asp.net-core - 用于授权和身份验证的多个 JWT 承载

Question

我有一个用于 SSO 的 .NET Core IdentityServer (IS)，我想用它来对我的 .NET Core(后端)-Angular(客户端)应用程序进行身份验证。我希望在后端有一个 EF ApplicationUser，并通过自定义后端生成的 JWT token 在后端进行基于声明的授权，该 token 也适用于客户端上的授权。

在后端，我创建了一个中间件来检查所有请求的“授权” header 。如果 header 包含由 IS 生成的 token ，我想将其交换为包含必要声明的自定义(后端)生成的 token 。然后，客户端使用此 header 来向后端发出后续请求。

启动配置:

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
   app.UseMiddleware<AuthorizationHeaderMiddleware>();
   app.UseAuthentication();
   app.UseStaticFiles();
   app.UseMvc();
}

public void ConfigureServices(IServiceCollection services)
{
   services.AddAuthentication(DEFAULT_AUTH_SCHEME)
        .AddJwtBearer(DEFAULT_AUTH_SCHEME, cfg =>
          {
                cfg.Audience = Configuration["Authorization:JwtIssuer"];
                cfg.RequireHttpsMetadata = false;
                cfg.TokenValidationParameters = new TokenValidationParameters
                    {
                    RequireSignedTokens = false,
                    ValidateIssuer = false,
                    ValidateLifetime = false,
                    ValidateIssuerSigningKey = false,
                    ValidIssuer = Configuration["Authorization:JwtIssuer"],
                    ValidAudience = Configuration["Authorization:JwtIssuer"],
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["Authorization:JwtKey"])),
                    RequireExpirationTime = false,
                    ClockSkew = TimeSpan.Zero // remove delay of token when expire
                };
          })
       .AddIdentityServerAuthentication(JwtBearerDefaults.AuthenticationScheme, options =>
             {
                 options.Authority = Configuration["IdentityServer:Url"];
                 options.RequireHttpsMetadata = false;
                 options.ApiName = Configuration["IdentityServer:ApiName"];
                 options.SupportedTokens = SupportedTokens.Both;
                 options.SaveToken = false;
                 options.EnableCaching = false; 
                 options.CacheDuration = TimeSpan.FromMinutes(10);
             });

    services.AddAuthorization(options =>
        options.AddPolicy("protectedScope", policy =>
        {
            policy.AuthenticationSchemes = new List<string> { DEFAULT_AUTH_SCHEME };
            policy.RequireAuthenticatedUser();
            policy.RequireClaim("someclaim");
        }));
}

AuthorizationHeaderMiddleware.cs:

    public class AuthorizationHeaderMiddleware
    {
        private RequestDelegate _next;
        private readonly IConfiguration _configuration;   

        public AuthorizationHeaderMiddleware(RequestDelegate next, IConfiguration configuration)
        {
            _configuration = configuration;
            _next = next;
        }

        public async Task Invoke(HttpContext context)
        {
            // here I intend to get user from the (backend) DB based on "sub" claim from IdentityServer's token and set users claims from DB. Is this correct attitude?
            var claims = new List<Claim> { new Claim("someclaim", "aaaa") };
            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["Authorization:JwtKey"]));
            var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
            var token = new JwtSecurityToken(
                _configuration["Authorization:JwtIssuer"],
                _configuration["Authorization:JwtIssuer"],
                claims,
                signingCredentials: creds
            );

            var tokenGenerated = new JwtSecurityTokenHandler().WriteToken(token);
            context.Request.Headers["Authorization"] = $"{DEFAULT_AUTH_SCHEME} {tokenGenerated}";

            await _next.Invoke(context);
        }

TestController.cs

    [Authorize(Policy = "protectedScope", AuthenticationSchemes = DEFAULT_AUTH_SCHEME)]
    public class TestController
    {
        [HttpGet]
        public IActionResult TestAction()
        {
            return Ok();
        }
    }

如果我在 TestController 中请求测试操作，我会收到 401 Unauthorized。

我在这里做错了什么？

这不是 Use multiple JWT Bearer Authentication 的重复项问题，因为我已经尝试过这个答案，但没有成功。另外，这是一个不同的情况，因为我想使用 IdentityServer 进行身份验证，使用后端 JWT 进行授权。

Answer 1

您只能使用IdentityServerAuthentication，并在成功进行身份验证后将声明从应用程序用户添加到当前用户。您可以使用 OnTokenValidated 来做到这一点

services.AddAuthentication()
        .AddIdentityServerAuthentication(DEFAULT_AUTH_SCHEME, options =>
        {
            options.Authority = Configuration["IdentityServer:Url"];
            options.RequireHttpsMetadata = false;
            options.ApiName = Configuration["IdentityServer:ApiName"];
            options.SupportedTokens = SupportedTokens.Both;
            options.SaveToken = false;
            options.EnableCaching = false;
            options.CacheDuration = TimeSpan.FromMinutes(10);
            options.JwtBearerEvents.OnTokenValidated = async context =>
            {
                // get subject from authenticated principal
                var subject = context.Principal.FindFirst("sub");

                // get claims from your database for the subject
                var claims = new List<Claim> { new Claim("someclaim", "aaaa") };

                // change the principal
                context.Principal = new System.Security.Claims.ClaimsPrincipal(claims);
            };
        });