无效的 redirect_uri IdentityServer4 和 AppAuth

Question

我正在使用 asp.net core 3.1 附带的 IdentityServer 模板。 到目前为止一切顺利，SPA 应用程序适用于隐式流程。 现在我有一个移动应用程序，我想与同一个身份服务器一起使用。

So in appsettings.json i added a new key charla-mobile , and set the Profile to NativeApp , assuming i can use my own configuration as per https://github.com/dotnet/aspnetcore/blob/62c098bc170f50feca15916e81cb7f321ffc52ff/src/Identity/ ApiAuthorization.IdentityServer/src/Configuration/ConfigureClients.cs#L56 ：

   "IdentityServer": {
    "Key": {
      "Type": "Development"
    },     
    "Clients": {
        "Charla": {
            "Profile": "IdentityServerSPA"
        },
        "charla-mobile": {
          "Enabled": true,
          "Profile": "NativeApp",
          "ClientName": "Charla Mobile Client (Code with PKCE)",
          "RequireClientSecret" : false,  
          "RedirectUris": ["http://localhost:8100/implicit/authcallback", "com.appauth.demo://callback"],
          "AllowedGrantTypes": [ "code", "implicit" ],
          "RequirePkce": true,
          "AllowedScopes": ["converse-appAPI", "openid", "profile"]
          
        }
    }
    
  }

问题是我一直收到 Invalid redirect_uri 虽然我从 javascript 库中调用它，但使用相同的 url （http://localhost:8100/implicit/authcallback）：

Invalid redirect_uri: http: //localhost:8100/implicit/authcallback
    {
        "ClientId": "charla-mobile",
        "ClientName": "charla-mobile",
        "RedirectUri": null,
        "AllowedRedirectUris": ["urn:ietf:wg:oauth:2.0:oob"],
        "SubjectId": "anonymous",
        "ResponseType": null,
        "ResponseMode": null,
        "GrantType": null,
        "RequestedScopes": "",
        "State": null,
        "UiLocales": null,
        "Nonce": null,
        "AuthenticationContextReferenceClasses": null,
        "DisplayMode": null,
        "PromptMode": null,
        "MaxAge": null,
        "LoginHint": null,
        "SessionId": null,
        "Raw": {
            "redirect_uri": "http://localhost:8100/implicit/authcallback",
            "client_id": "charla-mobile",
            "response_type": "code",
            "state": "4qtaYswLFK",
            "scope": "converse-appAPI openid profile",
            "code_challenge": "opKV8gSVV5X7pQ7eTvQ3Lp40A7BXplkz4RiGkEFgBcc",
            "code_challenge_method": "S256"
        },
        "$type": "AuthorizeRequestValidationLog"
    }

