[英]IdentityServer4 register UserService and get users from database in asp.net core
我已經搜索了如何在 asp.net 核心中使用 IdentityServer4 注冊UserService
,但我似乎找不到正確的方法。
這是在此處找到的用於注冊 InMemoryUsers 的代碼,但是我想從我的 MSSQL DB 訪問用戶,而不是示例中定義的靜態用戶。
var builder = services.AddIdentityServer(options =>
{
options.SigningCertificate = cert;
});
builder.AddInMemoryClients(Clients.Get());
builder.AddInMemoryScopes(Scopes.Get());
builder.AddInMemoryUsers(Users.Get());
然后我查看了這個用於IdentityServer3 的內容。
var factory = new IdentityServerServiceFactory()
.UseInMemoryClients(Clients.Get())
.UseInMemoryScopes(Scopes.Get());
var userService = new UserService();
factory.UserService = new Registration<IUserService>(resolver => userService);
從在線閱讀來看,我似乎需要使用 DI 系統來注冊 UserService,但我不確定它如何綁定到 IdentityServer,例如。
services.AddScoped<IUserService, UserService>();
所以我的問題是:
如何將我的UserService
綁定到構建器(IdentityServer4 用戶)? 我將如何調用我的數據庫來訪問和驗證UserService
我現有的數據庫用戶(我使用存儲庫連接到數據庫)?
考慮到這必須與asp.net core 一起使用。
謝謝!
更新 - IdentityServer 4 已更改並將IUserService替換為IResourceOwnerPasswordValidator和IProfileService
我使用我的UserRepository從數據庫中獲取所有用戶數據。 這被注入 (DI) 到構造函數中,並在Startup.cs
定義。 我還為身份服務器(也被注入)創建了以下類:
首先定義ResourceOwnerPasswordValidator.cs
:
public class ResourceOwnerPasswordValidator : IResourceOwnerPasswordValidator
{
//repository to get user from db
private readonly IUserRepository _userRepository;
public ResourceOwnerPasswordValidator(IUserRepository userRepository)
{
_userRepository = userRepository; //DI
}
//this is used to validate your user account with provided grant at /connect/token
public async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
{
try
{
//get your user model from db (by username - in my case its email)
var user = await _userRepository.FindAsync(context.UserName);
if (user != null)
{
//check if password match - remember to hash password if stored as hash in db
if (user.Password == context.Password) {
//set the result
context.Result = new GrantValidationResult(
subject: user.UserId.ToString(),
authenticationMethod: "custom",
claims: GetUserClaims(user));
return;
}
context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, "Incorrect password");
return;
}
context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, "User does not exist.");
return;
}
catch (Exception ex)
{
context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, "Invalid username or password");
}
}
//build claims array from user data
public static Claim[] GetUserClaims(User user)
{
return new Claim[]
{
new Claim("user_id", user.UserId.ToString() ?? ""),
new Claim(JwtClaimTypes.Name, (!string.IsNullOrEmpty(user.Firstname) && !string.IsNullOrEmpty(user.Lastname)) ? (user.Firstname + " " + user.Lastname) : ""),
new Claim(JwtClaimTypes.GivenName, user.Firstname ?? ""),
new Claim(JwtClaimTypes.FamilyName, user.Lastname ?? ""),
new Claim(JwtClaimTypes.Email, user.Email ?? ""),
new Claim("some_claim_you_want_to_see", user.Some_Data_From_User ?? ""),
//roles
new Claim(JwtClaimTypes.Role, user.Role)
};
}
和ProfileService.cs
:
public class ProfileService : IProfileService
{
//services
private readonly IUserRepository _userRepository;
public ProfileService(IUserRepository userRepository)
{
_userRepository = userRepository;
}
//Get user profile date in terms of claims when calling /connect/userinfo
public async Task GetProfileDataAsync(ProfileDataRequestContext context)
{
try
{
//depending on the scope accessing the user data.
if (!string.IsNullOrEmpty(context.Subject.Identity.Name))
{
//get user from db (in my case this is by email)
var user = await _userRepository.FindAsync(context.Subject.Identity.Name);
if (user != null)
{
var claims = GetUserClaims(user);
//set issued claims to return
context.IssuedClaims = claims.Where(x => context.RequestedClaimTypes.Contains(x.Type)).ToList();
}
}
else
{
//get subject from context (this was set ResourceOwnerPasswordValidator.ValidateAsync),
//where and subject was set to my user id.
