[英]Current user in owin authentication
I started to build a web api for mobile apps and I'm having a hard time with implementing authentication. 我开始为移动应用程序构建一个web api,我很难实现身份验证。 I use Bearer and although everything is supposed to be fine, I cannot get the current user from action in controller.
我使用Bearer,虽然一切都应该没问题,但我无法让当前用户从控制器中获取动作。 HttpContext.Current.User.Identity.Name is null (the same is result of HttpContext.Current.User.Identity.GetUserId()).
HttpContext.Current.User.Identity.Name为null(同样是HttpContext.Current.User.Identity.GetUserId())的结果。 Here are the pieces of important code:
以下是重要代码:
Startup.cs: Startup.cs:
public partial class Startup
{
public void Configuration(IAppBuilder app)
{
var config = new HttpConfiguration();
ConfigureAuth(app);
WebApiConfig.Register(config);
app.UseWebApi(config);
}
}
Startup.Auth.cs Startup.Auth.cs
public partial class Startup
{
static Startup()
{
OAuthOptions = new OAuthAuthorizationServerOptions
{
TokenEndpointPath = new PathString("/token"),
Provider = new ApplicationOAuthProvider(),
AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
AllowInsecureHttp = true
};
OAuthBearerOptions = new OAuthBearerAuthenticationOptions();
}
public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }
public static OAuthBearerAuthenticationOptions OAuthBearerOptions { get; private set; }
public static string PublicClientId { get; private set; }
public void ConfigureAuth(IAppBuilder app)
{
app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
{
AccessTokenProvider = new AuthenticationTokenProvider()
});
app.UseOAuthBearerTokens(OAuthOptions);
app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
}
}
ApplicationOAuthProvider.cs: ApplicationOAuthProvider.cs:
public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
{
string clientId, clientSecret;
if (!context.TryGetBasicCredentials(out clientId, out clientSecret))
{
return SetErrorAndReturn(context, "client error", "");
}
if (clientId == "secret" && clientSecret == "secret")
{
context.Validated();
return Task.FromResult<object>(null);
}
return SetErrorAndReturn(context, "client error", "");
}
public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
{
context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });
using (AuthRepository _repo = new AuthRepository())
{
IdentityUser user = await _repo.FindUser(context.UserName, context.Password);
if (user == null)
{
context.SetError("invalid_grant", "The user name or password is incorrect.");
return;
}
}
var identity = new ClaimsIdentity(context.Options.AuthenticationType);
identity.AddClaim(new Claim("sub", context.UserName));
identity.AddClaim(new Claim("role", "user"));
context.Validated(identity);
}
public override Task TokenEndpoint(OAuthTokenEndpointContext context)
{
foreach (KeyValuePair<string, string> property in context.Properties.Dictionary)
{
context.AdditionalResponseParameters.Add(property.Key, property.Value);
}
return Task.FromResult<object>(null);
}
AuthRepository.cs: AuthRepository.cs:
public class AuthRepository : IDisposable
{
private readonly AuthContext _ctx;
private readonly UserManager<IdentityUser> _userManager;
public AuthRepository()
{
_ctx = new AuthContext();
_userManager = new UserManager<IdentityUser>(new UserStore<IdentityUser>(_ctx));
}
public async Task<IdentityResult> RegisterUser(UserModel userModel)
{
var user = new IdentityUser
{
UserName = userModel.UserName
};
var result = await _userManager.CreateAsync(user, userModel.Password);
return result;
}
public async Task<IdentityUser> FindUser(string userName, string password)
{
IdentityUser user = await _userManager.FindAsync(userName, password);
return user;
}
public void Dispose()
{
_ctx.Dispose();
_userManager.Dispose();
}
}
AuthContext.cs: AuthContext.cs:
public class AuthContext : IdentityDbContext<IdentityUser>
{
public AuthContext()
: base("AuthContext")
{
}
}
And finnaly ValuesController.cs: 和finnaly ValuesController.cs:
[Authorize]
public class ValuesController : ApiController
{
public IEnumerable<string> Get()
{
return new String[] {HttpContext.Current.User.Identity.Name, HttpContext.Current.User.Identity.GetUserId(),ClaimsPrincipal.Current.Identity.Name};
}
}
When i go to this action, i get null 3 times. 当我采取这个行动时,我得到3次无效。 Despite that, the whole authentication proccess seems to be fine - only when i send a good token, i have access.
尽管如此,整个身份验证过程似乎都很好 - 只有当我发送一个好的令牌时,我才有权访问。 Does anybody have an idea what is wrong here?
有人知道这里有什么问题吗?
On method GrantResourceOwnerCredentials once you add claims after validating the username password you need to add this claim: 在验证用户名密码后添加声明后,在方法GrantResourceOwnerCredentials上,您需要添加此声明:
identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));
By doing this the UserId will be filled when you call User.Identity.Name inside protected controller. 通过这样做,当您在受保护的控制器内调用User.Identity.Name时,将填充UserId。 Hope this solves your issue.
希望这能解决您的问题。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.