并从 chrome 网络选项卡：

按要求填写完整日志

Application started. Press Ctrl+C to shut down.
[18:38:49 DBG] CORS request made for path: /.well-known/openid-configuration from origin: http://localhost:8100
[18:38:49 DBG] CorsPolicyService allowed origin: http://localhost:8100
[18:38:49 DBG] Login Url: /auth/login
[18:38:49 DBG] Login Return Url Parameter: ReturnUrl
[18:38:49 DBG] Logout Url: /Identity/Account/Logout
[18:38:49 DBG] ConsentUrl Url: /consent
[18:38:49 DBG] Consent Return Url Parameter: returnUrl
[18:38:49 DBG] Error Url: /home/error
[18:38:49 DBG] Error Id Parameter: errorId
[18:38:49 DBG] Request path /.well-known/openid-configuration matched to endpoint type Discovery
[18:38:49 DBG] Endpoint enabled: Discovery, successfully created handler: IdentityServer4.Endpoints.DiscoveryEndpoint
[18:38:49 INF] Invoking IdentityServer endpoint: IdentityServer4.Endpoints.DiscoveryEndpoint for /.well-known/openid-configuration
[18:38:49 DBG] Start discovery request
[18:38:49 DBG] Request path /connect/authorize matched to endpoint type Authorize
[18:38:49 DBG] Endpoint enabled: Authorize, successfully created handler: IdentityServer4.Endpoints.AuthorizeEndpoint
[18:38:49 INF] Invoking IdentityServer endpoint: IdentityServer4.Endpoints.AuthorizeEndpoint for /connect/authorize
[18:38:49 DBG] Start authorize request
[18:38:49 DBG] No user present in authorize request
[18:38:49 DBG] Start authorize request protocol validation
[18:38:49 DBG] client configuration validation for client charla-mobile succeeded.
[18:38:49 ERR] Invalid redirect_uri: http://localhost:8100/implicit/authcallback
{"ClientId": "charla-mobile", "ClientName": "charla-mobile", "RedirectUri": null, "AllowedRedirectUris": ["urn:ietf:wg:oauth:2.0:oob"], "SubjectId": "anonymous", "ResponseType": null, "ResponseMode": null, "GrantType": null, "RequestedScopes": "", "State": null, "UiLocales": null, "Nonce": null, "AuthenticationContextReferenceClasses": null, "DisplayMode": null, "PromptMode": null, "MaxAge": null, "LoginHint": null, "SessionId": null, "Raw": {"redirect_uri": "http://localhost:8100/implicit/authcallback", "client_id": "charla-mobile", "response_type": "code", "state": "G0Zn5uV8K4", "scope": "converse-appAPI openid profile", "code_challenge": "7vnsRsZRIzgf7Ti_gH-k1LY6fErlLZNrbfZlbQYCz7U", "code_challenge_method": "S256"}, "$type": "AuthorizeRequestValidationLog"}
[18:38:49 ERR] Request validation failed
[18:38:49 INF] {"ClientId": "charla-mobile", "ClientName": "charla-mobile", "RedirectUri": null, "AllowedRedirectUris": ["urn:ietf:wg:oauth:2.0:oob"], "SubjectId": "anonymous", "ResponseType": null, "ResponseMode": null, "GrantType": null, "RequestedScopes": "", "State": null, "UiLocales": null, "Nonce": null, "AuthenticationContextReferenceClasses": null, "DisplayMode": null, "PromptMode": null, "MaxAge": null, "LoginHint": null, "SessionId":
null, "Raw": {"redirect_uri": "http://localhost:8100/implicit/authcallback", "client_id": "charla-mobile", "response_type": "code", "state": "G0Zn5uV8K4", "scope": "converse-appAPI openid profile", "code_challenge": "7vnsRsZRIzgf7Ti_gH-k1LY6fErlLZNrbfZlbQYCz7U", "code_challenge_method": "S256"}, "$type": "AuthorizeRequestValidationLog"}
[18:38:49 INF] {"ClientId": "charla-mobile", "ClientName": "charla-mobile", "RedirectUri": null, "Endpoint": "Authorize", "SubjectId": null, "Scopes": "", "GrantType": null, "Error": "unauthorized_client", "ErrorDescription": "Invalid redirect_uri", "Category": "Token", "Name": "Token Issued Failure", "EventType": "Failure", "Id": 2001, "Message": null, "ActivityId": "0HM1T9FDQAMOT:00000001", "TimeStamp": "2020-08-10T16:38:49.0000000Z", "ProcessId": 13112, "LocalIpAddress": "::1:5000", "RemoteIpAddress": "::1", "$type": "TokenIssuedFailureEvent"}

Answer 1

我认为在代码中配置客户端以确保一切正确更容易。 我在想的是，如果您错过了 ClientID，并且如果 clientID 错误，那么 IS 找不到正确的重定向 URL？

我在这里找到了这个例子

"IdentityServer": {
  "IssuerUri": "urn:sso.company.com",
  "Clients": [
    {
      "Enabled": true,
      "ClientId": "local-dev",
      "ClientName": "Local Development",
      "ClientSecrets": [ { "Value": "<Insert Sha256 hash of the secret encoded as Base64 string>" } ],
      "AllowedGrantTypes": [ "implicit" ],
      "AllowedScopes": [ "openid", "profile" ],
      "RedirectUris": [ "https://localhost:5001/signin-oidc" ],
      "RequireConsent": false
    }
  ]

Answer 2

这可能不是我想要的答案，但我不得不放弃 asp.net 核心提供的 ApiAuthorizaion 扩展，并开始使用他们的标准文档和配置文件配置身份服务器。

Answer 3

我遇到了同样的问题，我的解决方案是通过代码手动设置它（就像真正手动一样），否则 redirectUri 被设置为完全不同的值：

services.AddIdentityServer()
            .AddApiAuthorization<ApplicationUser, AuthorizationDbContext>(options =>
            {
                options.Clients.AddNativeApp(
                    "MyApp", 
                    app => app
                        .WithScopes("MyServerAPI", "openid", "profile", "offline_access")
                );
                var client = options.Clients.Single(c => c.ClientId == "MyApp");
                client.AllowOfflineAccess = true;
                client.RedirectUris.Clear();
                client.RedirectUris.Add("http://localhost:4000/");
                client.PostLogoutRedirectUris.Clear();
                client.PostLogoutRedirectUris.Add("http://localhost:4000/");
                
            });