var userId = context.Subject.Claims.FirstOrDefault(x => x.Type == "sub");
if (!string.IsNullOrEmpty(userId?.Value) && long.Parse(userId.Value) > 0)
{
//get user from db (find user by user id)
var user = await _userRepository.FindAsync(long.Parse(userId.Value));
// issue the claims for the user
if (user != null)
{
var claims = ResourceOwnerPasswordValidator.GetUserClaims(user);
context.IssuedClaims = claims.Where(x => context.RequestedClaimTypes.Contains(x.Type)).ToList();
}
}
}
}
catch (Exception ex)
{
//log your error
}
}
//check if user account is active.
public async Task IsActiveAsync(IsActiveContext context)
{
try
{
//get subject from context (set in ResourceOwnerPasswordValidator.ValidateAsync),
var userId = context.Subject.Claims.FirstOrDefault(x => x.Type == "user_id");
if (!string.IsNullOrEmpty(userId?.Value) && long.Parse(userId.Value) > 0)
{
var user = await _userRepository.FindAsync(long.Parse(userId.Value));
if (user != null)
{
if (user.IsActive)
{
context.IsActive = user.IsActive;
}
}
}
}
catch (Exception ex)
{
//handle error logging
}
}
}
然后在Startup.cs
我做了以下事情:
public void ConfigureServices(IServiceCollection services)
{
//...
//identity server 4 cert
var cert = new X509Certificate2(Path.Combine(_environment.ContentRootPath, "idsrv4test.pfx"), "your_cert_password");
//DI DBContext inject connection string
services.AddScoped(_ => new YourDbContext(Configuration.GetConnectionString("DefaultConnection")));
//my user repository
services.AddScoped<IUserRepository, UserRepository>();
//add identity server 4
services.AddIdentityServer()
.AddSigningCredential(cert)
.AddInMemoryIdentityResources(Config.GetIdentityResources()) //check below
.AddInMemoryApiResources(Config.GetApiResources())
.AddInMemoryClients(Config.GetClients())
.AddProfileService<ProfileService>();
//Inject the classes we just created
services.AddTransient<IResourceOwnerPasswordValidator, ResourceOwnerPasswordValidator>();
services.AddTransient<IProfileService, ProfileService>();
//...
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
//...
app.UseIdentityServer();
JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();
IdentityServerAuthenticationOptions identityServerValidationOptions = new IdentityServerAuthenticationOptions
{
//move host url into appsettings.json
Authority = "http://localhost:50000/",
ApiSecret = "secret",
ApiName = "my.api.resource",
AutomaticAuthenticate = true,
SupportedTokens = SupportedTokens.Both,
// required if you want to return a 403 and not a 401 for forbidden responses
AutomaticChallenge = true,
//change this to true for SLL
RequireHttpsMetadata = false
};
app.UseIdentityServerAuthentication(identityServerValidationOptions);
//...
}
您還需要Config.cs
來定義您的客戶端、api 和資源。 你可以在這里找到一個例子: https : //github.com/IdentityServer/IdentityServer4.Demo/blob/master/src/IdentityServer4Demo/Config.cs
您現在應該可以調用 IdentityServer /connect/token
如需更多信息,請查看文檔: https : //media.readthedocs.org/pdf/identityserver4/release/identityserver4.pdf
舊答案(這不再適用於較新的 IdentityServer4)
一旦您了解了事物的流程,它就非常簡單。
像這樣配置您的 IdentityService(在 Startup.cs - ConfigureServices()
):
var builder = services.AddIdentityServer(options =>
{
options.SigningCertificate = cert;
});
builder.AddInMemoryClients(Clients.Get());
builder.AddInMemoryScopes(Scopes.Get());
//** this piece of code DI's the UserService into IdentityServer **
builder.Services.AddTransient<IUserService, UserService>();
//for clarity of the next piece of code
services.AddTransient<IUserRepository, UserRepository>();
然后設置你的 UserService
public class UserService : IUserService
{
//DI the repository from Startup.cs - see previous code block
private IUserRepository _userRepository;
public UserService(IUserRepository userRepository)
{
_userRepository = userRepository;
}
public Task AuthenticateLocalAsync(LocalAuthenticationContext context)
{
var user = _userRepository.Find(context.UserName);
//check if passwords match against user column
//My password was hashed,
//so I had to hash it with the saved salt first and then compare.
