Protect(AuthenticationTicket data)
    {

        // If no data is supplied, throw an exception
        if (data == null)
            throw new ArgumentNullException("data");

        // Get our values from our appSettings
        string audienceId = ConfigurationManager.AppSettings["as:AudienceId"];
        string symmetricKeyAsBase64 = ConfigurationManager.AppSettings["as:AudienceSecret"];

        // Decode our secret and encrypt the bytes
        var keyByteArray = TextEncodings.Base64Url.Decode(symmetricKeyAsBase64);
        var signingKey = new HmacSigningCredentials(keyByteArray);

        // Get our issue and expire dates in UNIX timestamps
        var issued = data.Properties.IssuedUtc;
        var expires = data.Properties.ExpiresUtc;

        // Create our new token
        var token = new JwtSecurityToken(this.issuer, audienceId, data.Identity.Claims, issued.Value.UtcDateTime, expires.Value.UtcDateTime, signingKey);

        // Create a handler
        var handler = new JwtSecurityTokenHandler();

        // Write our token string
        var jwt = handler.WriteToken(token);

        // Return our token string
        return jwt;
    }

    /// <summary>
    /// 
    /// </summary>
    /// <param name="protectedText"></param>
    /// <returns></returns>
    public AuthenticationTicket Unprotect(string protectedText)
    {
        throw new NotImplementedException();
    }
}

这是至关重要的一点。它使用Thinktecture生成令牌。看起来像这样的一行：

// Create our new token
var token = new JwtSecurityToken(this.issuer, audienceId, data.Identity.Claims, issued.Value.UtcDateTime, expires.Value.UtcDateTime, signingKey);

// Create a handler
var handler = new JwtSecurityTokenHandler();

// Write our token string
var jwt = handler.WriteToken(token);

这将返回您对令牌（access_token，expires_in和token_type）的期望，但我也想返回一些用户信息。用户名，角色等等。

任何人都知道我该怎么做？

Answer 1

用户名和角色出现在经过身份验证的身份声明中，因此会保留在访问令牌中发回的JWT中。

所以这一行： var token = new JwtSecurityToken(_issuer, audienceId, data.Identity.Claims,issued,expires,signingKey);

从身份验证标识中插入声明：

即如果我在OAuth提供程序中执行此操作：

```

IList<Claim> claims = new List<Claim>();

if (context.UserName.Equals("spencer") && context.UserName.Equals(context.Password))
        {                
            claims.Add(new Claim(ClaimTypes.Name, user.DisplayName));
            claims.Add(new Claim(ClaimTypes.Role, "User"));
        }
));

var claimIdentity = new ClaimsIdentity(claims);
var ticket = new AuthenticationTicket(claimIdentity, null);

//Now authed and claims are in my identity context
context.Validated(ticket);

```

所以现在生成JWT时，这些声明都在令牌中。

然后，您可以使用明确的角色装饰您的Api控制器，然后查询＆＃34;角色＆＃34;键入索赔集。如果用户在角色声明集中没有角色，则发出401：

```

[Route]
[Authorize(Roles ="User,Admin")]
public IHttpActionResult Get()
{
    return Ok<IEnumerable<Product>>(_products);
}

[Route]
[Authorize(Roles = "Admin")]
public IHttpActionResult Post(Product product)
{
    _products.Add(product);
    return Created(string.Empty, product);
}

```

所以在上面的例子中，如果我生成一个JWT作为我＆＃34; Spencer＆＃34;我是用户角色，GET可以（200），而POST是未授权的（401）。

有意义吗？

Web API 2 / Token返回更多信息

1 个答案: