ASP.NET Core中基于令牌的身份验证（刷新）

我正在使用ASP.NET Core应用程序。 我试图实现基于令牌的身份验证，但无法弄清楚如何使用新的安全系统。

我的场景：客户端请求令牌。 我的服务器应授权用户并返回客户端在以下请求中使用的access_token。

这里有两篇关于实现我需要的精彩文章：

问题是 - 对我来说，如何在ASP.NET Core中做同样的事情并不明显。

我的问题是：如何配置ASP.NET Core Web Api应用程序以使用基于令牌的身份验证？ 我应该追求什么方向？ 你是否写过关于最新版本的文章，或者知道我能找到哪些文章？

谢谢！

从Matt Dekrey的神话般的答案开始，我创建了一个基于令牌的身份验证的完整工作示例，针对ASP.NET Core（1.0.1）进行了工作。 您可以在GitHub（1.0.0-rc1，beta8，beta7的其他分支）上找到完整的代码，但简而言之，重要的步骤是：

为您的应用程序生成密钥

在我的示例中，每次应用程序启动时都会生成一个随机密钥，您需要生成一个并将其存储在某处并将其提供给您的应用程序。 查看这个文件，了解我如何生成随机密钥以及如何从.json文件导入它。 正如@kspearrin的评论中所建议的那样，Data Protection API似乎是“正确”管理密钥的理想人选，但我还没有制定出如果可能的话。 如果你解决了问题，请提交一个拉取请求！

Startup.cs - ConfigureServices

在这里，我们需要加载一个用于我们的令牌签名的私钥，我们还将在验证令牌时使用它来验证令牌。 我们将密钥存储在类级变量key ，我们将在下面的配置方法中重用该key 。 TokenAuthOptions是一个简单的类，它持有我们在TokenController中创建密钥所需的签名身份，受众和签发者。

// Replace this with some sort of loading from config / file.
RSAParameters keyParams = RSAKeyUtils.GetRandomKey();

// Create the key, and a set of token options to record signing credentials 
// using that key, along with the other parameters we will need in the 
// token controlller.
key = new RsaSecurityKey(keyParams);
tokenOptions = new TokenAuthOptions()
{
    Audience = TokenAudience,
    Issuer = TokenIssuer,
    SigningCredentials = new SigningCredentials(key, SecurityAlgorithms.Sha256Digest)
};

// Save the token options into an instance so they're accessible to the 
// controller.
services.AddSingleton<TokenAuthOptions>(tokenOptions);

// Enable the use of an [Authorize("Bearer")] attribute on methods and
// classes to protect.
services.AddAuthorization(auth =>
{
    auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
        .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme‌​)
        .RequireAuthenticatedUser().Build());
});

我们还制定了授权政策，允许我们在我们希望保护的端点和类别上使用[Authorize("Bearer")] 。

Startup.cs - 配置

在这里，我们需要配置JwtBearerAuthentication：

app.UseJwtBearerAuthentication(new JwtBearerOptions {
    TokenValidationParameters = new TokenValidationParameters {
        IssuerSigningKey = key,
        ValidAudience = tokenOptions.Audience,
        ValidIssuer = tokenOptions.Issuer,

        // When receiving a token, check that it is still valid.
        ValidateLifetime = true,

        // This defines the maximum allowable clock skew - i.e.
        // provides a tolerance on the token expiry time 
        // when validating the lifetime. As we're creating the tokens 
        // locally and validating them on the same machines which 
        // should have synchronised time, this can be set to zero. 
        // Where external tokens are used, some leeway here could be 
        // useful.
        ClockSkew = TimeSpan.FromMinutes(0)
    }
});

TokenController

在令牌控制器中，您需要使用在Startup.cs中加载的密钥来生成签名密钥的方法。 我们在Startup中注册了一个TokenAuthOptions实例，所以我们需要在T​​okenController的构造函数中注入它：

[Route("api/[controller]")]
public class TokenController : Controller
{
    private readonly TokenAuthOptions tokenOptions;

    public TokenController(TokenAuthOptions tokenOptions)
    {
        this.tokenOptions = tokenOptions;
    }
...

