使用 owin 中間件和 IdentityServer v3 刷新令牌

Question

我最近設置了 IdentityServer v3 並且它像夢一樣運行，但是我在使用 OWIN 中間件時遇到了麻煩。

我想使用混合流，這樣我就可以在后端刷新令牌，而無需用戶重定向回 IdentityServer 以每 5 分鍾獲取一個新的訪問令牌（這也很奇怪，因為它的生命周期設置為 1 小時在服務器上）。

我在啟動時使用以下配置並且我得到的令牌很好，但是一旦它過期，它似乎永遠不會嘗試刷新訪問令牌。 我是否需要一些自定義邏輯來刷新我的令牌？

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            ClientId = clientId,
            ClientSecret = clientSecret, //Not sure what this does?

            Authority = "https://auth.example.com",

            RedirectUri = "http://website.example.com",
            PostLogoutRedirectUri = "http://website.example.com",

            ResponseType = "code id_token token",
            Scope = "openid profile email write read offline_access",

            SignInAsAuthenticationType = "Cookies",

            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                AuthorizationCodeReceived = async n =>
                {
                    // filter "protocol" claims
                    var claims = new List<Claim>(from c in n.AuthenticationTicket.Identity.Claims
                                                 where c.Type != "iss" &&
                                                       c.Type != "aud" &&
                                                       c.Type != "nbf" &&
                                                       c.Type != "exp" &&
                                                       c.Type != "iat" &&
                                                       c.Type != "nonce" &&
                                                       c.Type != "c_hash" &&
                                                       c.Type != "at_hash"
                                                 select c);

                    // get userinfo data
                    var userInfoClient = new UserInfoClient(
                        new Uri(n.Options.Authority + "/connect/userinfo"),
                        n.ProtocolMessage.AccessToken);

                    var userInfo = await userInfoClient.GetAsync();
                    userInfo.Claims.ToList().ForEach(ui => claims.Add(new Claim(ui.Item1, ui.Item2)));

                    // get access and refresh token
                    var tokenClient = new OAuth2Client(
                        new Uri(n.Options.Authority + "/connect/token"),
                        clientId,
                        clientSecret);

                    var response = await tokenClient.RequestAuthorizationCodeAsync(n.Code, n.RedirectUri);

                    claims.Add(new Claim("access_token", response.AccessToken));
                    claims.Add(new Claim("expires_at", DateTime.UtcNow.AddSeconds(response.ExpiresIn).ToLocalTime().ToString(CultureInfo.InvariantCulture)));
                    claims.Add(new Claim("refresh_token", response.RefreshToken));
                    claims.Add(new Claim("id_token", n.ProtocolMessage.IdToken));

                    //Does this help?
                    n.AuthenticationTicket.Properties.AllowRefresh = true;

                    n.AuthenticationTicket = new AuthenticationTicket(
                        new ClaimsIdentity(
                            claims.Distinct(new ClaimComparer()),
                            n.AuthenticationTicket.Identity.AuthenticationType),
                        n.AuthenticationTicket.Properties);
                },

                RedirectToIdentityProvider = async n =>
                {
                    // if signing out, add the id_token_hint
                    if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
                    {
                        var id = n.OwinContext.Authentication.User.FindFirst("id_token");

                        if (id != null)
                        {
                            var idTokenHint = id.Value;
                            n.ProtocolMessage.IdTokenHint = idTokenHint;
                        }
                    }
                }
            }
        });

我還在我的 ApiClient (RestSharp) 中使用了以下內容，它與我的資源 api 對話

public class MyTokenAuthenticator : IAuthenticator
{
    public void Authenticate(IRestClient client, IRestRequest request)
    {
        var tokenClaim = ClaimsPrincipal.Current.Claims.FirstOrDefault(c => c.Type.Equals("access_token"));

        if (tokenClaim != null && !String.IsNullOrWhiteSpace(tokenClaim.Value))
            request.AddHeader("Authorization", String.Format("Bearer {0}", tokenClaim.Value));
    }
}

Answer 1

我能夠獲得一個刷新令牌，然后使用它來獲得一個新的訪問令牌：我遵循與您類似的邏輯來獲取令牌。 我創建了以下方法，每次需要令牌時都會調用該方法：

private static async Task CheckAndPossiblyRefreshToken(ClaimsIdentity id)
    {
        var clientName = "Myhybridclient";
        // check if the access token hasn't expired.
        if (DateTime.Now.ToLocalTime() >=
             (DateTime.Parse(id.FindFirst("expires_at").Value)))
        {
            // expired.  Get a new one.
            var tokenEndpointClient = new OAuth2Client(
                new Uri(Constants.TokenEndpoint),
                clientName,
                "secret");

            var tokenEndpointResponse =
                await tokenEndpointClient
                .RequestRefreshTokenAsync(id.FindFirst("refresh_token").Value);

            if (!tokenEndpointResponse.IsError)
            {
                // replace the claims with the new values - this means creating a 
                // new identity!                              
                var result = from claim in id.Claims
                             where claim.Type != "access_token" && claim.Type != "refresh_token" &&
                                   claim.Type != "expires_at"
                             select claim;

                var claims = result.ToList();

                claims.Add(new Claim("access_token", tokenEndpointResponse.AccessToken));
                claims.Add(new Claim("expires_at",
                             DateTime.Now.AddSeconds(tokenEndpointResponse.ExpiresIn)
                             .ToLocalTime().ToString()));
                claims.Add(new Claim("refresh_token", tokenEndpointResponse.RefreshToken));

                var newIdentity = new ClaimsIdentity(claims, "Cookies");
                var wrapper = new HttpRequestWrapper(HttpContext.Current.Request);
                wrapper.GetOwinContext().Authentication.SignIn(newIdentity);
            }
            else
            {
                // log, ...
                throw new Exception("An error has occurred");
            }
        }
    }