Question

我正试图了解其工作原理，所以请耐心等待。这是我的身份服务器配置：

    public static IEnumerable<ApiResource> GetApiResources(IConfiguration configuration)
    {
        return new []
        {
            new ApiResource
            {
                Name = "invoices.api",

                ApiSecrets =
                {
                    new Secret("invoices.api.secret".Sha256()),
                },

                Scopes =
                {
                    new Scope("invoices.api.scope"),
                },

                UserClaims =
                {
                    "custom_role",
                }
            }
        };
    }

    public static IEnumerable<Client> GetClients(IConfiguration configuration)
    {
        return new []
        {
            new Client
            {
                ClientId = "invoices.ui",
                RequireConsent = false,
                AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
                AccessTokenType = AccessTokenType.Reference,

                AllowedCorsOrigins = configuration.GetSection("Redirect").Get<RedirectOptions>().AllowedCorsOrigins.ToList(),
                RedirectUris = configuration.GetSection("Redirect").Get<RedirectOptions>().RedirectUris.ToList(),
                PostLogoutRedirectUris = configuration.GetSection("Redirect").Get<RedirectOptions>().PostLogoutRedirectUris.ToList(),

                ClientSecrets =
                {
                    new Secret("invoices.ui.secret".Sha256())
                },

                AllowedScopes =
                {
                    IdentityServerConstants.StandardScopes.OpenId,
                    "invoices.api.scope",
                },
            }
        };
    }

    public static IEnumerable<TestUser> GetUsers(IConfiguration configuration)
    {
        return new []
        {
            new TestUser
            {
                SubjectId = "1",
                Username = "alice",
                Password = "123",
                Claims =
                {
                    new Claim("custom_role", "user"),
                },
            },
            new TestUser
            {
                SubjectId = "2",
                Username = "bob",
                Password = "123",
                Claims =
                {
                    new Claim("custom_role", "admin"),
                },
            }
        };
    }

    public static IEnumerable<IdentityResource> GetIdentityResources(IConfiguration configuration)
    {
        return new []
        {
            new IdentityResources.OpenId(),
        };
    }

这是我的MVC客户端的设置方式：

    services.AddAuthentication(options =>
    {
        options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = "oidc";
    })
    .AddCookie(opts =>
    {
        //opts.ExpireTimeSpan = TimeSpan.FromSeconds(60);
    })
    .AddOpenIdConnect("oidc", opts =>
    {
        opts.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;

        opts.DisableTelemetry = true;

        opts.Authority = Configuration.GetValue<string>("IdentityServer");
        opts.RequireHttpsMetadata = false;

        opts.ClientId = "invoices.ui";
        opts.ClientSecret = "invoices.ui.secret";
        opts.ResponseType = "code id_token";

        opts.SaveTokens = true;
        opts.GetClaimsFromUserInfoEndpoint = true;

        opts.Scope.Clear();
        opts.Scope.Add("openid");
        opts.Scope.Add("invoices.api.scope");
    });

在对用户进行身份验证之后，我试图以这种方式查看它的声明：

    @foreach (var claim in User.Claims)
    {
        <dt>@claim.Type</dt>
        <dd>@claim.Value</dd>
    }

但是该列表不包含任何“ custom_role”声明。身份服务器日志显示客户端已从用户信息端点请求了用户信息，但是我的“ custom_role”没有转移到那里，但是它在身份服务器的日志中显示该用户拥有该信息。

如何在我的MVC应用中访问我的自定义声明？我需要从用户端点获取它们并用于授权。

Answer 1

如果您要求提供访问令牌和身份令牌（“代码id_token”），则Identity Server默认不会包含用户声明。

解决方案是将AlwaysIncludeUserClaimsInIdToken设置为true。参见Link

此设置为何存在的说明在这里：http://docs.identityserver.io/en/release/reference/client.html

Answer 2

即使使用内置ProfileService实现，似乎添加具有指定声明的身份资源也可以解决该问题：

    public static IEnumerable<IdentityResource> GetIdentityResources(IConfiguration configuration)
    {
        return new []
        {
            new IdentityResources.OpenId(),
            new IdentityResource
            {
                Name = "roles.scope",
                UserClaims =
                {
                    "custom_role",
                }
            }
        };
    }

也将其添加为客户范围：

    AllowedScopes =
    {
        IdentityServerConstants.StandardScopes.OpenId,
        "invoices.api.scope",
        "roles.scope",
    },

如何在IdentityServer4中正确使用声明？

2 个答案: