Question

我有一个非核心webapi和一个identityserver v3。现在我想实现一个asp核心网站。 asp核心测试网站在http://localhost:49946/上运行是否可以将asp核心站点与identityserver v3 sts服务器一起使用？有没有已知的问题？

我试了但是我总是得到

客户端应用程序未知或未经授权。

我确保重定向uri和客户端ID匹配。

这里我的客户端配置在identityserver

中

  return new Client
            {
                Enabled = true,
                ClientId = "website",
                ClientName = "Site",
                Flow = Flows.Implicit,
                AllowedScopes = new List<string>
                {
                    Constants.StandardScopes.OpenId,
                    Constants.StandardScopes.Email,
                    Constants.StandardScopes.Profile,
                    Constants.StandardScopes.AllClaims,
                    Constants.StandardScopes.Roles,

                    "read","warehouseapi"

                },
                RedirectUris = new List<string>
                {"http://localhost:49946/"
                },
                PostLogoutRedirectUris = new List<string>
                {
                    "http://localhost:49946/"
                }
            };

这里是asp核心mvc客户端的配置

 app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
            {
                AuthenticationScheme = "oidc",
                SignInScheme = "Cookies",

                Authority = "http://localhost:7890",
                RequireHttpsMetadata = false,

                ClientId = "website",

                ResponseType = "id_token token",
                Scope = { "openid profile email warehouseapi" },

                GetClaimsFromUserInfoEndpoint = true,
                SaveTokens = true,
                AutomaticAuthenticate = true,
                AutomaticChallenge = true,
            });

这里是客户端想要进行身份验证时重定向到的URL。在那里你可以看到重定向uri设置为http://localhost:49946/

http://localhost:7890/connect/authorize?client_id=website&redirect_uri=http%3A%2F%2Flocalhost%3A49946%2Fsignin-oidc&response_type=id_token%20token&scope=openid%20profile%20openid%20profile%20email%20warehouseapi&response_mode=form_post&nonce=636115164423104247.ZjY0MjY4OTctZWY3Ny00MGE2LTg4NDAtOWEzZWQyMmQ0NDY5YzJiOWRiNDQtYWY4Yy00MjE2LWE5ZWEtNTA3ZmU3MThkNzBi&state=CfDJ8Faq7VwoA29ApMd_ECq59Rnz2OH_juBD61Mbr40-8VxMsE4i5s5i-jNyb4LdOBYcCAvojnXLPzGy5fvm3c0eNcCnALfy2M2Pl_k0eXcxwXIlF9D_GBmPH5EwsQTXXP5jNBaPuFuxpFM-5tbdSkiqQbdpeddgO7LBPqqxlHcu3MB7e0MOBcPsVOKcTfXwUMG_cWDCoUldgu4k-CjunCTsXOnS7VWpg8ICEP8fcMM8q5GY8KfZFHoOPzu5_24SOLhAeujPF2l_YkVQJRY-QMmv-IWThjk97ewZE8Pl8uIyof38B0lRtbYeE0ChBbM4Wx5O-3yFtTVaT46gtXxqdn4lny39Te1b0SFsG5-LqzZrtTw-RZ_EMZO9wbdd4uwXoifjXg

这只是一个兼容性问题吗？我在监督什么？

- 更新

对于minimalsrivilege的提示，我在日志中找到了解决方案。有一个意外的子路径/signin-oidc

在追踪中我看到了

2016-10-08 13:07:41.450 +02:00 [Information] Start authorize request
2016-10-08 13:07:41.465 +02:00 [Information] Start authorize request protocol validation
2016-10-08 13:07:41.498 +02:00 [Error] "Invalid redirect_uri: http://localhost:49946/signin-oidc"
 "{
  \"ClientId\": \"website\",
  \"ClientName\": \"Pluto Site\",
  \"RedirectUri\": \"http://localhost:49946/signin-oidc\",
  \"AllowedRedirectUris\": [
    \"http://localhost:49946/\"
  ],
  \"SubjectId\": \"unknown\",
  \"Flow\": \"AuthorizationCode\",
  \"RequestedScopes\": \"\",
  \"Raw\": {
    \"client_id\": \"website\",
    \"redirect_uri\": \"http://localhost:49946/signin-oidc\",
    \"response_type\": \"id_token token\",
    \"scope\": \"openid profile openid profile email warehouseapi\",
    \"response_mode\": \"form_post\",
    \"nonce\": \"636115215901620557.ZTNkNmFmYjMtOTY4MC00ODE3LWExMmEtYTc0OWYzYzRkZmY4MDRlM2JjZjUtZGViNC00MjIyLWI1MTktOTM4Y2U2MWFkYzkw\",
    \"state\": \"CfDJ8Faq7VwoA29ApMd_ECq59RmXQrEZdMEoqQ9onYQLXRTRz-ge13paqnwmi_xjJMoVpaItur0ETX08PxoOzQ-YUn--7DR1pvaxqUngPYOiS44j4t9bS4_yiu7Gb1fjU_R5OiZU2cc-0T6PzT_WgUZ48rqC-unHdJqd_NgE7D_9H9ZT1a-2J3GBZEkfh4LOCHHtfcuG06lgXTPn85fkVKcWxbqn6pTrCLRhiRfH9h41e6bvKsGTOmzJ45G9HRpEAlyo7GkgtFgrrshKNo0xDsIxXjAhxp_me_tipBEpyHT8Mo7T9G4-HTtP8FSnb7YurSWjfywOpEG136-T7wvksCEwlMGrL8k90v6prM-bwefOhCFA-8vJO1hvtKkF3wPSgeMiYg\"
  }
}"

Answer 1

在asp核心中，有一个静默附加的子路径

soo http://localhost:49946/signin-oidc必须添加到重定向uris

将Core MVC Client与IdentityServer v3一起使用 - 客户端应用程序未知或未经授权

1 个答案: