c# - 无效的 redirect_uri IdentityServer4 和 AppAuth

Question

我正在使用 asp.net core 3.1 附带的 IdentityServer 模板。到目前为止一切顺利，SPA 应用程序使用隐式流程。现在我有一个移动应用程序，我想与同一个身份服务器一起使用。
所以在 appsettings.json 我添加了一个新 key charla-mobile ，并将配置文件设置为 NativeApp ，假设我可以按照 https://github.com/dotnet/aspnetcore/blob/62c098bc170f50feca15916e81cb7f321ffc52ff/src/Identity/ApiAuthorization.IdentityServer/src/Configuration/ConfigureClients.cs#L56 使用我自己的配置:

   "IdentityServer": {
    "Key": {
      "Type": "Development"
    },     
    "Clients": {
        "Charla": {
            "Profile": "IdentityServerSPA"
        },
        "charla-mobile": {
          "Enabled": true,
          "Profile": "NativeApp",
          "ClientName": "Charla Mobile Client (Code with PKCE)",
          "RequireClientSecret" : false,  
          "RedirectUris": ["http://localhost:8100/implicit/authcallback", "com.appauth.demo://callback"],
          "AllowedGrantTypes": [ "code", "implicit" ],
          "RequirePkce": true,
          "AllowedScopes": ["converse-appAPI", "openid", "profile"]
          
        }
    }
    
  }

问题是我不断收到无效的redirect_uri，尽管我从具有相同网址(http://localhost:8100/implicit/authcallback)的javascript库中调用它:

Invalid redirect_uri: http: //localhost:8100/implicit/authcallback
    {
        "ClientId": "charla-mobile",
        "ClientName": "charla-mobile",
        "RedirectUri": null,
        "AllowedRedirectUris": ["urn:ietf:wg:oauth:2.0:oob"],
        "SubjectId": "anonymous",
        "ResponseType": null,
        "ResponseMode": null,
        "GrantType": null,
        "RequestedScopes": "",
        "State": null,
        "UiLocales": null,
        "Nonce": null,
        "AuthenticationContextReferenceClasses": null,
        "DisplayMode": null,
        "PromptMode": null,
        "MaxAge": null,
        "LoginHint": null,
        "SessionId": null,
        "Raw": {
            "redirect_uri": "http://localhost:8100/implicit/authcallback",
            "client_id": "charla-mobile",
            "response_type": "code",
            "state": "4qtaYswLFK",
            "scope": "converse-appAPI openid profile",
            "code_challenge": "opKV8gSVV5X7pQ7eTvQ3Lp40A7BXplkz4RiGkEFgBcc",
            "code_challenge_method": "S256"
        },
        "$type": "AuthorizeRequestValidationLog"
    }

并从 chrome 网络选项卡:

按要求提供完整日志

Application started. Press Ctrl+C to shut down.
[18:38:49 DBG] CORS request made for path: /.well-known/openid-configuration from origin: http://localhost:8100
[18:38:49 DBG] CorsPolicyService allowed origin: http://localhost:8100
[18:38:49 DBG] Login Url: /auth/login
[18:38:49 DBG] Login Return Url Parameter: ReturnUrl
[18:38:49 DBG] Logout Url: /Identity/Account/Logout
[18:38:49 DBG] ConsentUrl Url: /consent
[18:38:49 DBG] Consent Return Url Parameter: returnUrl
[18:38:49 DBG] Error Url: /home/error
[18:38:49 DBG] Error Id Parameter: errorId
[18:38:49 DBG] Request path /.well-known/openid-configuration matched to endpoint type Discovery
[18:38:49 DBG] Endpoint enabled: Discovery, successfully created handler: IdentityServer4.Endpoints.DiscoveryEndpoint
[18:38:49 INF] Invoking IdentityServer endpoint: IdentityServer4.Endpoints.DiscoveryEndpoint for /.well-known/openid-configuration
[18:38:49 DBG] Start discovery request
[18:38:49 DBG] Request path /connect/authorize matched to endpoint type Authorize
[18:38:49 DBG] Endpoint enabled: Authorize, successfully created handler: IdentityServer4.Endpoints.AuthorizeEndpoint
[18:38:49 INF] Invoking IdentityServer endpoint: IdentityServer4.Endpoints.AuthorizeEndpoint for /connect/authorize
[18:38:49 DBG] Start authorize request
[18:38:49 DBG] No user present in authorize request
[18:38:49 DBG] Start authorize request protocol validation
[18:38:49 DBG] client configuration validation for client charla-mobile succeeded.
[18:38:49 ERR] Invalid redirect_uri: http://localhost:8100/implicit/authcallback
{"ClientId": "charla-mobile", "ClientName": "charla-mobile", "RedirectUri": null, "AllowedRedirectUris": ["urn:ietf:wg:oauth:2.0:oob"], "SubjectId": "anonymous", "ResponseType": null, "ResponseMode": null, "GrantType": null, "RequestedScopes": "", "State": null, "UiLocales": null, "Nonce": null, "AuthenticationContextReferenceClasses": null, "DisplayMode": null, "PromptMode": null, "MaxAge": null, "LoginHint": null, "SessionId": null, "Raw": {"redirect_uri": "http://localhost:8100/implicit/authcallback", "client_id": "charla-mobile", "response_type": "code", "state": "G0Zn5uV8K4", "scope": "converse-appAPI openid profile", "code_challenge": "7vnsRsZRIzgf7Ti_gH-k1LY6fErlLZNrbfZlbQYCz7U", "code_challenge_method": "S256"}, "$type": "AuthorizeRequestValidationLog"}
[18:38:49 ERR] Request validation failed
[18:38:49 INF] {"ClientId": "charla-mobile", "ClientName": "charla-mobile", "RedirectUri": null, "AllowedRedirectUris": ["urn:ietf:wg:oauth:2.0:oob"], "SubjectId": "anonymous", "ResponseType": null, "ResponseMode": null, "GrantType": null, "RequestedScopes": "", "State": null, "UiLocales": null, "Nonce": null, "AuthenticationContextReferenceClasses": null, "DisplayMode": null, "PromptMode": null, "MaxAge": null, "LoginHint": null, "SessionId":
null, "Raw": {"redirect_uri": "http://localhost:8100/implicit/authcallback", "client_id": "charla-mobile", "response_type": "code", "state": "G0Zn5uV8K4", "scope": "converse-appAPI openid profile", "code_challenge": "7vnsRsZRIzgf7Ti_gH-k1LY6fErlLZNrbfZlbQYCz7U", "code_challenge_method": "S256"}, "$type": "AuthorizeRequestValidationLog"}
[18:38:49 INF] {"ClientId": "charla-mobile", "ClientName": "charla-mobile", "RedirectUri": null, "Endpoint": "Authorize", "SubjectId": null, "Scopes": "", "GrantType": null, "Error": "unauthorized_client", "ErrorDescription": "Invalid redirect_uri", "Category": "Token", "Name": "Token Issued Failure", "EventType": "Failure", "Id": 2001, "Message": null, "ActivityId": "0HM1T9FDQAMOT:00000001", "TimeStamp": "2020-08-10T16:38:49.0000000Z", "ProcessId": 13112, "LocalIpAddress": "::1:5000", "RemoteIpAddress": "::1", "$type": "TokenIssuedFailureEvent"}

Answer 1

我认为在代码中配置客户端更容易，以确保一切正确。我在想的是，如果您错过了 ClientID，并且如果 clientID 错误，那么 IS 找不到正确的重定向 URL？
我找到了这个例子 here

"IdentityServer": {
  "IssuerUri": "urn:sso.company.com",
  "Clients": [
    {
      "Enabled": true,
      "ClientId": "local-dev",
      "ClientName": "Local Development",
      "ClientSecrets": [ { "Value": "<Insert Sha256 hash of the secret encoded as Base64 string>" } ],
      "AllowedGrantTypes": [ "implicit" ],
      "AllowedScopes": [ "openid", "profile" ],
      "RedirectUris": [ "https://localhost:5001/signin-oidc" ],
      "RequireConsent": false
    }
  ]