IdentityServer4并调用自定义函数

Question

What I'm trying to achieve is this: set up an instance of IdentityServer4 that hands off authentication of a username/password to a function located in another .net assembly. I understand that OpenID Connect is one option but coming up with a custom IdP gives the impression of making a mountain out of a molehill.

Are there any simple ways of achieving this using Identityserver?

Answer 1

Yes. In your ConfigureServices method in Startup you need to register your own implementations of IProfileService and IResourceOwnerPasswordValidator . For example:

services.AddTransient<IProfileService, CustomProfileService>();
services.AddTransient<IResourceOwnerPasswordValidator, ResourceOwnerPasswordValidator>();

The ValidatedAsync method on the IResourceOwnerPasswordValidator is where you can then access the username/password and call your own assemblies for validation. You then return a GrantValidationResult object from that method to indicate success/failure. For example:

public Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
    {
        logWriter.Debug("Validating resource owner password: " + context.UserName);
        if (_userRepository.ValidatePassword(context.UserName, context.Password))
        {
            context.Result = new GrantValidationResult(context.UserName, "password");
            return Task.FromResult(0);
        }

        logWriter.Debug("Unauthorised resource owner password for: " + context.UserName);
        return Task.FromResult(new GrantValidationResult(TokenRequestErrors.UnauthorizedClient));
    }

The IProfileService is where you can set the claims on the context, for example by examining what has been requested (as defined in the ApiResource definition) and then make your own calls to whichever assemblies/repo you need to find out the details for those claims.