本节将在第四节基础上介绍如何实现IdentityServer4从数据库获取User进行验证，并对Claim进行权限设置。

一、新建Web API资源服务，命名为ResourceAPI

（1）新建API项目，用来进行user的身份验证服务。

（2）配置端口为5001

       安装Microsoft.EntityFrameworkCore包

       安装Microsoft.EntityFrameworkCore.SqlServer包

       安装Microsoft.EntityFrameworkCore.Tools包

（3）我们在项目添加一个 Entities文件夹。

新建一个User类，存放用户基本信息，其中Claims为一对多的关系。

其中UserId的值是唯一的。

  1.  public class User
  2.     {
  3.         [Key]
  4.         [MaxLength()]
  5.         public string UserId { get; set; }
  6.  
  7.         [MaxLength()]
  8.         public string UserName { get; set; }
  9.  
  10.         [MaxLength()]
  11.         public string Password { get; set; }
  12.  
  13.         public bool IsActive { get; set; }//是否可用
  14.  
  15.         public virtual ICollection<Claims> Claims { get; set; }
  16.  
  17. }

新建Claims类

  1. public class Claims
  2.     {
  3.         [MaxLength()]
  4.         public int ClaimsId { get; set; }
  5.  
  6.         [MaxLength()]
  7.         public string Type { get; set; }
  8.  
  9.         [MaxLength()]
  10.         public string Value { get; set; }
  11.  
  12.         public virtual User User { get; set; }
  13.  
  14.     }

继续新建 UserContext.cs

  1. public class UserContext:DbContext
  2.     {
  3.  
  4.         public UserContext(DbContextOptions<UserContext> options)
  5.             : base(options)
  6.         {
  7.         }
  8.         public DbSet<User> Users { get; set; }
  9.         public DbSet<Claims> UserClaims { get; set; }
  10. }

（4）修改startup.cs中的ConfigureServices方法，添加SQL Server配置。

  1. public void ConfigureServices(IServiceCollection services)
  2.         {
  3.             var connection = "Data Source=localhost;Initial Catalog=UserAuth;User ID=sa;Password=Pwd";
  4.             services.AddDbContext<UserContext>(options => options.UseSqlServer(connection));
  5.             // Add framework services.
  6.             services.AddMvc();
  7.         }

完成后在程序包管理器控制台运行：Add-Migration InitUserAuth

生成迁移文件。

（5）添加Models文件夹，定义User的model类和Claims的model类。

在Models文件夹中新建User类：

  1. public class User
  2.     {
  3.         public string UserId { get; set; }
  4.  
  5.         public string UserName { get; set; }
  6.  
  7.         public string Password { get; set; }
  8.  
  9.         public bool IsActive { get; set; }
  10.  
  11.         public ICollection<Claims> Claims { get; set; } = new HashSet<Claims>();
  12. }

新建Claims类：

  1. public class Claims
  2.     {
  3.         public Claims(string type,string value)
  4.         {
  5.             Type = type;
  6.             Value = value;
  7.         }
  8.         public string Type { get; set; }
  9.         public string Value { get; set; }
  10.     }

做Model和Entity之前的映射。

添加类UserMappers：

  1. public static class UserMappers
  2.     {
  3.         static UserMappers()
  4.         {
  5.             Mapper = new MapperConfiguration(cfg => cfg.AddProfile<UserContextProfile>())
  6.                 .CreateMapper();
  7.         }
  8.         internal static IMapper Mapper { get; }
  9.  
  10.         /// <summary>
  11.         /// Maps an entity to a model.
  12.         /// </summary>
  13.         /// <param name="entity">The entity.</param>
  14.         /// <returns></returns>
  15.         public static Models.User ToModel(this User entity)
  16.         {
  17.             return Mapper.Map<Models.User>(entity);
  18.         }
  19.  
  20.         /// <summary>
  21.         /// Maps a model to an entity.
  22.         /// </summary>
  23.         /// <param name="model">The model.</param>
  24.         /// <returns></returns>
  25.         public static User ToEntity(this Models.User model)
  26.         {
  27.             return Mapper.Map<User>(model);
  28.         }
  29.     }

类UserContextProfile：

  1. public class UserContextProfile: Profile
  2.     {
  3.         public UserContextProfile()
  4.         {
  5.             //entity to model
  6.             CreateMap<User, Models.User>(MemberList.Destination)
  7.                 .ForMember(x => x.Claims, opt => opt.MapFrom(src => src.Claims.Select(x => new Models.Claims(x.Type, x.Value))));
  8.  
  9.             //model to entity
  10.             CreateMap<Models.User, User>(MemberList.Source)
  11.                 .ForMember(x => x.Claims,
  12.                     opt => opt.MapFrom(src => src.Claims.Select(x => new Claims { Type = x.Type, Value = x.Value })));
  13.         }
  14.     }

（6）在startup.cs中添加初始化数据库的方法InitDataBase方法，对User和Claim做级联插入。

  1.  public void InitDataBase(IApplicationBuilder app)
  2.         {
  3.  
  4.             using (var serviceScope = app.ApplicationServices.GetService<IServiceScopeFactory>().CreateScope())
  5.             {
  6.                 serviceScope.ServiceProvider.GetRequiredService<Entities.UserContext>().Database.Migrate();
  7.  
  8.                 var context = serviceScope.ServiceProvider.GetRequiredService<Entities.UserContext>();
  9.                 context.Database.Migrate();
  10.                 if (!context.Users.Any())
  11.                 {
  12.                     User user = new User()
  13.                     {
  14.                         UserId = "",
  15.                         UserName = "zhubingjian",
  16.                         Password = "",
  17.                         IsActive = true,
  18.                         Claims = new List<Claims>
  19.                         {
  20.                             new Claims("role","admin")
  21.                         }
  22.                     };
  23.                     context.Users.Add(user.ToEntity());
  24.                     context.SaveChanges();
  25.                 }
  26.             }
  27.         }

（7）在startup.cs中添加InitDataBase方法的引用。

  1. public void Configure(IApplicationBuilder app, IHostingEnvironment env)
  2.         {
  3.             if (env.IsDevelopment())
  4.             {
  5.                 app.UseDeveloperExceptionPage();
  6.             }
  7.             InitDataBase(app);
  8.             app.UseMvc();
  9.         }

运行程序，这时候数据生成数据库UserAuth，表Users中有一条UserName=zhubingjian,Password=123的数据。

二、实现获取User接口，进行身份验证

（1）先对API进行保护，在Startup.cs的ConfigureServices方法中添加：

  1.             //protect API
  2.             services.AddMvcCore()
  3.             .AddAuthorization()
  4.             .AddJsonFormatters();
  5.  
  6.             services.AddAuthentication("Bearer")
  7.                 .AddIdentityServerAuthentication(options =>
  8.                 {
  9.                     options.Authority = "http://localhost:5000";
  10.                     options.RequireHttpsMetadata = false;
  11.  
  12.                     options.ApiName = "api1";
  13.                 });

并在Configure中，将UseAuthentication身份验证中间件添加到管道中，以便在每次调用主机时自动执行身份验证。

app.UseAuthentication();

（2）接着，实现获取User的接口。

在ValuesController控制中，添加如下代码：

  1. UserContext context;
  2.         public ValuesController(UserContext _context)
  3.         {
  4.             context = _context;
  5.         }
  6.  
  7. //只接受role为AuthServer授权服务的请求
  8. [Authorize(Roles = "AuthServer")]
  9.         [HttpGet("{userName}/{password}")]
  10.         public IActionResult AuthUser(string userName, string password)
  11.         {
  12.            var res = context.Users.Where(p => p.UserName == userName && p.Password == password)
  13.                 .Include(p=>p.Claims)
  14.                 .FirstOrDefault();
  15.             return Ok(res.ToModel());
  16.         }

好了，资源服务器获取User的接口完成了。

（3）接着回到AuthServer项目，把User改成从数据库进行验证。

找到AccountController控制器，把从内存验证User部分修改成从数据库验证。

主要修改Login方法，代码给出了简要注释：

  1.         public async Task<IActionResult> Login(LoginInputModel model, string button)
  2.         {
  3.             // check if we are in the context of an authorization request
  4.             AuthorizationRequest context = await _interaction.GetAuthorizationContextAsync(model.ReturnUrl);
  5.  
  6.             // the user clicked the "cancel" button
  7.             if (button != "login")
  8.             {
  9.                 if (context != null)
  10.                 {
  11.                     // if the user cancels, send a result back into IdentityServer as if they
  12.                     // denied the consent (even if this client does not require consent).
  13.                     // this will send back an access denied OIDC error response to the client.
  14.                     await _interaction.GrantConsentAsync(context, ConsentResponse.Denied);
  15.  
  16.                     // we can trust model.ReturnUrl since GetAuthorizationContextAsync returned non-null
  17.                     if (await _clientStore.IsPkceClientAsync(context.ClientId))
  18.                     {
  19.                         // if the client is PKCE then we assume it's native, so this change in how to
  20.                         // return the response is for better UX for the end user.
  21.                         return View("Redirect", new RedirectViewModel { RedirectUrl = model.ReturnUrl });
  22.                     }
  23.  
  24.                     return Redirect(model.ReturnUrl);
  25.                 }
  26.                 else
  27.                 {
  28.                     // since we don't have a valid context, then we just go back to the home page
  29.                     return Redirect("~/");
  30.                 }
  31.             }
  32.  
  33.             if (ModelState.IsValid)
  34.             {
  35.                 //从数据库获取User并进行验证
  36.                 var client = _httpClientFactory.CreateClient();
  37.                 //已过时
  38.                 //DiscoveryResponse disco = await DiscoveryClient.GetAsync("http://localhost:5000");
  39.                 //TokenClient tokenClient = new TokenClient(disco.TokenEndpoint, "AuthServer", "secret");
  40.                 //var tokenResponse = await tokenClient.RequestClientCredentialsAsync("api1");
  41.                 DiscoveryResponse disco = await client.GetDiscoveryDocumentAsync("http://localhost:5000");
  42.                 var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
  43.                 {
  44.                     Address = disco.TokenEndpoint,
  45.                     ClientId = "AuthServer",
  46.                     ClientSecret = "secret",
  47.                     Scope = "api1"
  48.                 });
  49.                 if (tokenResponse.IsError)
  50.                     throw new Exception(tokenResponse.Error);
  51.  
  52.                 client.SetBearerToken(tokenResponse.AccessToken);
  53.                 try
  54.                 {
  55.                     var response = await client.GetAsync("http://localhost:5001/api/values/" + model.Username + "/" + model.Password);
  56.                     if (!response.IsSuccessStatusCode)
  57.                     {
  58.                         throw new Exception("Resource server is not working!");
  59.                     }
  60.                     else
  61.                     {
  62.                         var content = await response.Content.ReadAsStringAsync();
  63.                         User user = JsonConvert.DeserializeObject<User>(content);
  64.                         if (user != null)
  65.                         {
  66.                             await _events.RaiseAsync(new UserLoginSuccessEvent(user.UserName, user.UserId, user.UserName));
