c# - 如何在移动应用程序上进行身份验证后在 .NET Core 服务器上登录用户

Question

我在 .NET Core Web API 应用身份验证方面遇到了问题。我想要:1) 在移动应用程序(目前为 iOS)上使用 Google 对用户进行身份验证2) 使用此身份验证，使用 AspNetCore.Identity 和 Entity Framework Core 在数据库中创建用户记录3) 使用相同的身份验证，从 .NET Core 服务器调用 Google Calendar API

到目前为止，我已经弄清楚如何实现 1 和 3，但无法理解第 2 点。

我的理解是，由于文档原因，要登录第三方认证的用户，您需要使用 SignInManager 实例方法 ExternalLoginSignInAsync .它需要两个参数:login provider(应该是简单的“Google”)和唯一的provider key。我的问题是我找不到任何可以买到的地方。

以下是我在移动应用程序上从 Google 登录结果中收到的所有内容的列表:

这是我尝试调用的方法。

// POST api/signup
    [HttpPost]
    public async Task<bool> Post([FromBody]string authorizationCode, [FromBody]string userId)
    {
        var tokenFromAuthorizationCode = await GetGoogleTokens(userId, authorizationCode);
        var result = await signInManager.ExternalLoginSignInAsync(
            "Google", tokenFromAuthorizationCode.IdToken, false);
        if (result.Succeeded)
            return true;

        var externalLoginInfo = new ExternalLoginInfo(
            ClaimsPrincipal.Current, "Google", tokenFromAuthorizationCode.IdToken, null);
        return await SignInUser(externalLoginInfo);
    }

    private async Task<bool> SignInUser(ExternalLoginInfo info)
    {
        var newUser = new AppUser { Email = "test@test.com", UserName = "TestUser" };
        var identResult = await userManager.CreateAsync(newUser);
        if (identResult.Succeeded)
        {
            identResult = await userManager.AddLoginAsync(newUser, info);
            if (identResult.Succeeded)
            {
                await signInManager.SignInAsync(newUser, false);
                return true;
            }
        }

        return false;
    }

    private async Task<TokenResponse> GetGoogleTokens(string userId, string authorizationCode)
    {
        TokenResponse token;
        try
        {
            // TODO: Save access and refresh token to AppUser object
            token = await authFlow.Flow.ExchangeCodeForTokenAsync(
                userId, authorizationCode, "http://localhost:60473/signin-google", CancellationToken.None);
        }
        catch (Exception e)
        {
            Console.WriteLine(e);
            throw;
        }

        return token;
    }

我的问题是:如果您通过 REST API 构建身份验证，这是正确的路径吗？如果是，我从哪里可以获得 Google 的提供商 key ？提前致谢。

Answer 1

显然，provider key 只是来自 Google 的user id。这是对我有用的解决方案:

       [HttpPost]
    public async Task<AppUser> Post([FromBody]GoogleSignInCredentials credentials)
    {
        // 1. get user id from idToken
        var oauthService = new Oauth2Service(new BaseClientService.Initializer { ApiKey = "{your api key}" });
        var tokenInfoRequest = oauthService.Tokeninfo();
        tokenInfoRequest.IdToken = credentials.IdToken;
        var userInfo = await tokenInfoRequest.ExecuteAsync();

        // 2. get access_token and refresh_token with new id and authorization code
        var tokenFromAuthorizationCode = await GetGoogleTokens(userInfo.UserId, credentials.AuthorizationCode);

        // 3. check if user exists
        var result = await _signInManager.ExternalLoginSignInAsync(
            "Google", userInfo.UserId, false);
        if (result.Succeeded)
            return await _userManager.FindByEmailAsync(userInfo.Email); 

        // 4. create user account
        var externalLoginInfo = new ExternalLoginInfo(
            ClaimsPrincipal.Current, "Google", userInfo.UserId, null);

        // 5. fetch user
        var createdUser = await SignInUser(externalLoginInfo, userInfo.Email);
        if (createdUser != null)
        {
            createdUser.GoogleAccessToken = tokenFromAuthorizationCode.AccessToken;
            createdUser.GoogleRefreshToken = tokenFromAuthorizationCode.RefreshToken;
            var updateResult = await _userManager.UpdateAsync(createdUser);
            if (updateResult.Succeeded)
                return createdUser;

            return null;
        }

        return null;
    }

    private async Task<AppUser> SignInUser(ExternalLoginInfo info, string email)
    {
        var newUser = new AppUser { Email = email, UserName = email };
        var identResult = await _userManager.CreateAsync(newUser);
        if (identResult.Succeeded)
        {
            identResult = await _userManager.AddLoginAsync(newUser, info);
            if (identResult.Succeeded)
            {
                await _signInManager.SignInAsync(newUser, false);
                return await _userManager.FindByEmailAsync(email);
            }
        }

        return null;
    }

    private async Task<TokenResponse> GetGoogleTokens(string userId, string authorizationCode)
    {
        return await _authFlow.Flow.ExchangeCodeForTokenAsync(
                userId, authorizationCode, "http://localhost:60473/signin-google", CancellationToken.None);
    }