Question

我在.Net core 3中有一个Identity Server 4实现。我还创建了3个客户端：Angular，.Net Core MVC（.Net Core 3.0）和.Net framework MVC（.Net framework 4.6.2）。 / p>

Angular和.Net Core MVC客户端可以正常工作，但是.Net框架MVC客户端存在问题。它不会从Identity Server重定向回到客户端。

.Net Framework MVC启动

private void ConfigureAuth(IAppBuilder app)
{
    app.UseCookieAuthentication(new CookieAuthenticationOptions {AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,});

    app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
    {
        AuthenticationType = OpenIdConnectAuthenticationDefaults.AuthenticationType,
        SignInAsAuthenticationType = CookieAuthenticationDefaults.AuthenticationType,

        Authority = "https://localhost:5001/",
        RequireHttpsMetadata = false,

        ResponseType = "id_token",

        RedirectUri = "https://localhost:44333/signin-oidc",
        PostLogoutRedirectUri = "https://localhost:44333/signout-callback-oidc",

        ClientId = "mvc-framework",
        SaveTokens = true
    });
}

注销代码：

[Authorize]
public ActionResult SignOut()
{
    HttpContext.GetOwinContext().Authentication.SignOut(CookieAuthenticationDefaults.AuthenticationType, OpenIdConnectAuthenticationDefaults.AuthenticationType);

    return RedirectToAction("Index", "Home");
}

身份服务器设置：

internal static IServiceCollection AddConfiguredIdentityServer4InMemory(this IServiceCollection services, IConfiguration configuration, IWebHostEnvironment webHostingEnvironment)
{
    var builder = services.AddIdentityServer()
        .AddInMemoryIdentityResources(InMemoryData.GetIdentityResources())
        .AddInMemoryApiResources(InMemoryData.GetApiResources())
        .AddInMemoryClients(InMemoryData.GetClients())
        .AddTestUsers(InMemoryData.GetUsers());

    if (webHostingEnvironment.IsDevelopment())
        builder.AddDeveloperSigningCredential();
    else
        throw new Exception("need to configure key material"); //ToDo: work with certificate in key vault.

    return services;

}

客户端配置：

internal static IEnumerable<Client> GetClients()
{
    return new[]
    {
        // OpenID Connect implicit flow MVC .Net Framework client
        new Client
        {
            ClientId = "mvc-framework",
            ClientName = "MVC .Net Framework Client",
            AllowedGrantTypes = GrantTypes.Implicit,
            RequireConsent = false,

            // where to redirect to after login
            RedirectUris = { "https://localhost:44333/signin-oidc" },

            // where to redirect to after logout
            PostLogoutRedirectUris = { "https://localhost:44333/signout-callback-oidc" },

            // scopes
            AllowedScopes = new List<string> {IdentityServerConstants.StandardScopes.OpenId, IdentityServerConstants.StandardScopes.Profile}
        },

        // OpenID Connect implicit flow MVC .Net Core client
        new Client
        {
            ClientId = "mvc-core",
            ClientName = "MVC .Net Core Client",
            AllowedGrantTypes = GrantTypes.Implicit,
            RequireConsent = false,

            // where to redirect to after login
            RedirectUris = { "https://localhost:5003/signin-oidc" },

            // where to redirect to after logout
            PostLogoutRedirectUris = { "https://localhost:5003/signout-callback-oidc" },
            AllowedScopes = new List<string> {IdentityServerConstants.StandardScopes.OpenId, IdentityServerConstants.StandardScopes.Profile}
        },
        new Client
        {

            ClientId = "angular_spa",
            ClientName = "Angular SPA",
            AllowedGrantTypes = GrantTypes.Implicit,

            RequireConsent = false,

            // where to redirect to after login
            RedirectUris = { "http://localhost:4200/auth-callback" },

            // where to redirect to after logout
            PostLogoutRedirectUris = { "http://localhost:4200/" },

            // cors
            AllowedCorsOrigins = {"http://localhost:4200"},

            AllowedScopes = new List<string> {IdentityServerConstants.StandardScopes.OpenId, IdentityServerConstants.StandardScopes.Profile}
        }
    };
}

身份服务器帐户配置：

public class AccountOptions
{
    public static bool AllowLocalLogin = true;
    public static bool AllowRememberLogin = true;
    public static TimeSpan RememberMeLoginDuration = TimeSpan.FromDays(30);

    public static bool ShowLogoutPrompt = false;
    public static bool AutomaticRedirectAfterSignOut = true;

    public static readonly string WindowsAuthenticationSchemeName = Microsoft.AspNetCore.Server.IISIntegration.IISDefaults.AuthenticationScheme;
    public static bool IncludeWindowsGroups = false;

    public static string InvalidCredentialsErrorMessage = "Invalid username or password";
}

当我使用.Net框架MVC客户端并注销时，我被重定向到Identity Server，并且用户没有问题地注销，但是我的浏览器卡在了上面：

身份服务器的注销页面

PostLogoutRedirectUri在LoggedOutViewModel上为空，但我不确定为什么。注销后，其他两个客户端都将重定向到。

为什么我的.Net Framework MVC（.Net framework 4.6.2）客户端未重定向到任何想法？还是为什么在LoggedOutViewModel上其PostLogoutRedirectUri为空？

Answer 1

IdentityServer需要 id_token 才能继续（自动）重定向。因为这不会发生，所以似乎没有id令牌。

请查看issue here，以了解更多信息。

要解决此问题，您必须include the token on logout：

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    Notifications = new OpenIdConnectAuthenticationNotifications
    {
        RedirectToIdentityProvider = n =>
        {
            // if signing out, add the id_token_hint
            if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
            {
                var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token");

                    if (idTokenHint != null)
                        n.ProtocolMessage.IdTokenHint = idTokenHint.Value;

                    return Task.FromResult(0);
                }
            }
        }
    }
}

要启用自动重定向，请查看我的answer here。

注销后，ASP.Net MVC客户端（.net Framework 4.6.2）不会重定向到

1 个答案: