docker - 如何使 Identityserver 重定向到我的网络应用程序？

Question

我正在尝试将 Identity Server 4 与 Ocelot 集成并对 WebApp (asp.net core 3.1) 进行身份验证，然后在请求通过身份验证时访问 api。

为此我创建了一个解决方案

• 网关- Ocelot(最新)
• IdentityService - Identity Server 4(最新)
• 示例 API(asp.net core 3.1 网络 api)
• WebApp(asp.net core 3.1 网络应用程序)

我已将 [Authorize] 属性添加到 webapp 的 homecontroller 中的一个操作方法。

以上都在 docker compose 中运行。

我能做什么

• 通过网关打api
• 运行 web APP 并查看 UI
• WellKnown 端点及其来自 IdentityService 的响应
• IdentityService 正在重定向浏览器登录页面

我做不到的

• 在登录页面上，当我使用 bob/bob 登录时，它保持相同的登录页面。
• 我调试了登录方法，发现用户已成功验证，最后它创建了一个重定向 URL，如下所示

/connect/authorize/callback?client_id=MS.UI&redirect_uri=http%3A%2F%2Flocalhost%3A5003%2Fsignin-oidc&response_type=code%20id_token&scope=openid%20sampleapi.read%20offline_access&response_mode=form_post&nonce=637311085925185701.MDBmN2IyNGYtYmJkNC00ODYxLWI4YTktZGZkNmUwOGNlOTI1ZTEzM2NjYjUtZjFmNC00OWFlLWJjODItNzdiZjI4MzU5OWYy&state=CfDJ8Lknm9JCWslNlbQ0xWa8fYKwi1rc-EosZtMFuCBrWuQouhK03IW5FLqKl2zjaMjUGbpl8INF4Ro2mtbe1ZODEBX8kKMi6IbHd1Dcfft9jeTCfSUBGigFm_f3vqHnGnc7TkAs_9BiFUlYNs0Cbc1xNNIXteRlLVo_aYqXzJMtnL_ZY8bk0AadRj8fx50rMDq68XVQ6tqYbx_MCAya5DGljux3UyDz8nAuS27dWoUI1hsUJ3SFC61iLqe7HHMDRyIOc3puZoDXnJOeR36xDuLiFQk8yXfmQ3L7SCNm63ZcJBGnMpZyLiUgZA-T2iBDzDriEw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=5.5.0.0

身份服务配置.cs

// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.


using IdentityServer4;
using IdentityServer4.Models;
using System.Collections.Generic;

namespace IdentityServer
{
    public static class Config
    {
        private const string SampleAPI_Secret = "tT1CCYyY7P";
        public static IEnumerable<IdentityResource> IdentityResources =>
            new IdentityResource[]
            { 
                new IdentityResources.OpenId()
            };

        public static IEnumerable<ApiScope> ApiScopes =>
            new ApiScope[]
            { 
                new ApiScope("sampleapi.read","Read your data"),
                new ApiScope("sampleapi.write","Write your data"),
                new ApiScope("sampleapi.delete","Delete your data")
            };

        public static IEnumerable<ApiResource> ApiResources =>
             new List<ApiResource>
            {
                new ApiResource("sampleAPI", "Sample API"){
                    Scopes = { "sampleapi.read", "sampleapi.write", "sampleapi.delete" },
                }
            };
        

        public static IEnumerable<Client> Clients =>
            new Client[] 
            {
                new Client(){ 
                    ClientId = "MS.UI",
                    AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
                    AllowOfflineAccess = true,
                    ClientSecrets = { new Secret("z71C0PyDjR".Sha256()) },
                    RedirectUris ={"http://localhost:5003/signin-oidc" },
                    PostLogoutRedirectUris = { "http://localhost:5003"},
                    FrontChannelLogoutUri = "http://localhost:5003/signout-oidc",
                    AllowedScopes = {
                        IdentityServerConstants.StandardScopes.OpenId,
                        IdentityServerConstants.StandardScopes.Profile,
                        IdentityServerConstants.StandardScopes.Email,
                        "sampleapi.read",
                        "sampleapi"
                    },
                    AllowAccessTokensViaBrowser = true,
                    RequirePkce =false
                },
            
            };
    }
}

启动.cs

// Copyright (c) Brock Allen & Dominick Baier. All rights reserved.
// Licensed under the Apache License, Version 2.0. See LICENSE in the project root for license information.


using IdentityServer4;
using IdentityServer4.Models;
using System.Collections.Generic;

namespace IdentityServer
{
    public static class Config
    {
        private const string SampleAPI_Secret = "tT1CCYyY7P";
        public static IEnumerable<IdentityResource> IdentityResources =>
            new IdentityResource[]
            { 
                new IdentityResources.OpenId()
            };

        public static IEnumerable<ApiScope> ApiScopes =>
            new ApiScope[]
            { 
                new ApiScope("sampleapi.read","Read your data"),
                new ApiScope("sampleapi.write","Write your data"),
                new ApiScope("sampleapi.delete","Delete your data")
            };

        public static IEnumerable<ApiResource> ApiResources =>
             new List<ApiResource>
            {
                new ApiResource("sampleAPI", "Sample API"){
                    Scopes = { "sampleapi.read", "sampleapi.write", "sampleapi.delete" },
                }
            };
        

        public static IEnumerable<Client> Clients =>
            new Client[] 
            {
                new Client(){ 
                    ClientId = "MS.UI",
                    AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
                    AllowOfflineAccess = true,
                    ClientSecrets = { new Secret("z71C0PyDjR".Sha256()) },
                    RedirectUris ={"http://localhost:5003/signin-oidc" },
                    PostLogoutRedirectUris = { "http://localhost:5003"},
                    FrontChannelLogoutUri = "http://localhost:5003/signout-oidc",
                    AllowedScopes = {
                        IdentityServerConstants.StandardScopes.OpenId,
                        IdentityServerConstants.StandardScopes.Profile,
                        IdentityServerConstants.StandardScopes.Email,
                        "sampleapi.read",
                        "sampleapi"
                    },
                    AllowAccessTokensViaBrowser = true,
                    RequirePkce =false
                },
            
            };
    }
}

MS.UI - 网络应用客户端

启动.cs

using System;
using System.Collections.Generic;
using System.IdentityModel.Tokens.Jwt;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.AspNetCore.Authentication;

using IdentityModel;
using Microsoft.AspNetCore.Http;

namespace MS.UI
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.Configure<CookiePolicyOptions>(options=> {
                options.CheckConsentNeeded = context => true;
                options.MinimumSameSitePolicy = SameSiteMode.None;
            });
            services.AddControllersWithViews();
            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
            services.AddAuthentication(options =>
            {
                Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;
                options.DefaultScheme = "Cookies";
                options.DefaultChallengeScheme = "oidc";
            }).AddCookie("Cookies")
               .AddOpenIdConnect("oidc", options =>
                {
                    options.Authority = "http://localhost:5002";
                    options.MetadataAddress = "http://identityserver/.well-known/openid-configuration";
                    options.RequireHttpsMetadata = false;
                    options.Events.OnRedirectToIdentityProvider = context =>
    {
                        // Intercept the redirection so the browser navigates to the right URL in your host
                        context.ProtocolMessage.IssuerAddress = "http://localhost:5002/connect/authorize";
                        return Task.CompletedTask;
                    };

                    options.SignInScheme = "Cookies";
                    options.ClientId = "MS.UI";
                    options.ClientSecret = "z71C0PyDjR";
                    options.ResponseType = "code id_token";
                    //options.UsePkce = true;

                    options.SaveTokens = true;
                    //options.GetClaimsFromUserInfoEndpoint = true;
                    options.Scope.Clear();
                    options.Scope.Add("profile");
                    options.Scope.Add("sampleapi.read");
                    options.Scope.Add("offline_access");
                 
                });
           
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
            }
            //app.UseHttpsRedirection();
            

            app.UseStaticFiles();
            app.UseCookiePolicy();
            app.UseRouting();
            
            app.UseAuthentication();
            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllerRoute(
                    name: "default",
                    pattern: "{controller=Home}/{action=Index}/{id?}");
            });
        }
    }
}

修改后的 View

<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="utf-8" />
    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
    <title>@ViewData["Title"] - MS.UI</title>
    <link rel="stylesheet" href="~/lib/bootstrap/dist/css/bootstrap.min.css" />
    <link rel="stylesheet" href="~/css/site.css" />
</head>
<body>
    <header>
        <nav class="navbar navbar-expand-sm navbar-toggleable-sm navbar-light bg-white border-bottom box-shadow mb-3">
            <div class="container">
                <a class="navbar-brand" asp-area="" asp-controller="Home" asp-action="Index">MS.UI</a>
                <button class="navbar-toggler" type="button" data-toggle="collapse" data-target=".navbar-collapse" aria-controls="navbarSupportedContent"
                        aria-expanded="false" aria-label="Toggle navigation">
                    <span class="navbar-toggler-icon"></span>
                </button>
                <div class="navbar-collapse collapse d-sm-inline-flex flex-sm-row-reverse">
                    <ul class="navbar-nav flex-grow-1">
                        <li class="nav-item">
                            <a class="nav-link text-dark" asp-area="" asp-controller="Home" asp-action="Index">Home</a>
                        </li>
                        <li class="nav-item">
                            <a class="nav-link text-dark" asp-area="" asp-controller="Home" asp-action="Privacy">Privacy</a>
                        </li>
                        <li class="nav-item">
                            <a class="nav-link text-dark" asp-area="" asp-controller="Secure" asp-action="Secure">Secure</a>
                        </li>
                    </ul>
                </div>
            </div>
        </nav>
    </header>
    <div class="container">
        <main role="main" class="pb-3">
            @RenderBody()
        </main>
    </div>

    <footer class="border-top footer text-muted">
        <div class="container">
            &copy; 2020 - MS.UI - <a asp-area="" asp-controller="Home" asp-action="Privacy">Privacy</a>
        </div>
    </footer>
    <script src="~/lib/jquery/dist/jquery.min.js"></script>
    <script src="~/lib/bootstrap/dist/js/bootstrap.bundle.min.js"></script>
    <script src="~/js/site.js" asp-append-version="true"></script>
    @RenderSection("Scripts", required: false)
</body>
</html>

在上面的文件中我刚刚添加

 <li class="nav-item">
                            <a class="nav-link text-dark" asp-area="" asp-controller="Secure" asp-action="Secure">Secure</a>
                        </li>

HomeController.cs

using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using MS.UI.Models;

namespace MS.UI.Controllers
{
    public class HomeController : Controller
    {
        private readonly ILogger<HomeController> _logger;

        public HomeController(ILogger<HomeController> logger)
        {
            _logger = logger;
        }

        public IActionResult Index()
        {
            return View();
        }

        [Authorize]
        public IActionResult Privacy()
        {
            return View();
        }

        [ResponseCache(Duration = 0, Location = ResponseCacheLocation.None, NoStore = true)]
        public IActionResult Error()
        {
            return View(new ErrorViewModel { RequestId = Activity.Current?.Id ?? HttpContext.TraceIdentifier });
        }

        [Authorize]
        public IActionResult Secure() 
        {
            ViewData["Message"] = "Secure page.";

            return View();
        }
    }
}

我在上面的文件中添加了

[Authorize]
public IActionResult Privacy()
{
   return View();
}

网关启动.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using IdentityServer4.AccessTokenValidation;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;
using Ocelot.DependencyInjection;
using Ocelot.Middleware;

namespace MS.Gateway
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            var authenticationProviderKey = "TestKey";

            Action<IdentityServerAuthenticationOptions> options = o =>
            {
                o.RequireHttpsMetadata = false;
                o.Authority = "http://identityserver";
                o.ApiName = "sampleAPI";
                o.SupportedTokens = SupportedTokens.Both;
                o.ApiSecret = "secret";
            };

            services.AddAuthentication()
                .AddIdentityServerAuthentication(authenticationProviderKey, options);
            services.AddOcelot();

        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            //app.UseHttpsRedirection();

            app.UseRouting();

            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
            app.UseOcelot().Wait();
        }
    }
}

豹猫.json

{
  "Routes": [
    {
      "DownstreamPathTemplate": "/{everything}",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "MS.api",
          "Port": 80
        }
      ],
      "UpstreamPathTemplate": "/api/{everything}",
      "UpstreamHttpMethod": [
        "GET",
        "POST",
        "PUT",
        "DELETE"
      ],
      "RouteIsCaseSensitive": false,
      "AuthenticationOptions": {
        "AuthenticationProviderKey": "TestKey",
        "AllowedScopes": [ "sampleAPI" ]
      }
    }
  ],
  "GlobalConfiguration": {
    "BaseUrl": "http://localhost:5001"
  }
}

docker 组成

version: '3.7'

services:
  ms.api:
    image: msapi
    build:
      context: .
      dockerfile: MS.API/Dockerfile
  
  ms.gateway:
    image: ms.gateway
    build: 
      context: .
      dockerfile: MS.Gateway/Dockerfile

  identityserver:
    image: identityserver
    build: 
      context: .
      dockerfile: IdentityServer/Dockerfile
  
  ms.ui:
    image: ms.ui
    build: 
      context: .
      dockerfile: MS.UI/Dockerfile

Docker 组合覆盖

version: '3.7'

services:
  ms.api:
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - ASPNETCORE_URLS=http://+:80
    ports:
      - "5000:80"
   
    volumes:
      - ${APPDATA}/Microsoft/UserSecrets:/root/.microsoft/usersecrets:ro
      - C:/Users/dheer/.aspnet/https:/https:ro
    networks: 
      - msnetwork

  ms.gateway:
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - ASPNETCORE_URLS=http://+:80
    ports:
      - "5001:80"
    networks: 
      - msnetwork

  identityserver:
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - ASPNETCORE_URLS=http://+:80
    ports:
      - "5002:80"
    networks: 
      - msnetwork

  ms.ui:
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - ASPNETCORE_URLS=http://+:80
    ports:
      - "5003:80"
    networks: 
      - msnetwork

networks: 
  msnetwork:

volumes: 
  gateway_voludme:

请帮帮我。此完整源代码也可在@https://github.com/Dheerajmentor/Microservice.git 获得。分支-Add-IDS4

Answer 1

如果您收到 Code_challenge required 错误，那是因为客户端没有发送以下两个 PKCE header :

&code_challenge=XXXXXXXXX...
&code_challenge_method=S256

请在 Fiddler 中验证这一点。

此外，取消注释这一行是一个好的开始:

//options.UsePkce = true;

查看 IdentityServer 日志也​​是进一步诊断的好地方。

此外，PKCE 仅适用于授权代码流。您正在使用

AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,

什么时候应该使用它:

AllowedGrantTypes = GrantTypes.Code,

如果你仍然想使用当前的混合流程，你需要禁用 PKCE 使用客户端定义中的以下内容:

RequirePkce = false