然后，您需要在您的处理程序中为登录端点生成令牌，在我的示例中，我使用用户名和密码并使用if语句验证这些令牌，但您需要做的关键是创建或加载声明为基础的身份并为此生成令牌：

public class AuthRequest
{
    public string username { get; set; }
    public string password { get; set; }
}

/// <summary>
/// Request a new token for a given username/password pair.
/// </summary>
/// <param name="req"></param>
/// <returns></returns>
[HttpPost]
public dynamic Post([FromBody] AuthRequest req)
{
    // Obviously, at this point you need to validate the username and password against whatever system you wish.
    if ((req.username == "TEST" && req.password == "TEST") || (req.username == "TEST2" && req.password == "TEST"))
    {
        DateTime? expires = DateTime.UtcNow.AddMinutes(2);
        var token = GetToken(req.username, expires);
        return new { authenticated = true, entityId = 1, token = token, tokenExpires = expires };
    }
    return new { authenticated = false };
}

private string GetToken(string user, DateTime? expires)
{
    var handler = new JwtSecurityTokenHandler();

    // Here, you should create or look up an identity for the user which is being authenticated.
    // For now, just creating a simple generic identity.
    ClaimsIdentity identity = new ClaimsIdentity(new GenericIdentity(user, "TokenAuth"), new[] { new Claim("EntityID", "1", ClaimValueTypes.Integer) });

    var securityToken = handler.CreateToken(new Microsoft.IdentityModel.Tokens.SecurityTokenDescriptor() {
        Issuer = tokenOptions.Issuer,
        Audience = tokenOptions.Audience,
        SigningCredentials = tokenOptions.SigningCredentials,
        Subject = identity,
        Expires = expires
    });
    return handler.WriteToken(securityToken);
}

这应该是。 只需将[Authorize("Bearer")]到您要保护的任何方法或类中，并且如果您尝试在没有令牌存在的情况下访问它，则应该会出现错误。 如果你想返回一个401而不是500的错误，你需要注册一个自定义的异常处理程序，就像我在这里的示例中那样。

private static string GenerateRsaKeys()
{
    RSACryptoServiceProvider myRSA = new RSACryptoServiceProvider(2048);
    RSAParameters publicKey = myRSA.ExportParameters(true);
    return myRSA.ToXmlString(includePrivateParameters: true);
}

const string TokenAudience = "Myself";
const string TokenIssuer = "MyProject";

RsaSecurityKey key;
using (var textReader = new System.IO.StreamReader(stream))
{
    RSACryptoServiceProvider publicAndPrivate = new RSACryptoServiceProvider();
    publicAndPrivate.FromXmlString(textReader.ReadToEnd());

    key = new RsaSecurityKey(publicAndPrivate.ExportParameters(true));
}

services.AddInstance(new SigningCredentials(key, 
  SecurityAlgorithms.RsaSha256Signature, SecurityAlgorithms.Sha256Digest));

services.Configure<OAuthBearerAuthenticationOptions>(bearer =>
{
    bearer.TokenValidationParameters.IssuerSigningKey = key;
    bearer.TokenValidationParameters.ValidAudience = TokenAudience;
    bearer.TokenValidationParameters.ValidIssuer = TokenIssuer;
});

app.UseOAuthBearerAuthentication();

services.ConfigureAuthorization(auth =>
{
    auth.AddPolicy("Bearer", new AuthorizationPolicyBuilder()
        .AddAuthenticationTypes(OAuthBearerAuthenticationDefaults.AuthenticationType)
        .RequireAuthenticatedUser().Build());
});

private readonly OAuthBearerAuthenticationOptions bearerOptions;
private readonly SigningCredentials signingCredentials;

// add to using clauses:
// using System.IdentityModel.Tokens.Jwt;

var handler = bearerOptions.SecurityTokenValidators.OfType<JwtSecurityTokenHandler>()
    .First();
// The identity here is the ClaimsIdentity you want to authenticate the user as. 
// You can add your own custom claims to it if you like.
// You can get this using the SignInManager if you're using Identity.
var securityToken = handler.CreateToken(
    issuer: bearerOptions.TokenValidationParameters.ValidIssuer, 
    audience: bearerOptions.TokenValidationParameters.ValidAudience, 
    signingCredentials: signingCredentials,
    subject: identity);
var token = handler.WriteToken(securityToken);

