堆棧內存溢出
  簡體   English   中英

Blazor WebAssembly 應用程序與個人帳戶和 ASP.NET 核心托管 - 令牌請求 - “錯誤”：“unauthorized_client”

[英]Blazor WebAssembly App with Individual Accounts and ASP.NET Core Hosted - Token request - "error": "unauthorized_client"

 原文  2021-04-29 08:25:08  1   1    c#/ asp.net/ asp.net-core/ blazor/ blazor-webassembly

問題描述

使用具有以下規范的Microsoft Visual Studio 2019 Version 16.9.4創建新的Blazor WebAssembly App ： Target Framework .NET 5.0 ， Authentication Type Individual Accounts和ASP.NET Core Hosted ：

在此處輸入圖像描述

在版本5.0.5中提供具有這些NuGet的服務器項目：

  • Microsoft.AspNetCore.ApiAuthorization.IdentityServer
  • Microsoft.AspNetCore.Identity.EntityFrameworkCore
  • Microsoft.AspNetCore.Identity.UI

Startup.cs 包含以下代碼：

services.AddIdentityServer()
    .AddApiAuthorization<ApplicationUser, ApplicationDbContext>();

services.AddAuthentication()
    .AddIdentityServerJwt();

閱讀博客文章ASP.NET Core Authentication with IdentityServer4 from Microsoft 我應該能夠使用如下所示的示例請求檢索令牌：

POST /connect/token HTTP/1.1
Host: localhost:5000
Cache-Control: no-cache
Postman-Token: 958df72b-663c-5638-052a-aed41ba0dbd1
Content-Type: application/x-www-form-urlencoded

grant_type=password&username=Mike%40Contoso.com&password=MikesPassword1!&client_id=myClient&scope=myAPIs

https://devblogs.microsoft.com/aspnet/asp-net-core-authentication-with-identityserver4/

創建一個看起來像這樣的請求，但針對創建的解決方案：

POST /connect/token HTTP/1.1
Host: localhost:44388
Content-Type: application/x-www-form-urlencoded
Content-Length: 153

grant_type=password&username=example%40example.com&password=Password1&client_id=WebApplication4.Client&scope=WebApplication4.ServerAPI%20openid%20profile

此請求返回 HTTP 狀態 400 錯誤請求，正文：

{
    "error": "unauthorized_client"
}

在此處輸入圖像描述

我很確定這些值是正確的，因為我從用於登錄 web 應用程序的請求中獲得了client_id和scope 。 不過，該流程不使用grant_type=password 。 來自登錄的示例請求：

https://localhost:44388/Identity/Account/Login?ReturnUrl=/connect/authorize/callback?client_id=WebApplication4.Client&redirect_uri=https%3A%2F%2Flocalhost%3A44388%2Fauthentication%2Flogin-callback&response_type=code&scope=WebApplication4.ServerAPI%20openid%20profile&state=12345&code_challenge=12345&code_challenge_method=S256&response_mode=query

確認用戶存在並工作：

在此處輸入圖像描述

我錯過了什么？

1 個解決方案

解決方案1
 1 已采納  2021-04-29 19:54:41

TLDR：

從appsettings.json刪除它：

"Clients": {
  "WebApplication4.Client": {
    "Profile": "IdentityServerSPA"
  }
}

編輯Startup.cs ：

services.AddIdentityServer()
    .AddApiAuthorization<ApplicationUser, ApplicationDbContext>(options =>
    {
        options.Clients.AddIdentityServerSPA("WebApplication4.Client", builder =>
        {
            builder.WithRedirectUri("/authentication/login-callback");
            builder.WithLogoutRedirectUri("/authentication/logout-callback");
        });
        options.Clients.Add(new IdentityServer4.Models.Client
        {
            ClientId = "WebApplication4.Integration",
            AllowedGrantTypes = { GrantType.ResourceOwnerPassword },
            //Use Configuration.GetSection("MySecretValue").Value; to get a value from appsettings.json
            ClientSecrets = { new Secret("MySecretValue".Sha256()) },
            AllowedScopes = { "WebApplication4.ServerAPI", "openid", "profile" }
        });
    });

此請求將起作用：

POST /connect/token HTTP/1.1
Host: localhost:44388
Content-Type: application/x-www-form-urlencoded
Content-Length: 168

grant_type=password&username=example%40example.com&password=Password1!&client_id=WebApplication4.Integration&scope=WebApplication4.ServerAPI&client_secret=MySecretValue

