oauth-2.0 - 如何在 IdentityServer 中启用滑动过期

Question

我正在使用 IdentityServer3 进行身份验证，并且我有 ASP.NET MVC 应用程序作为客户端。我想设置身份验证 cookie 的滑动到期。

因此，只要用户在客户端应用程序中积极地做某事，他就应该登录。如果他保持非事件状态(浏览器打开)超过 120 分钟，然后尝试使用客户端应用程序，那么他应该被重定向到登录页面。

在 IdentityServer3 的 IdentityServerOptions 中有很多与滑动过期相关的设置以及客户端应用程序的CookieAuthenticationOptions和 OpenIdConnectAuthenticationOptions
在身份服务器上，我有以下配置

app.Map("/identity", idsrvApp =>
            {
                idsrvApp.UseIdentityServer(new IdentityServerOptions
                {
                    SiteName = "Login",
                    SigningCertificate = LoadCertificate(),
                    RequireSsl = true,
                    Factory = new IdentityServerServiceFactory()
                        .Configure(),
                    AuthenticationOptions = new AuthenticationOptions()
                    {
                        CookieOptions = new CookieOptions()
                        {
                            AllowRememberMe = false,
                            SlidingExpiration = true                            
                        }
                    }
                    .Configure(ConfigureIdentityProviders),
                    EventsOptions = new EventsOptions().Configure(),
                    EnableWelcomePage = ApplicationConfig.EnableWelcomePage                    
                });
            });
        }

我设置了 Client.IdentityTokenLifetime至 7200秒

在客户端应用程序中，我具有以下配置

var cookieOptions = new CookieAuthenticationOptions
            {
                AuthenticationType = "Cookies",
                LoginPath = new Microsoft.Owin.PathString("/Home"),
                SlidingExpiration = true                
            };

var openIdOptions = new OpenIdConnectAuthenticationOptions
            {
                Authority = ConfigurationManager.AppSettings["id:Authority"],
                Scope = "openid email profile",
                ClientId = "XXXXXXXXX",
                RedirectUri = "http://localhost/Home",
                ResponseType = "id_token",
                SignInAsAuthenticationType = "Cookies",
                UseTokenLifetime = true,                
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    SecurityTokenValidated = (context) =>
                    {
                         // do something
                    },

                    RedirectToIdentityProvider = (context) =>
                    {
                            // do something
                    },

                    AuthenticationFailed = context =>
                    {
                        // do something
                    }
                }
            };

            app.UseCookieAuthentication(cookieOptions);
            app.UseOpenIdConnectAuthentication(openIdOptions);

请注意，我已设置 UseTokenLifetime至 true因此 cookie 超时将与 Client.IdentityTokenLifetime 对齐

问题
即使用户活跃了 120 分钟，他也会在 120 分钟后退出。

我还需要做什么才能启用滑动到期？

(我已经在 SO 和 IdentityServer 的论坛上浏览过几篇文章，但没有人给出具体答案)

Answer 1

@thunk 让我在这里走上了正确的道路，他的回答基本上是为我解决了这个问题，让我知道要搜索什么以获得理解。我只是想“添加到它”，希望它能帮助其他人。

我花了相当多的时间试图弄清楚这一点，并且由于样本和文档中缺乏解释而变得更加复杂。如果您通过 MVC Getting Started对于 IdentityServer3，他们偷偷摸摸 UseTokenLifetime设置在您身上(示例代码的中途)，而没有提及他们添加它或它的用途。起初，他们使用以下代码(在 MVC 应用程序的 Startup.cs 中):

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    Authority = "https://localhost:44319/identity",
    ClientId = "mvc",
    RedirectUri = "https://localhost:44319/",
    ResponseType = "id_token",

    SignInAsAuthenticationType = "Cookies"
});

后来他们潜入 UseTokenLifetime :

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    Authority = "https://localhost:44319/identity",

    ClientId = "mvc",
    Scope = "openid profile roles",
    RedirectUri = "https://localhost:44319/",
    ResponseType = "id_token",

    SignInAsAuthenticationType = "Cookies",
    UseTokenLifetime = false,

    // other stuff continues...
});

当我阅读教程并输入我自己的代码时，我错过了 UseTokenLifetime = false被偷偷溜进来，他们没有提到它已经完成，或者为什么它完成了。

这是 nice bit of info I found这证实了我不是唯一一个有这种困惑的人，并更好地解释了正在发生的事情

For posterity, what I found most confusing about this was that I can set a cookie lifetime in my cookie options:

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
   ...
    ExpireTimeSpan = new TimeSpan(4, 0, 0),
    SlidingExpiration = true,
}); 

But if I don't know to override the OIDC defaults, that ExpireTimeSpan is ignored/overwritten.

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions    
{
    ...
    UseTokenLifetime = false, // have to know to do this for ExpireTimeSpan to be respected
    ...    
}); 

That behavior seems incredibly opaque to me. Not sure if it could be helped by different naming, or what, but it seems like it will be a common misunderstanding in practice, though I don't profess to understand the majority of use cases.

作为旁注， MSDN on the UseTokeLifetime property (我什至可以在此属性上找到任何文档的唯一地方!!!)太可怕了:

Indicates that the authentication session lifetime (e.g. cookies) should match that of the authentication token. If the token does not provide lifetime information then normal session lifetimes will be used. This is enabled by default.

不知道他们为什么不出来说 token 生命周期信息将覆盖正常的 session 时间。

所有这一切都回到了我仍然不明白的地方......根据我所读到的，cookie 的生命周期与 cookie 内的身份验证票证的有效性或到期没有任何关系.换句话说，您不能只查看 cookie 上的过期时间来了解您的身份验证何时过期。我无法理解 CookieAuthenticationOptions 中的设置实际上并不控制 cookie 的过期时间，它们控制嵌入式身份验证票的过期时间。来自 this blog post :

.AddCookie(options =>
{
    // Configure the client application to use sliding sessions
    options.SlidingExpiration = true;
    // Expire the session of 15 minutes of inactivity
    options.ExpireTimeSpan = TimeSpan.FromMinutes(15);
})

When I first configured this, I wrongly assumed that this would set the expiration of the cookie itself, as reflected in the browsers development tools. However, this is in fact a setting of the ticket that is stored inside the cookie, not of the cookie itself. It is this ticket that is evaluated by the MVC client whenever a request is handled. This ticket determines the validity of the users authentication session.

TL;博士

如果 UseTokenLifetime未设置或设置为 true，那么只要您的 id_token 有效(默认 5 分钟)，您的身份验证票证就有效。

如果 UseTokenLifetime设置为 false，那么您的 CookieAuthenticationOptions设置接管，即 ExpireTimeSpan和 SlidingExpiration .

无论如何，希望这个答案可以帮助其他人获得启发。