  67.  
  68.                             // only set explicit expiration here if user chooses "remember me".
  69.                             // otherwise we rely upon expiration configured in cookie middleware.
  70.                             AuthenticationProperties props = null;
  71.                             if (AccountOptions.AllowRememberLogin && model.RememberLogin)
  72.                             {
  73.                                 props = new AuthenticationProperties
  74.                                 {
  75.                                     IsPersistent = true,
  76.                                     ExpiresUtc = DateTimeOffset.UtcNow.Add(AccountOptions.RememberMeLoginDuration)
  77.                                 };
  78.                             };
  79.  
  80.                             //             context.Result = new GrantValidationResult(
  81.                             //user.SubjectId ?? throw new ArgumentException("Subject ID not set", nameof(user.SubjectId)),
  82.                             //OidcConstants.AuthenticationMethods.Password, _clock.UtcNow.UtcDateTime,
  83.                             //user.Claims);
  84.  
  85.                             // issue authentication cookie with subject ID and username
  86.                             await HttpContext.SignInAsync(user.UserId, user.UserName, props);
  87.  
  88.                             if (context != null)
  89.                             {
  90.                                 if (await _clientStore.IsPkceClientAsync(context.ClientId))
  91.                                 {
  92.                                     // if the client is PKCE then we assume it's native, so this change in how to
  93.                                     // return the response is for better UX for the end user.
  94.                                     return View("Redirect", new RedirectViewModel { RedirectUrl = model.ReturnUrl });
  95.                                 }
  96.  
  97.                                 // we can trust model.ReturnUrl since GetAuthorizationContextAsync returned non-null
  98.                                 return Redirect(model.ReturnUrl);
  99.                             }
  100.  
  101.                             // request for a local page
  102.                             if (Url.IsLocalUrl(model.ReturnUrl))
  103.                             {
  104.                                 return Redirect(model.ReturnUrl);
  105.                             }
  106.                             else if (string.IsNullOrEmpty(model.ReturnUrl))
  107.                             {
  108.                                 return Redirect("~/");
  109.                             }
  110.                             else
  111.                             {
  112.                                 // user might have clicked on a malicious link - should be logged
  113.                                 throw new Exception("invalid return URL");
  114.                             }
  115.                         }
  116.  
  117.                         await _events.RaiseAsync(new UserLoginFailureEvent(model.Username, "invalid credentials"));
  118.                         ModelState.AddModelError("", AccountOptions.InvalidCredentialsErrorMessage);
  119.                     }
  120.                 }
  121.                 catch (Exception ex)
  122.                 {
  123.                     await _events.RaiseAsync(new UserLoginFailureEvent("Resource server", "is not working!"));
  124.                     ModelState.AddModelError("", "Resource server is not working");
  125.                 }
  126.  
  127.             }
  128.  
  129.             // something went wrong, show form with error
  130.             var vm = await BuildLoginViewModelAsync(model);
  131.             return View(vm);
  132.         }

可以看到，在IdentityServer4更新后，旧版获取tokenResponse的方法已过时，按官网文档的说明，使用新方法。

官网链接：https://identitymodel.readthedocs.io/en/latest/client/token.htm

（4）到这步后，可以把Startup中ConfigureServices方法里面的AddTestUsers去掉了。

运行程序，已经可以从数据进行User验证了。

点击进入About页面时候，出现没有权限提示，我们会发现从数据库获取的User中的Claims不起作用了。

三、使用数据数据自定义Claim

为了让获取的Claims起作用，我们来实现IresourceOwnerPasswordValidator接口和IprofileService接口。

（1）在AuthServer中添加类ResourceOwnerPasswordValidator，继承IresourceOwnerPasswordValidator接口。

  1.  public class ResourceOwnerPasswordValidator : IResourceOwnerPasswordValidator
  2.     {
  3.         private readonly IHttpClientFactory _httpClientFactory;
  4.         public ResourceOwnerPasswordValidator(IHttpClientFactory httpClientFactory)
  5.         {
  6.             _httpClientFactory = httpClientFactory;
  7.         }
  8.         public async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
  9.         {
  10.             try
  11.             {
  12.                 var client = _httpClientFactory.CreateClient();
  13.                 //已过时
  14.                 //DiscoveryResponse disco = await DiscoveryClient.GetAsync("http://localhost:5000");
  15.                 //TokenClient tokenClient = new TokenClient(disco.TokenEndpoint, "AuthServer", "secret");
  16.                 //var tokenResponse = await tokenClient.RequestClientCredentialsAsync("api1");
  17.  
  18.                 DiscoveryResponse disco = await client.GetDiscoveryDocumentAsync("http://localhost:5000");
  19.                 var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
  20.                 {
  21.                     Address = disco.TokenEndpoint,
  22.                     ClientId = "AuthServer",
  23.                     ClientSecret = "secret",
  24.                     Scope = "api1"
  25.                 });
  26.                 if (tokenResponse.IsError)
  27.                     throw new Exception(tokenResponse.Error);
  28.  
  29.                 client.SetBearerToken(tokenResponse.AccessToken);
  30.                 var response = await client.GetAsync("http://localhost:5001/api/values/" + context.UserName + "/" + context.Password);
  31.                 if (!response.IsSuccessStatusCode)
  32.                 {
  33.                     throw new Exception("Resource server is not working!");
  34.                 }
  35.                 else
  36.                 {
  37.                     var content = await response.Content.ReadAsStringAsync();
  38.                     User user = JsonConvert.DeserializeObject<User>(content);
  39.                     //get your user model from db (by username - in my case its email)
  40.                     //var user = await _userRepository.FindAsync(context.UserName);
  41.                     if (user != null)
  42.                     {
  43.                         //check if password match - remember to hash password if stored as hash in db
  44.                         if (user.Password == context.Password)
  45.                         {
  46.                             //set the result
  47.                             context.Result = new GrantValidationResult(
  48.                                 subject: user.UserId.ToString(),
  49.                                 authenticationMethod: "custom",
  50.                                 claims: GetUserClaims(user));
  51.  
  52.                             return;
  53.                         }
  54.                         context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, "Incorrect password");
  55.                         return;
  56.                     }
  57.                     context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, "User does not exist.");
  58.                     return;
  59.                 }
  60.             }
  61.             catch (Exception ex)
  62.             {
  63.  
  64.             }
  65.  
  66.         }
  67.         public static Claim[] GetUserClaims(User user)
  68.         {
  69.             List<Claim> claims = new List<Claim>();
  70.             Claim claim;
  71.             foreach (var itemClaim in user.Claims)
  72.             {
  73.                 claim = new Claim(itemClaim.Type, itemClaim.Value);
  74.                 claims.Add(claim);
  75.             }
  76.             return claims.ToArray();
  77.         }
  78.     }

（2）ProfileService类实现IprofileService接口：

  1.  public class ProfileService : IProfileService
  2.     {
  3.         private readonly IHttpClientFactory _httpClientFactory;
  4.         public ProfileService(IHttpClientFactory httpClientFactory)
  5.         {
  6.             _httpClientFactory = httpClientFactory;
  7.         }
  8.         ////services
  9.         //private readonly IUserRepository _userRepository;
  10.  
  11.         //public ProfileService(IUserRepository userRepository)
  12.         //{
  13.         //    _userRepository = userRepository;
  14.         //}
  15.  
  16.         //Get user profile date in terms of claims when calling /connect/userinfo
  17.         public async Task GetProfileDataAsync(ProfileDataRequestContext context)
  18.         {
  19.             try
  20.             {
  21.                 //depending on the scope accessing the user data.
  22.                            var userId = context.Subject.Claims.FirstOrDefault(x => x.Type == "sub");
  23.                     //获取User_Id
  24.                     if (!string.IsNullOrEmpty(userId?.Value) && long.Parse(userId.Value) > )
  25.                     {
  26.                         var client = _httpClientFactory.CreateClient();
  27.                         //已过时
  28.                         //DiscoveryResponse disco = await DiscoveryClient.GetAsync("http://localhost:5000");
  29.                         //TokenClient tokenClient = new TokenClient(disco.TokenEndpoint, "AuthServer", "secret");
  30.                         //var tokenResponse = await tokenClient.RequestClientCredentialsAsync("api1");
  31.  
  32.                         DiscoveryResponse disco = await client.GetDiscoveryDocumentAsync("http://localhost:5000");
  33.                         var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
  34.                         {
  35.                              Address = disco.TokenEndpoint,
  36.                              ClientId = "AuthServer",
  37.                              ClientSecret = "secret",
  38.                              Scope = "api1"
  39.                         });
  40.                         if (tokenResponse.IsError)
  41.                              throw new Exception(tokenResponse.Error);
  42.                         client.SetBearerToken(tokenResponse.AccessToken);
  43.  
  44.                         //根据User_Id获取user
  45.                         var response = await client.GetAsync("http://localhost:5001/api/values/" + long.Parse(userId.Value));
  46.                         //get user from db (find user by user id)
  47.                         //var user = await _userRepository.FindAsync(long.Parse(userId.Value));
  48.                         var content = await response.Content.ReadAsStringAsync();
  49.                         User user = JsonConvert.DeserializeObject<User>(content);
  50.                         // issue the claims for the user
  51.                         if (user != null)
  52.                         {
  53.                             //获取user中的Claims
  54.                             var claims = GetUserClaims(user);
  55.                             //context.IssuedClaims = claims.Where(x => context.RequestedClaimTypes.Contains(x.Type)).ToList();
  56.                             context.IssuedClaims = claims.ToList();
  57.                         }
  58.                   }
  59.             }
  60.             catch (Exception ex)
  61.             {
  62.                 //log your error
  63.             }
  64.         }
  65.  
  66.         //check if user account is active.
  67.         public async Task IsActiveAsync(IsActiveContext context)
  68.         {
  69.             try
  70.             {
  71.                 var userId = context.Subject.Claims.FirstOrDefault(x => x.Type == "sub");
  72.  
  73.                         if (!string.IsNullOrEmpty(userId?.Value) && long.Parse(userId.Value) > )
  74.                         {
  75.                             //var user = await _userRepository.FindAsync(long.Parse(userId.Value));
  76.                             var client = _httpClientFactory.CreateClient();
  77.                             //已过时
  78.                             //DiscoveryResponse disco = await DiscoveryClient.GetAsync("http://localhost:5000");
  79.                             //TokenClient tokenClient = new TokenClient(disco.TokenEndpoint, "AuthServer", "secret");
  80.                             //ar tokenResponse = await tokenClient.RequestClientCredentialsAsync("api1");
  81.  
  82.                             DiscoveryResponse disco = await client.GetDiscoveryDocumentAsync("http://localhost:5000");
  83.                             var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
  84.                             {
  85.                                Address = disco.TokenEndpoint,
  86.                                ClientId = "AuthServer",
  87.                                ClientSecret = "secret",
  88.                                Scope = "api1"
  89.                             });
  90.                             if (tokenResponse.IsError)
  91.                                throw new Exception(tokenResponse.Error);
  92.                             client.SetBearerToken(tokenResponse.AccessToken);
  93.  
  94.                             //根据User_Id获取user
  95.                             var response = await client.GetAsync("http://localhost:5001/api/values/" + long.Parse(userId.Value));
  96.                             //get user from db (find user by user id)
  97.                             //var user = await _userRepository.FindAsync(long.Parse(userId.Value));
  98.                             var content = await response.Content.ReadAsStringAsync();
  99.                             User user = JsonConvert.DeserializeObject<User>(content);
  100.                             if (user != null)
  101.                             {
  102.                                 if (user.IsActive)
  103.                                 {
  104.                                     context.IsActive = user.IsActive;
  105.                                 }
  106.                             }
  107.                         }
  108.             }
  109.             catch (Exception ex)
  110.             {
  111.                 //handle error logging
  112.             }
  113.         }
  114.         public static Claim[] GetUserClaims(User user)
  115.         {
  116.             List<Claim> claims = new List<Claim>();
  117.             Claim claim;
  118.             foreach (var itemClaim in user.Claims)
  119.             {
  120.                 claim = new Claim(itemClaim.Type, itemClaim.Value);
  121.                 claims.Add(claim);
  122.             }
  123.             return claims.ToArray();
  124.         }
  125.     }

（3）发现代码里面需要在ResourceAPI项目的ValuesController控制器中

添加根据UserId获取User的Claims的接口。

  1.         Authorize(Roles = "AuthServer")]
  2.         [HttpGet("{userId}")]
  3.         public ActionResult<string> Get(string userId)
  4.         {
  5.             var user = context.Users.Where(p => p.UserId == userId)
  6.            .Include(p => p.Claims)
  7.            .FirstOrDefault();
  8.             return Ok(user.ToModel());
  9.         }

（4）修改AuthServer中的Config中GetIdentityResources方法，定义从数据获取的Claims为role的信息。

  1.  public static IEnumerable<IdentityResource> GetIdentityResources()
  2.         {
  3.             var customProfile = new IdentityResource(
  4.                 name: "mvc.profile",
  5.                 displayName: "Mvc profile",
  6.                 claimTypes: new[] { "role" });
  7.             return new List<IdentityResource>
  8.             {
  9.                 new IdentityResources.OpenId(),
  10.                 new IdentityResources.Profile(),
  11.                 //new IdentityResource("roles","role",new List<string>{ "role"}),
  12.                 customProfile
  13.             };
  14.         }

（5）在GetClients中把定义的mvc.profile加到Scope配置

（6）最后记得在Startup的ConfigureServices方法加上

.AddResourceOwnerValidator<ResourceOwnerPasswordValidator>()

.AddProfileService<ProfileService>();

运行后，出现熟悉的About页面（Access Token后面加上去的，源码上有添加方法）

本节介绍的IdentityServer4通过访问接口的形式验证从数据库获取的User信息。当然，也可以写成AuthServer授权服务通过连接数据库进行验证。

另外，授权服务访问资源服务API，用的是ClientCredentials模式（服务与服务之间访问）。

参考博客：https://stackoverflow.com/questions/35304038/identityserver4-register-userservice-and-get-users-from-database-in-asp-net-core

源码地址：https://github.com/Bingjian-Zhu/Mvc-HybridFlow.git

IdentityServer4-从数据库获取User进行授权验证（五）的更多相关文章

  1. IdentityServer4-MVC+Hybrid实现Claims授权验证（四）

    上节以对话形式,大概说了几种客户端授权模式的原理,这节重点介绍Hybrid模式在MVC下的使用.且为实现IdentityServer4从数据库获取User进行验证,并对Claim进行权限设置打下基础( ...

  2. 【从零开始搭建自己的.NET Core Api框架】（四）实战！带你半个小时实现接口的JWT授权验证

    系列目录 一.  创建项目并集成swagger 1.1 创建 1.2 完善 二. 搭建项目整体架构 三. 集成轻量级ORM框架——SqlSugar 3.1 搭建环境 3.2 实战篇:利用SqlSuga ...

  3. ASP.NET Core WebApi基于JWT实现接口授权验证

    一.ASP.Net Core WebApi JWT课程前言 我们知道,http协议本身是一种无状态的协议,而这就意味着如果用户向我们的应用提供了用户名和密码来进行用户认证,那么下一次请求时,用户还要再 ...

  4. 从壹开始前后端分离 [ Vue2.0+.NET Core2.1] 二十四║ Vuex + JWT 实现授权验证登录

    壹周回顾 哈喽,又是元气满满的一个周一,又与大家见面了,周末就是团圆节了,正好咱们的前后端也要团圆了,为什么这么说呢,因为以后的开发可能就需要前后端一起了,两边也终于会师了,还有几天Vue系列就基本告 ...

  5. ASP.NET Core搭建多层网站架构【10-使用JWT进行授权验证】

    2020/01/31, ASP.NET Core 3.1, VS2019, Microsoft.AspNetCore.Authentication.JwtBearer 3.1.1 摘要:基于ASP.N ...

  6. 用Middleware给ASP.NET Core Web API添加自己的授权验证

    Web API,是一个能让前后端分离.解放前后端生产力的好东西.不过大部分公司应该都没能做到完全的前后端分离.API的实现方式有很 多,可以用ASP.NET Core.也可以用ASP.NET Web ...

  7. [转]用Middleware给ASP.NET Core Web API添加自己的授权验证

    本文转自:http://www.cnblogs.com/catcher1994/p/6021046.html Web API,是一个能让前后端分离.解放前后端生产力的好东西.不过大部分公司应该都没能做 ...

  8. yii2 resetful 授权验证

    什么是restful风格的api呢?我们之前有写过大篇的文章来介绍其概念以及基本操作. 既然写过了,那今天是要说点什么吗? 这篇文章主要针对实际场景中api的部署来写. 我们今天就来大大的侃侃那些年a ...

  9. Shrio授权验证详解

    所谓授权,就是控制你是否能访问某个资源,比如说,你可以方位page文件夹下的jsp页面,但是不可以访问page文件夹下的admin文件夹下的jsp页面. 在授权中,有三个核心元素:权限,角色,用户. ...

随机推荐

  1. JavaScript学习 - 基础(八) - DOM 节点 添加/删除/修改/属性值操作

    html代码: <!--添加/删除/修改 --> <div id="a1"> <button id="a2" onclick=&q ...

  2. 搭建yum服务器

    一.yum服务器端配置1.安装FTP软件#yum install vsftpd #service vsftpd start#chkconfig --add vsftpd#chkconfig vsftp ...

  3. win10 + ubuntu双系统详细安装过程

    由于搞深度学习,电脑跟不上,换了一台神舟战神Z8,于是装一个ubuntu双系统,没想到几乎花了一天,还花了80个软妹币找人帮忙,蓝瘦,现在写下来供大家参考: 不得不说,win10 + ubuntu双系 ...

  4. Linux MMC framework2：基本组件之core

    1.前言 本文主要core组件的主要流程,在介绍的过程中,将详细说明和core相关的流程,涉及到其它组件的详细流程再在相关文章中说明. 2.主要数据结构和API TODO 3. 主要流程 3.1 mm ...

  5. 所有Windows7下游戏的全屏问题

    Win键+R键,打开运行窗口,输入regedit 回车,这样就打开了注册表编辑器,然后,定位到以下位置:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ ...

  6. Python3学习笔记15-迭代器与生成器

    生成器 如果创建一个有很多元素的列表,但是只需要访问前几个元素,后面的元素占着的空间就白白浪费了 在循环的过程中不断推算出后续的元素呢?这样就不必创建完整的list,从而节省大量的空间. 在Pytho ...

  7. 006_ssl监测及评分

    https://testssl.sh/ 一. https://www.ssllabs.com/ssltest/analyze.html?d=jyall.com 监测下jyll.com,不忍直视啊! 二 ...

  8. OA系统高性能解决方案(史上最全的通达OA系统优化方案)

    序: 这是一篇针对通达OA系统的整体优化方案,文档将硬件.网络.linux操作系统.程序本身(包括web和数据库)以及现有业务有效结合在一起,进行了系统的整合优化.该方案应用于真实生产环境,部署完成后 ...

  9. Ex 6_18 硬币有限的兑换问题_第七次作业

    子问题定义: 定义一个二维数组b,其中b[i][j]表示前i个币种是否能兑换价格j,表示第i个币种的面值,第i个币种的使用有两种情况,若使用,则b[i][j]=b[i-1][j-],若不使用,则b[i ...

  10. LeetCode（52）：N皇后 II

    Hard! 题目描述: n 皇后问题研究的是如何将 n 个皇后放置在 n×n 的棋盘上,并且使皇后彼此之间不能相互攻击. 上图为 8 皇后问题的一种解法. 给定一个整数 n,返回 n 皇后不同的解决方 ...