为了实现您所描述的内容，您需要一个OAuth2 / OpenID Connect授权服务器和一个为您的API验证访问令牌的中间件。 Katana曾经提供OAuthAuthorizationServerMiddleware ，但它在ASP.NET Core中不再存在。

我建议看看AspNet.Security.OpenIdConnect.Server ，这是您提到的教程使用的OAuth2授权服务器中间件的实验性分支：有OWIN / Katana 3版本和支持这两种版本的ASP.NET Core版本net451 （.NET Desktop）和netstandard1.4 （与.NET Core兼容）。

https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server

不要错过展示如何使用AspNet.Security.OpenIdConnect.Server配置OpenID Connect授权服务器的MVC Core示例以及如何验证服务器中间件发布的加密访问令牌：https：//github.com/aspnet-的contrib / AspNet.Security.OpenIdConnect.Server /团块的/ dev /样品/ MVC / Mvc.Server / Startup.cs

您也可以阅读这篇博文，该文章解释了如何实施资源所有者密码授权，即基本认证的OAuth2等效功能：http://kevinchalet.com/2016/07/13/creating-your-own-openid-连接服务器与 - ASOS - 实施 - 在资源所有者密码，证书发放/

Startup.cs

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication();
    }

    public void Configure(IApplicationBuilder app)
    {
        // Add a new middleware validating the encrypted
        // access tokens issued by the OIDC server.
        app.UseOAuthValidation();

        // Add a new middleware issuing tokens.
        app.UseOpenIdConnectServer(options =>
        {
            options.TokenEndpointPath = "/connect/token";

            // Override OnValidateTokenRequest to skip client authentication.
            options.Provider.OnValidateTokenRequest = context =>
            {
                // Reject the token requests that don't use
                // grant_type=password or grant_type=refresh_token.
                if (!context.Request.IsPasswordGrantType() &&
                    !context.Request.IsRefreshTokenGrantType())
                {
                    context.Reject(
                        error: OpenIdConnectConstants.Errors.UnsupportedGrantType,
                        description: "Only grant_type=password and refresh_token " +
                                     "requests are accepted by this 
                    return Task.FromResult(0);
                }

                // Since there's only one application and since it's a public client
                // (i.e a client that cannot keep its credentials private),
                // call Skip() to inform the server the request should be
                // accepted without enforcing client authentication.
                context.Skip();

                return Task.FromResult(0);
            };

            // Override OnHandleTokenRequest to support
            // grant_type=password token requests.
            options.Provider.OnHandleTokenRequest = context =>
            {
                // Only handle grant_type=password token requests and let the
                // OpenID Connect server middleware handle the other grant types.
                if (context.Request.IsPasswordGrantType())
                {
                    // Do your credentials validation here.
                    // Note: you can call Reject() with a message
                    // to indicate that authentication failed.

                    var identity = new ClaimsIdentity(context.Options.AuthenticationScheme);
                    identity.AddClaim(OpenIdConnectConstants.Claims.Subject, "[unique id]");

                    // By default, claims are not serialized
                    // in the access and identity tokens.
                    // Use the overload taking a "destinations"
                    // parameter to make sure your claims
                    // are correctly inserted in the appropriate tokens.
                    identity.AddClaim("urn:customclaim", "value",
                        OpenIdConnectConstants.Destinations.AccessToken,
                        OpenIdConnectConstants.Destinations.IdentityToken);

                    var ticket = new AuthenticationTicket(
                        new ClaimsPrincipal(identity),
                        new AuthenticationProperties(),
                        context.Options.AuthenticationScheme);

                    // Call SetScopes with the list of scopes you want to grant
                    // (specify offline_access to issue a refresh token).
                    ticket.SetScopes("profile", "offline_access");

                    context.Validate(ticket);
                }

                return Task.FromResult(0);
            };
        });
    }
}

project.json

{
  "dependencies": {
    "AspNet.Security.OAuth.Validation": "1.0.0",
    "AspNet.Security.OpenIdConnect.Server": "1.0.0"
  }
}

祝你好运！

上一篇: Token Based Authentication in ASP.NET Core (refreshed)

下一篇: bearer token authentication with web api 1