長答案：

我開始嘗試使用 Logging 獲得更好的錯誤消息。

我將以下代碼添加到Program.cs中的public static IHostBuilder CreateHostBuilder(string[] args) ：

.ConfigureLogging(logging =>
{
    logging.ClearProviders();
    logging.AddConsole();
})

https://docs.microsoft.com/en-us/aspnet/core/fundamentals/logging/?view=aspnetcore-5.0

在調試時，我可以在發出請求時從服務器應用程序中顯示 output。 它看起來像這樣：

info: IdentityServer4.Hosting.IdentityServerMiddleware[0]
      Invoking IdentityServer endpoint: IdentityServer4.Endpoints.TokenEndpoint for /connect/token
info: IdentityServer4.Events.DefaultEventService[0]
      {
        "ClientId": "WebApplication4.Client",
        "AuthenticationMethod": "NoSecret",
        "Category": "Authentication",
        "Name": "Client Authentication Success",
        "EventType": "Success",
        "Id": 1010,
        "ActivityId": "8000000a-0000-8f00-b63f-84710c7967bb",
        "TimeStamp": "2021-04-29T11:47:07Z",
        "ProcessId": 8436,
        "LocalIpAddress": "::1:44388",
        "RemoteIpAddress": "::1"
      }
fail: IdentityServer4.Validation.TokenRequestValidator[0]
      Client not authorized for resource owner flow, check the AllowedGrantTypes setting{ client_id = WebApplication4.Client }, details: {
        "ClientId": "WebApplication4.Client",
        "ClientName": "WebApplication4.Client",
        "GrantType": "password",
        "Raw": {
          "grant_type": "password",
          "username": "example@example.com",
          "password": "***REDACTED***",
          "client_id": "WebApplication4.Client",
          "scope": "WebApplication4.ServerAPI"
        }
      }
info: IdentityServer4.Events.DefaultEventService[0]
      {
        "ClientId": "WebApplication4.Client",
        "ClientName": "WebApplication4.Client",
        "Endpoint": "Token",
        "GrantType": "password",
        "Error": "unauthorized_client",
        "Category": "Token",
        "Name": "Token Issued Failure",
        "EventType": "Failure",
        "Id": 2001,
        "ActivityId": "8000000a-0000-8f00-b63f-84710c7967bb",
        "TimeStamp": "2021-04-29T11:47:07Z",
        "ProcessId": 8436,
        "LocalIpAddress": "::1:44388",
        "RemoteIpAddress": "::1"
      }

要查看的錯誤消息是Client not authorized for resource owner flow, check the AllowedGrantTypes setting{ client_id = WebApplication4.Client } 。

在此處輸入圖像描述

有了這個錯誤消息，我發現了這個問題：

關於 ASP.NET Core 3 Identity / Identity Server / SPA 對資源所有者密碼授予類型的支持的問題

在那里我可以閱讀

發現當配置文件設置為 IdentityServerSPA 時，未添加允許的密碼授予類型。

查看appsettings.json應用程序使用該配置文件：

"IdentityServer": {
  "Clients": {
    "WebApplication4.Client": {
      "Profile": "IdentityServerSPA"
    }
  }
},

查看Microsoft Application profiles它的實際作用是：

  • redirect_uri 默認為 /authentication/login-callback。
  • post_logout_redirect_uri 默認為 /authentication/logout-callback。
  • 范圍集包括為應用程序中的 API 定義的 openid、配置文件和每個 scope。
  • 允許的 OIDC 響應類型集是 id_token 令牌或每個單獨的（id_token、令牌）。
  • 允許的響應模式是片段。

https://docs.microsoft.com/en-us/aspnet/core/security/authentication/identity-api-authorization?view=aspnetcore-5.0#application-profiles

在開始修改之前，我訪問了 URL https://localhost:44388/.well-known/openid-configuration以獲取當前配置。 它看起來像這樣，特別是grant_types_supported: ...password ：

