IdentityServer4专题之五：OpenID Connect及其Client Credentials流程模式

1.基于概念

OAuth2.0与身份认证协议的角色映射

OpenID Connect 这个协议是2014颁发的，基于OAuth2.0，在这个协议中，ID Token会和Access Token一起发回客户端应用，它还提供了一个UserInfo这个端点，通过此端点可以获取用户信息，还提供了一级标识身份的scopes和claims（profile、email、address、phone）

这个协议定义了三个流程：

Identity Server4.0的结构图

2.三种流程模式

IdentityServer上：

在startup.cs页面中ConfiureServices页面中，应将json config 方式改为code config方式。即按如下方式切换注释代码

// in-memory, code config

builder.AddInMemoryIdentityResources(Config.GetIdentityResources());

builder.AddInMemoryApiResources(Config.GetApis());

builder.AddInMemoryClients(Config.GetClients());

// in-memory, json config

//builder.AddInMemoryIdentityResources(Configuration.GetSection("IdentityResources"));

//builder.AddInMemoryApiResources(Configuration.GetSection("ApiResources"));

//builder.AddInMemoryClients(Configuration.GetSection("clients"));

public static class Config

{

public static IEnumerable<IdentityResource> GetIdentityResources()

{

return new IdentityResource[]

{

new IdentityResources.OpenId(),

new IdentityResources.Profile(),

};

}

public static IEnumerable<ApiResource> GetApis()

{

return new ApiResource[]

{

new ApiResource("api1", "My API #1")

};

}

public static IEnumerable<Client> GetClients()

{

return new[]

{

// client credentials flow client

new Client

{

ClientId = "console client",

ClientName = "Client Credentials Client",

AllowedGrantTypes = GrantTypes.ClientCredentials,

ClientSecrets = { new Secret("511536EF-F270-4058-80CA-1C89C192F69A".Sha256()) },

AllowedScopes = {"api1" }

}

};

}

}

客户端控制台程序代码：

static async Task Main(string[] args)

{

//Discovery endpoint

Console.WriteLine("Hello World!");

var client = new HttpClient();

var disco = await client.GetDiscoveryDocumentAsync("http://localhost:5000");

if(disco.IsError)

{

Console.WriteLine(disco.Error);

return;

}

//Request access token，客户端必须带有：ClientCredentials

var tokenResponse =await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest {

Address = disco.TokenEndpoint,

ClientId = "console client",

ClientSecret = "511536EF-F270-4058-80CA-1C89C192F69A",

Scope= "api1"

});

if (tokenResponse.IsError)

{

Console.WriteLine(tokenResponse.Error);

return;

}

var apiClient = new HttpClient();

apiClient.SetBearerToken(tokenResponse.AccessToken);

var response = await apiClient.GetAsync("http://localhost:5002/api/values");

if (!response.IsSuccessStatusCode)

{

Console.WriteLine(response.StatusCode);

}

else

{

var content = await response.Content.ReadAsStringAsync();

Console.WriteLine(content);

}

｝

asp.net core api资源应用:

public class Startup

{

public Startup(IConfiguration configuration)

{

Configuration = configuration;

}

public IConfiguration Configuration { get; }

// This method gets called by the runtime. Use this method to add services to the container.

public void ConfigureServices(IServiceCollection services)

{

//使用IdentityServer认证和授权

services.AddMvcCore().AddAuthorization().AddJsonFormatters();

services.AddAuthentication("Bearer")

.AddJwtBearer("Bearer", options =>

{

options.Authority = "http://localhost:5000";

options.RequireHttpsMetadata = false;

options.Audience = "api1";

});

}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)

{   //使用identityserver

app.UseAuthentication();

app.UseMvc();

}

}

[Route("api/[controller]")]

[Authorize]

[ApiController]

public class ValuesController : ControllerBase

{

// GET api/values

[HttpGet]

public ActionResult<IEnumerable<string>> Get()

{

return new string[] { "value1", "value2","value3"};

}

｝

总结：Client Credentials这种方式，客户端应用不代表用户，客户端应用本身就相当于是资源所有者；通常用于机器对机器的通信；客户端也需要身份认证。

可采用工具软件监控客户端与服务端的通信：

将获取的access token放到网站https://jwt.io/，进行解码，即可以看到token中包含的许多用用信息。