Question

我正在尝试使用自托管的IdentityServer3解决方案，并遇到了一个我无法找到答案的问题。

这是我的IdentityServer设置：

var factory = new IdentityServerServiceFactory();
factory.UseInMemoryClients(Config.GetClients())
       .UseInMemoryScopes(Config.GetScopes());
factory.UserService = new Registration<IUserService>(resolver => new LocalRegistrationUserService());
var options = new IdentityServerOptions
{
    SiteName = "Demo IdP",
    SigningCertificate = Certificate.Get(),
    Factory = factory,
    RequireSsl = Convert.ToBoolean(ConfigurationManager.AppSettings["RequireSsl"]),
};
app.UseIdentityServer(options);

范围和客户：

public static IEnumerable<Client> GetClients() 
{
    return new List<Client>
        {
            new Client
                {
                    ClientId = "resourceowner.client",
                    ClientSecrets =
                        {
                            new Secret("3FE8FB45-627A-4C44-BBE3-63281C6CA910".Sha256())
                        },
                    AllowedScopes = { "demo", "openid", "profile" },
                    Flow = Flows.ResourceOwner,
                }   
        };
}

public static IEnumerable<Scope> GetScopes()
{
    return new List<Scope>
        {
            new Scope
                {
                    Name = "demo",
                    DisplayName = "Demo",
                },
            StandardScopes.OpenId,
            StandardScopes.Profile,
        };
}

在LocalRegistrationUserService.AuthenticateLocalAsync(LocalAuthenticationContext context)我得到了：

var loginResult = new AccountManagementService().Login(context.UserName, context.Password);
if (loginResult.LoginOk)
{
    context.AuthenticateResult = new AuthenticateResult(loginResult.Subject, loginResult.UserName);
}
else
{
    ....
}

我对文档中的以下段落的理解

*要在身份验证API中完全记录用户，必须生成代表用户的主题和名称。主题是用户服务的用户唯一标识符，名称是将在用户界面中显示的用户的显示名称。*

主题和用户名将出现在IdentityServer返回的令牌中。但是，当我解码令牌时，这就是我得到的：

Access Token (decoded):
{
  "typ": "JWT",
  "alg": "RS256",
  "x5t": "a3rMUgMFv9tPclLa6yF3zAkfquE",
  "kid": "a3rMUgMFv9tPclLa6yF3zAkfquE"
}
{
  "iss": "http://localhost:44333/core",
  "aud": "http://localhost:44333/core/resources",
  "exp": 1478524845,
  "nbf": 1478521245,
  "client_id": "resourceowner.client",
  "scope": [
    "demo",
    "openid",
    "profile"
  ],
  "sub": "6ace8b2e-ce20-41e9-8d4e-382168e4ce05",
  "auth_time": 1478521245,
  "idp": "idsrv",
  "amr": [
    "password"
  ]
}

很明显，没有名称声明。我在实例化AuthenticateResult时尝试明确添加声明，但无济于事。我在这里明显遗漏了一些东西，但不能最好地弄清楚我做错了什么，所以我会非常感谢提示，指示和/或一个有用的例子。

TIA

AuthenticateResult：为什么有些索赔丢失了？

0 个答案: