Question

我想使用函数IntrospectionClient来验证身份服务器中的令牌，但它总是返回：未经授权

身份服务器启动代码：

services.AddIdentityServer()
            .AddSigningCredential(myPrivatecert)
            .AddInMemoryApiResources(Config.GetResources())
            .AddInMemoryClients(Config.GetClients())
            .AddTestUsers(Config.GetTestUsers())
            .AddValidationKey(myPubliccert)
            .AddJwtBearerClientAuthentication()
            .AddValidators();

我在配置文件中添加了api资源，客户端信息和测试用户

我的配置是：

public class Config
{
    //ApiResource
    public static IEnumerable<ApiResource> GetResources()
    {
        return new List<ApiResource>
        {
            new ApiResource("api")
        };
    }

    //Client
    public static IEnumerable<Client> GetClients()
    {
        return new List<Client>
        {
            new Client()
            {
                ClientId = "site",
                AccessTokenLifetime = 180,
                RefreshTokenExpiration = TokenExpiration.Absolute,
                AbsoluteRefreshTokenLifetime = 1800,
                AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
                ClientSecrets =
                {
                    new Secret("secret".Sha256())
                },
                AlwaysSendClientClaims = true,
                AllowAccessTokensViaBrowser = true,
                RequireConsent = false,
                AllowedScopes =
                {
                    "api"
                },
                AccessTokenType = AccessTokenType.Jwt,
                AllowOfflineAccess = true
            },
        };
    }

    //TestUser
    public static List<TestUser> GetTestUsers()
    {
        return new List<TestUser>{
            new TestUser{
                SubjectId="1",
                Username="wyt",
                Password="123456",
                Claims = new List<Claim>()
                {
                    new Claim("wawa", "aoao"),
                }
            }
        };
    }
}

我的客户启动是：

        services.AddAuthentication(options =>
                {
                    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
                }).
                AddIdentityServerAuthentication(options =>
                {
                    options.Authority = "http://localhost:6001";
                    options.RequireHttpsMetadata = false;
                    options.ApiName = "api";
                });

获取令牌：

        //token
        var tokenClient = new TokenClient(dico.TokenEndpoint, "site", "secret");
        var tokenResponse = tokenClient.RequestResourceOwnerPasswordAsync("wyt", "123456").Result;

想要使用内省：

var introspectionClient = new IntrospectionClient(
            dico.IntrospectionEndpoint,
            "api",
            "secret");

        var vresponse = await introspectionClient.SendAsync
            (
                new IntrospectionRequest { Token = tokenResult.AccessToken }
            );

但是vresponse始终是未经授权的哪里错了？

Answer 1

我遇到了同样的问题，文档不是很清楚。您需要将ApiSecret添加到您的ApiResource：

public static IEnumerable<ApiResource> GetResources()
{
    return new List<ApiResource>
    {
        new ApiResource("api") 
        {
            ApiSecrets = { new Secret("secret".Sha256()) }
        }
    };
}

然后调用自省端点，传递api名称和api机密，就像您做的一样：

var introspectionClient = new IntrospectionClient(
        dico.IntrospectionEndpoint,
        "api",
        "secret");

Identityserver4中的函数IntrospectionClient始终返回Unauthorized

1 个答案: