asp.net core网关Ocelot的简单介绍& Ocelot集成Identity认证

文章简介

•  Ocelot网关简介

• Ocelot集成Idnetity认证处理

Ocelot网关简介

Ocelot是一个基于netcore实现的API网关，本质是一组按特定顺序排列的中间件。Ocelot内部实现了路由转发，限流，熔断，请求聚合，服务发现（集成consul，eureka等），负载均衡，认证（集成Identity）功能。

这里简单介绍下ocelot的配置文件，也就是说以下图为例，请求地址为localhost:18002/users会被转发到localhost:18000/api/users

更多关于Ocelot的介绍可以看https://www.cnblogs.com/jesse2013/p/net-core-apigateway-ocelot-docs.html这篇博客或者https://ocelot.readthedocs.io/en/latest/index.html官方文档。

Ocelot集成Identity认证

　　这里我们实现一个Ocelot集成Idnetity做认证的Demo；我们这里客户端请求ocelot网关服务，ocelot网关服务集成Idnetity获取token，再通过返回的token请求用户信息服务，如下图所示。这里扩展一个知识点，我们的Identity服务使用扩展认证，这个认证需要实现IExtensionGrantValidator接口的ValidateAsync方法，从http请求上下文中获取自定义参数，获取方法为context.Request.Raw。（oauth2默认的认证方式有password，authcode等，扩展认证文档=》http://docs.identityserver.io/en/latest/topics/extension_grants.html?highlight=IExtensionGrantValidator）

 

首先我们创建三个服务，分别为Ocelot网关服务（端口号设置为18002），Identity认证服务（端口号设置为18001），UserInfo用户信息服务（端口号设置为18000），如下图所示=》

• 首先我们配置User.API服务，这个服务很简单，开放一个返回用户信息的端口，关键代码如下所示 =》

 namespace User.API.Controllers
 {
     [Route("api/users")]
     public class UserController : BaseController
     {
         private readonly UserContext _userContext;
         private ILogger<UserController> _logger;
         public UserController(UserContext userContext, ILogger<UserController> logger)
         {
             _userContext = userContext;
             _logger = logger;
         }
         [HttpGet]
         public async Task<IActionResult> Get()
 
         {
             var user = await _userContext.Set<AppUser>()
                 .AsNoTracking()
                 .Include(u => u.userProperties)
                 .FirstOrDefaultAsync(t => t.Id == );
             if (user == null)
             {
                 _logger.LogError("登录用户为空");
                 throw new UserOperationException("用户登录异常");
             }
             return Json(user);
         }
 ..... other

User.Api

         [Route("check_or_create")]
         [HttpPost]
         public async Task<IActionResult> CheckOrCreate(string phone)
         {
             var user = await _userContext.Users.SingleOrDefaultAsync(u => u.Phone == phone);
 
             if (user == null)
             {
                 user = new AppUser { Phone = phone };
                 _userContext.Users.Add(new AppUser { Phone = phone });
                 await _userContext.SaveChangesAsync();
             }
             return Ok(new {
                 user.Id,
                 user.Name,
                 user.Company,
                 user.Title,
                 user.Avatar
             });
         }

User.Api 验证用户手机号，返回用户信息

• 然后配置我们的Identity认证服务，引入IdnttiyServer4 nuget包，添加Ids4配置文件Config.cs。注意：这里的client_grant_type为sms_auth_code

     public class Config
     {
         public static IEnumerable<Client> GetClients()
         {
             return new List<Client>{
                 new Client{
                     ClientId = "android",
                     ClientSecrets = new List<Secret>
                     {
                         new Secret("secret".Sha256())
                     },
                     RefreshTokenExpiration  = TokenExpiration.Sliding,
                     AllowOfflineAccess = true,
                     RequireClientSecret = false,
                     AllowedGrantTypes = new List<string>{"sms_auth_code"},
                     AlwaysIncludeUserClaimsInIdToken = true,
                     AllowedScopes = new List<string>
                     {
                         "gateway_api",
                         IdentityServerConstants.StandardScopes.OfflineAccess,
                         IdentityServerConstants.StandardScopes.OpenId,
                         IdentityServerConstants.StandardScopes.Profile
                     }
                 }
             };
         }
         public static IEnumerable<IdentityResource> GetIdentityResources()
         {
             return new List<IdentityResource>
             {
                 new IdentityResources.OpenId(),
                 new IdentityResources.Profile()
             };
         }
         public static IEnumerable<ApiResource> GetApiResources()
         {
             return new List<ApiResource>
             {
                 new ApiResource("gateway_api","user service")
             };
         }
     }

Config

　　编写我们的自定义自定义验证服务类，我们验证客户端传入的手机号&验证码是否正确（Demo逻辑中只需要填写正确手机号就可以了）

     public class SmsAuthCodeGrantType : IExtensionGrantValidator
     {
         private IUserService _userService;
         private IAuthCodeService _authCodeService;
         public SmsAuthCodeGrantType(IUserService userService, IAuthCodeService authCodeService)
         {
             _userService = userService;
             _authCodeService = authCodeService;
         }
         public string GrantType => "sms_auth_code";
         /// <summary>
         ///
         /// </summary>
         /// <param name="context"></param>
         /// <returns></returns>
         public async Task ValidateAsync(ExtensionGrantValidationContext context)
         {
             var phone = context.Request.Raw["phone"];
             var code = context.Request.Raw["auth_code"];
             var errorValidationResult = new GrantValidationResult(TokenRequestErrors.InvalidGrant);
 
             if (string.IsNullOrWhiteSpace(phone) || string.IsNullOrWhiteSpace(code))
             {
                 context.Result = errorValidationResult;
                 return;
             }
             //检查验证码
             if (!_authCodeService.Validate(phone, code))
             {
                 context.Result = errorValidationResult;
                 return;
             }
             //完成用户注册
             var userinfo = await _userService.CheckOrCreate(phone);
             if (userinfo== null)
             {
                 context.Result = errorValidationResult;
                 return;
             }
             var claims = new Claim[]
             {
                 new Claim("name",userinfo.Name??string.Empty),
                 new Claim("company",userinfo.Company??string.Empty),
                 new Claim("title",userinfo.Tiltle??string.Empty),
                 new Claim("avatar",userinfo.Avatar??string.Empty),
             };
             context.Result = new GrantValidationResult(userinfo.Id.ToString(),
                 GrantType,
                 claims);
         }
     }

SmsAuthCodeGrantType

　　其他的验证服务和与User.API服务通信的服务类和返回的UserInfoDto

     public class UserInfo
     {
         public int Id { get; set; }
         public string Name { get; set; }
         public string Company { get; set; }
         public string Tiltle { get; set; }
         public string Avatar { get; set; }
     }

UserInfo

     public interface IAuthCodeService
     {
         /// <summary>
         /// 根据手机号验证验证码
         /// </summary>
         /// <param name="phone"></param>
         /// <param name="authCode"></param>
         /// <returns></returns>
         bool Validate(string phone, string authCode);
     }

IAuthCodeService

     public class TestAuthCodeService : IAuthCodeService
     {
         public bool Validate(string phone, string authCode)
         {
             return true;
         }
     }

TestAuthCodeService

     public interface IUserService
     {
         /// <summary>
         /// 检查手机号是否注册，未注册就注册
         /// </summary>
         /// <param name="phone"></param>
         Task<UserInfo> CheckOrCreate(string phone);
     }

IUserService

     public class UserService : IUserService
     {
         private HttpClient _httpClient;
         private string _userServiceUrl = "http://localhost:18000";
         public UserService(HttpClient httpClient)
         {
             _httpClient = httpClient;
         }
 
         public async Task<UserInfo> CheckOrCreate(string phone)
         {
             var from = new Dictionary<string, string>
             {
                 { "phone",phone }
             };
             var content = new FormUrlEncodedContent(from);
             var response = await _httpClient.PostAsync(_userServiceUrl + "/api/users/check_or_create", content);
             if (response.StatusCode == System.Net.HttpStatusCode.OK)
             {
                 var result = await response.Content.ReadAsStringAsync();
                 var userinfo = JsonConvert.DeserializeObject<UserInfo>(result);
 
                 //int.TryParse(userId,out int UserIdInt);
                 return userinfo;
             }
             return null;
         }
     }

UserService

　　配置Startup，注意要在我们的DI容器中注入自定义服务验证类（SmsAuthCodeGrantType）

     public class Startup
     {
         public Startup(IConfiguration configuration)
         {
             Configuration = configuration;
         }
 
         public IConfiguration Configuration { get; }
 
         // This method gets called by the runtime. Use this method to add services to the container.
         public void ConfigureServices(IServiceCollection services)
         {
             services.AddMvc();
             services.AddIdentityServer()
                 .AddExtensionGrantValidator<SmsAuthCodeGrantType>()
                 .AddDeveloperSigningCredential()
                 .AddInMemoryClients(Config.GetClients())
                 .AddInMemoryIdentityResources(Config.GetIdentityResources())
                 .AddInMemoryApiResources(Config.GetApiResources());  //identityserver 认证
 
             services.AddScoped<IAuthCodeService, TestAuthCodeService>()
                 .AddScoped<IUserService, UserService>();
             services.AddSingleton(new HttpClient());
         }
 
         // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
         public void Configure(IApplicationBuilder app, IHostingEnvironment env)
         {
             if (env.IsDevelopment())
             {
                 app.UseDeveloperExceptionPage();
             }
             app.UseIdentityServer();
             app.UseMvc();
         }
     }

Startup

• 最后配置我们的网关Ocelot站点，首先添加nuget包IdentityServer4.AccessTokenValidation和Ocelot。添加配置文件ocelot.json,其实就是博客开头的配置文件截图,这里特别说明下AuthenticationOptions节点，AuthenticationOptions是ocelot集成Identity所需要配置节点，AuthenticationProviderKey需要跟startup的authenticationScheme匹配

 {
   "ReRoutes": [
     {
       "DownstreamPathTemplate": "/api/users",
       "DownstreamScheme": "http",
       "DownstreamHostAndPorts": [
         {
           "Host": "localhost",
           "Port":
         }
       ],
       "UpstreamPathTemplate": "/users",
       "UpstreamHttpMethod": [ "Get" ],
       "AuthenticationOptions": {
         "AuthenticationProviderKey": "finbook",
         "AllowedScopes": []
       }
     },
     {
       "DownstreamPathTemplate": "/connect/token",
       "DownstreamScheme": "http",
       "DownstreamHostAndPorts": [
         {
           "Host": "localhost",
           "Port":
         }
       ],
       "UpstreamPathTemplate": "/connect/token",
       "UpstreamHttpMethod": [ "Post" ]
     }
   ],
   "GlobalConfiguration": {
     "BaseUrl": "http://localhost:18002"
   }
 }

ocelot.json

将配置文件加载到服务中，修改Program的CreateWebHostBuilder方法

     public class Program
     {
         public static void Main(string[] args)
         {
             CreateWebHostBuilder(args).Build().Run();
         }
 
         public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
             WebHost.CreateDefaultBuilder(args)
                 .UseStartup<Startup>()
                 .UseContentRoot(Directory.GetCurrentDirectory())
                 .ConfigureAppConfiguration((hostingContext, config) =>
                 {
                     config
                        .SetBasePath(hostingContext.HostingEnvironment.ContentRootPath)
                        //.AddJsonFile("appsettings.json", true, true)
                        //.AddJsonFile($"appsettings.{hostingContext.HostingEnvironment.EnvironmentName}.json", true, true)
                        .AddJsonFile("ocelot.json")
                        .AddEnvironmentVariables();
                 })
                 .UseUrls("http://+:18002");
     }

Program

配置startup，在DI容器中加入Identity自定义认证，加入Ocelot，启用Ocelot中间件

     public class Startup
     {
         public Startup(IConfiguration configuration)
         {
             Configuration = configuration;
         }
 
         public IConfiguration Configuration { get; }
 
         // This method gets called by the runtime. Use this method to add services to the container.
         public void ConfigureServices(IServiceCollection services)
         {
             services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);
             //添加 认证信息
             var authenticationProviderKey = "finbook";
             services.AddAuthentication()
                 .AddIdentityServerAuthentication(authenticationProviderKey, options =>
                 {
                     options.Authority = "http://localhost:18001";
                     options.ApiName = "gateway_api";
                     options.SupportedTokens = IdentityServer4.AccessTokenValidation.SupportedTokens.Both;
                     options.ApiSecret = "secret";
                     options.RequireHttpsMetadata = false;
                 });
             services.AddOcelot();
         }
 
         // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
         public void Configure(IApplicationBuilder app, IHostingEnvironment env)
         {
             if (env.IsDevelopment())
             {
                 app.UseDeveloperExceptionPage();
             }
             else
             {
                 // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                 app.UseHsts();
             }
             //app.UseAuthentication();
             app.UseOcelot(); //.Wait()
             app.UseHttpsRedirection();
             app.UseMvc();
         }
     }

Startup

• 验证运行

首先获取token，访问ocelot网关的/connect/token地址，转发到Idnetity服务，注意下grant_type参数要和Identity服务中的配置相同

接下来根据获取到的token，请求用户信息

Demo地址=》https://github.com/madeinchinalmc/User.Api