if (user.Password == context.Password)
{
context.AuthenticateResult = new AuthenticateResult(
user.UserId.ToString(),
user.Email,
//I set up some claims
new Claim[]
{
//Firstname and Surname are DB columns mapped to User object (from table [User])
new Claim(Constants.ClaimTypes.Name, user.Firstname + " " + user.Surname),
new Claim(Constants.ClaimTypes.Email, user.Email),
new Claim(Constants.ClaimTypes.Role, user.Role.ToString()),
//custom claim
new Claim("company", user.Company)
}
);
}
return Task.FromResult(0);
}
public Task GetProfileDataAsync(ProfileDataRequestContext context)
{
//find method in my repository to check my user email
var user = _userRepository.Find(context.Subject.Identity.Name);
if (user != null)
{
var claims = new Claim[]
{
new Claim(Constants.ClaimTypes.Name, user.Firstname + " " + user.Surname),
new Claim(Constants.ClaimTypes.Email, user.Email),
new Claim(Constants.ClaimTypes.Role, user.Role.ToString(), ClaimValueTypes.Integer),
new Claim("company", user.Company)
};
context.IssuedClaims = claims.Where(x => context.RequestedClaimTypes.Contains(x.Type));
}
return Task.FromResult(0);
}
public Task IsActiveAsync(IsActiveContext context)
{
var user = _userRepository.Find(context.Subject.Identity.Name);
return Task.FromResult(user != null);
}
}
基本上通過將UserService
注入builder
(類型為IdentityServerBuilder
) Services
,允許它在身份驗證時調用 UserService 。
我希望這可以幫助其他人,因為我花了幾個小時才完成這項工作。
在 IdentityServer4 中。 IUserService
不再可用,現在您必須使用IResourceOwnerPasswordValidator
進行身份驗證並使用IProfileService
來獲取聲明。
在我的場景中,我使用資源所有者授權類型,我需要的只是讓用戶聲明根據用戶名和密碼對我的 Web API 進行基於角色的授權。 我假設這個主題對每個用戶都是獨一無二的。
我已經在下面發布了我的代碼,它可以正常工作; 誰能告訴我我的代碼有什么問題嗎?
在startup.cs中注冊這兩個服務。
public void ConfigureServices(IServiceCollection services)
{
var builder = services.AddIdentityServer();
builder.AddInMemoryClients(Clients.Get());
builder.AddInMemoryScopes(Scopes.Get());
builder.Services.AddTransient<IResourceOwnerPasswordValidator, ResourceOwnerPasswordValidator>();
builder.Services.AddTransient<IProfileService, ProfileService>();
}
實現IResourceOwnerPasswordValidator
接口。
public class ResourceOwnerPasswordValidator: IResourceOwnerPasswordValidator
{
public Task<customgrantvalidationresult> ValidateAsync(string userName, string password, ValidatedTokenRequest request)
{
// Check The UserName And Password In Database, Return The Subject If Correct, Return Null Otherwise
// subject = ......
if (subject == null)
{
var result = new CustomGrantValidationResult("Username Or Password Incorrect");
return Task.FromResult(result);
}
else {
var result = new CustomGrantValidationResult(subject, "password");
return Task.FromResult(result);
}
}
}
實現ProfileService
接口。
public class ProfileService : IProfileService
{
public Task GetProfileDataAsync(ProfileDataRequestContext context)
{
string subject = context.Subject.Claims.ToList().Find(s => s.Type == "sub").Value;
try
{
// Get Claims From Database, And Use Subject To Find The Related Claims, As A Subject Is An Unique Identity Of User
//List<string> claimStringList = ......
if (claimStringList == null)
{
return Task.FromResult(0);
}
else {
List<Claim> claimList = new List<Claim>();
for (int i = 0; i < claimStringList.Count; i++)
{
claimList.Add(new Claim("role", claimStringList[i]));
}
context.IssuedClaims = claimList.Where(x => context.RequestedClaimTypes.Contains(x.Type));
return Task.FromResult(0);
}
}
catch
{
return Task.FromResult(0);
}
}
public Task IsActiveAsync(IsActiveContext context)
{
return Task.FromResult(0);
}
}
在 IdentityServer4 1.0.0-rc5 中,IUserService 和 CustomGrantValidationResult 都不可用。
現在,您需要設置 context.Result,而不是返回 CustomGrantValidationResult。
public class ResourceOwnerPasswordValidator: IResourceOwnerPasswordValidator
{
private MyUserManager _myUserManager { get; set; }
public ResourceOwnerPasswordValidator()
{
_myUserManager = new MyUserManager();
}
public async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
{
var user = await _myUserManager.FindByNameAsync(context.UserName);
if (user != null && await _myUserManager.CheckPasswordAsync(user,context.Password))
{
context.Result = new GrantValidationResult(
subject: "2",
authenticationMethod: "custom",
claims: someClaimsList);
}
else
{
context.Result = new GrantValidationResult(
TokenRequestErrors.InvalidGrant,
"invalid custom credential");
}
return;
}
聲明:本站的技術帖子網頁,遵循CC BY-SA 4.0協議,如果您需要轉載,請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.