Question

我有一个ASP.NET Core 2 MVC应用程序使用身份服务器3和混合流程，目的是获取访问权限，我可以进一步使用它来访问API，有时我被重定向到IDP登录页面，并在输入用户名后和密码我被重定向回MVC应用程序，但它是随机失败的。

我有以下配置

 services.AddAuthentication(sharedOptions =>
            {
                sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                sharedOptions.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;

            })
             .AddOpenIdConnect(options =>
             {
                 options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                 options.Authority = authConfig.GetValue<string>("Authority");
                 options.RequireHttpsMetadata = false;
                 options.ClientId = authConfig.GetValue<string>("ClientId");
                 options.ClientSecret = authConfig.GetValue<string>("ClientSecret");
                 options.ResponseType = "code id_token token";
                 options.SaveTokens = true;
                 options.GetClaimsFromUserInfoEndpoint = false;
                 options.TokenValidationParameters = new
                 TokenValidationParameters
                 {
                     NameClaimType = ClaimTypes.Name,
                     RoleClaimType = ClaimTypes.Role
                 };
                 options.Events = new OpenIdConnectEvents
                 {
                     OnRemoteFailure = context =>
                     {
                         context.HttpContext.Response.Redirect($"/Error?RequestId=4000&errormessage={context.Failure?.Message }");
                         context.HandleResponse();
                         return Task.FromResult(0);
                     },
                     OnRedirectToIdentityProvider = context =>
                     {
                         //TODO: Get IdentityProvider value for Multiple subscribers and not from config
                         var idp = authConfig.GetValue<string>("IdentityProvider");
                         var acrValues = new List<string>();

                         if (!string.IsNullOrWhiteSpace(idp))
                             acrValues.Add($"idp:{idp}");

                         if (acrValues.Count > 0)
                             context.ProtocolMessage.AcrValues = string.Join(" ", acrValues);

                         //if (context.ProtocolMessage.RequestType != OpenIdConnectRequestType.Logout)
                         //{
                         //    if (!CurrentEnvironment.IsDevelopment() &&
                         //        context.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)
                         //    {
                         //        // in widget iframe skip prompt login screen
                         //        context.ProtocolMessage.Prompt = "none";
                         //    }
                         //    return Task.FromResult(0);
                         //}

                         var idTokenHint = context.HttpContext.User.FindFirst("id_token");
                         if (idTokenHint != null)
                             context.ProtocolMessage.IdTokenHint = idTokenHint.Value;

                         return Task.FromResult(0);
                     }

并且客户端的Identity Server上的配置类似于

    "ClientName": "SampleApp",
    "ClientId": "sample.app.mvc",
    "Flow": 2,
    "RedirectUris": ["https://localhost:44368/signin-oidc","https://ecare-rooster-test.azurewebsites.net/signin-oidc"],
    "PostLogoutRedirectUris": ["https://localhost:44368/"],
        "PrefixClientClaims": true,
    "RequireConsent": false,
    "AllowedScopes": 
    [
        "openid",
        "profile",
        "roles",
        "CustomScope"
    ],
    "Claims": [{
        "Type": "subscriberId",
        "Value": "35621957-cb82-4ecc-bce5-836c707d163c"
    }],
"ClientSecrets": [{
        "Secret": "tudc73K2y7pnEjT2"
    }],

    "IdentityTokenLifetime": 300,
    "AccessTokenLifetime": 3600,
    "AuthorizationCodeLifetime": 300,
    "EnableLocalLogin": true
}

我在浏览器中尝试时大多数时间都会遇到错误invalid_grant。你能否告诉我配置的哪一部分不正确？

Answer 1

我发现了这里的问题。

由于上面提到的任何配置，它没有发生。但是由于我使用InMemory存储用于AuthorizationCode存储，而且我的身份服务器部署在Azure上并且有2个实例。

invalid_grant错误IdentityServer 3＆amp; asp.net核心

1 个答案: