oauth-2.0 - 客户端凭据流的访问 token 中的 invalid_scope 错误

Question

我在客户端凭据流的访问 token 请求中收到 invalid_scope 错误。错误日志指出“无法在客户端凭据流中请求 OpenID 范围”。我没有要求开放 id 范围。我不知道它是从哪里来的。我需要使用客户端凭据流生成访问 token 。

问题/重现问题的步骤

API 资源定义。

public IEnumerable GetApiResources()
{
    return new List {
        new ApiResource
        {
            Name = "WidgetApi",
            DisplayName = "Widget Management API",
            Description = "Widget Management API Resource Access",
            ApiSecrets = new List { new Secret("scopeSecret".Sha256()) },
            Scopes = new List {
                new Scope("WidgetApi.Read"),
                new Scope("WidgetApi.Write")
            }
        }
     };
}

客户定义；

return new List
{
    new Client
    {
        ClientId = "WidgetApi Client Id",
        ClientName = "WidgetApi Client credential",
        RequireConsent = false,
        AllowedGrantTypes = GrantTypes.ClientCredentials,
        ClientSecrets =
        {
            new Secret( clientSecret.Sha256())
        },
       // scopes that client has access to
       AllowedScopes = { "WidgetApi.Read", "WidgetApi.Write"},
       AccessTokenLifetime = 3600
   };
}

使用 postman 访问 token 请求正文(键 - 值)

grant_type  client_credentials
response_type  id_token
scope  WidgetApi.Read WidgetApi.Write
client_secret  xxxxxxxxxxxxxxxxxxxxxx
client_id  WidgetApiClientId

日志文件的相关部分

dbug: Microsoft.EntityFrameworkCore.Storage.Internal.SqlServerConnection[4]
Closing connection to database 'IdentityServer4Db' on server 'localhost\SQLEXPRESS'.
dbug: IdentityServer4.EntityFramework.Stores.ResourceStore[0]
Found PssUserMgtApi.Read, PssUserMgtApi.Write API scopes in database
fail: IdentityServer4.Validation.TokenRequestValidator[0]
xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx cannot request OpenID scopes in client credentials flow
fail: IdentityServer4.Validation.TokenRequestValidator[0]

{
        "ClientId": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
        "ClientName": "xxxxxxxxxxxxxxxxxxxxxxxxx",
        "GrantType": "client_credentials",
        "Scopes": "xxxxxxxxxx.Read xxxxxxxxxxxxx.Write",
        "Raw": {
            "grant_type": "client_credentials",
            "response_type": "id_token",
            "scope": "xxxxxxxxxxxx.Read xxxxxxxxxxxxx.Write",
            "client_secret": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
            "client_id": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
        }
 }

info: Microsoft.AspNetCore.Hosting.Internal.WebHost[2]
Request finished in 5292.2873ms 400 application/json
dbug: Microsoft.AspNetCore.Server.Kestrel[9]
Connection id "0HL51IVGKG792" completed keep alive response.

Answer 1

由于客户端凭据流中没有用户标记，因此通常情况下，客户端凭据不打算为其标记范围，并且许多框架不支持它。

https://www.oauth.com/oauth2-servers/access-tokens/client-credentials/说:

范围(可选) :
您的服务可以支持客户端凭据授予的不同范围。 在实践中，实际上支持这一点的服务并不多。