如何从MVC客户端asp.net core2.2在Identity Server 4下调用安全API隐式流

Question

我尝试使用单独的IdentityService，MVC Client和WebAPI为IdentityServer4进行poc。通过从IdentityService重定向到“登录”页面，我的MVC客户端能够从Identity Service获取令牌。现在，我想在身份服务器4（单独的service-asp.net核心2.2）下以隐式模式从经过身份验证的mvc客户端（asp.net核心2.2）调用我的webAPI（asp.net核心2.2）。

我曾尝试在搜索文档和其他地方搜索示例代码，但没有运气

WebAPI启动

public void ConfigureServices(IServiceCollection services)
        {
            services.AddMvcCore()
            .AddAuthorization()
            .AddJsonFormatters();
            services.AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
                .AddIdentityServerAuthentication(options => {
                    options.Authority = "https://localhost:44398/";
                    options.ApiName = "customAPI"; // required audience of access tokens
                    options.RequireHttpsMetadata = false; // dev only!
                });

                services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
        }

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }
            app.UseAuthentication();
            app.UseHttpsRedirection();
            app.UseMvc();
        }

API注册

new Client
                {
                    ClientId = "mvc",
                    ClientName = "MVC Client",
                    AllowedGrantTypes = GrantTypes.Implicit,
                    AllowedScopes = new List<string>
                    {
                        IdentityServerConstants.StandardScopes.OpenId,
                        IdentityServerConstants.StandardScopes.Profile,
                        "customAPI.read",
                        "customAPI.write"
                    },
                    // where to redirect to after login
                    RedirectUris = { "https://localhost:44356/signin-oidc" },

                    // where to redirect to after logout
                    PostLogoutRedirectUris = { "https://localhost:44356/signout-callback-oidc" },
                    RequireConsent = false,


                }