{
    "issuer": "https://localhost:44388",
    "jwks_uri": "https://localhost:44388/.well-known/openid-configuration/jwks",
    "authorization_endpoint": "https://localhost:44388/connect/authorize",
    "token_endpoint": "https://localhost:44388/connect/token",
    "userinfo_endpoint": "https://localhost:44388/connect/userinfo",
    "end_session_endpoint": "https://localhost:44388/connect/endsession",
    "check_session_iframe": "https://localhost:44388/connect/checksession",
    "revocation_endpoint": "https://localhost:44388/connect/revocation",
    "introspection_endpoint": "https://localhost:44388/connect/introspect",
    "device_authorization_endpoint": "https://localhost:44388/connect/deviceauthorization",
    "frontchannel_logout_supported": true,
    "frontchannel_logout_session_supported": true,
    "backchannel_logout_supported": true,
    "backchannel_logout_session_supported": true,
    "scopes_supported": [
        "openid",
        "profile",
        "WebApplication4.ServerAPI",
        "offline_access"
    ],
    "claims_supported": [
        "sub",
        "name",
        "family_name",
        "given_name",
        "middle_name",
        "nickname",
        "preferred_username",
        "profile",
        "picture",
        "website",
        "gender",
        "birthdate",
        "zoneinfo",
        "locale",
        "updated_at"
    ],
    "grant_types_supported": [
        "authorization_code",
        "client_credentials",
        "refresh_token",
        "implicit",
        "password",
        "urn:ietf:params:oauth:grant-type:device_code"
    ],
    "response_types_supported": [
        "code",
        "token",
        "id_token",
        "id_token token",
        "code id_token",
        "code token",
        "code id_token token"
    ],
    "response_modes_supported": [
        "form_post",
        "query",
        "fragment"
    ],
    "token_endpoint_auth_methods_supported": [
        "client_secret_basic",
        "client_secret_post"
    ],
    "id_token_signing_alg_values_supported": [
        "RS256"
    ],
    "subject_types_supported": [
        "public"
    ],
    "code_challenge_methods_supported": [
        "plain",
        "S256"
    ],
    "request_parameter_supported": true
}

由於某種原因，無法在代碼和appsettings.json中配置IdentityServer Clients 。 因此，我從appsettings.json中刪除了Clients並將其添加到 Startup.cs：

services.AddIdentityServer()
    .AddApiAuthorization<ApplicationUser, ApplicationDbContext>(options =>
    {
        options.Clients.AddIdentityServerSPA("WebApplication4.Client", builder =>
        {
            builder.WithRedirectUri("/authentication/login-callback");
            builder.WithLogoutRedirectUri("/authentication/logout-callback");
        });
        options.Clients.Add(new IdentityServer4.Models.Client
        {
            ClientId = "WebApplication4.Integration",
            AllowedGrantTypes = { GrantType.ResourceOwnerPassword },
            AllowedScopes = { "WebApplication4.ServerAPI", "openid", "profile" }
        });
    });

沒有WithRedirectUri和WithLogoutRedirectUri它不起作用， OidcConfigurationController得到了ClientRequestParametersProvider.GetClientParameters(HttpContext, clientId); with System.InvalidOperationException: 'Sequence contains no elements' 。 由於某種原因，使用appsettings.json時會自動修復此問題。

我現在在發布到/connect/token時收到錯誤消息：

{
    "error": "invalid_client"
}

但是我在日志中得到了一個更好的錯誤：

Invalid client configuration for client WebApplication4.Integration: Client secret is required for password, but no client secret is configured.

向Startup.cs添加了一個秘密：

services.AddIdentityServer()
    .AddApiAuthorization<ApplicationUser, ApplicationDbContext>(options =>
    {
        options.Clients.AddIdentityServerSPA("WebApplication4.Client", builder =>
        {
            builder.WithRedirectUri("/authentication/login-callback");
            builder.WithLogoutRedirectUri("/authentication/logout-callback");
        });
        options.Clients.Add(new IdentityServer4.Models.Client
        {
            ClientId = "WebApplication4.Integration",
            AllowedGrantTypes = { GrantType.ResourceOwnerPassword },
            //Use Configuration.GetSection("MySecretValue").Value; to get a value from appsettings.json
            ClientSecrets = { new Secret("MySecretValue".Sha256()) },
            AllowedScopes = { "WebApplication4.ServerAPI", "openid", "profile" }
        });
    });

和請求：

POST /connect/token HTTP/1.1
Host: localhost:44388
Content-Type: application/x-www-form-urlencoded
Content-Length: 168

grant_type=password&username=example%40example.com&password=Password1!&client_id=WebApplication4.Integration&scope=WebApplication4.ServerAPI&client_secret=MySecretValue

它終於奏效了，正常的登錄流程也奏效了！

在此處輸入圖像描述

暫無
暫無

聲明:本站的技術帖子網頁，遵循CC BY-SA 4.0協議，如果您需要轉載，請注明本站網址或者原文地址。任何問題請咨詢:yoyou2525@163.com.

相關問題 Blazor WebAssembly 應用程序與個人帳戶和 ASP.NET 核心托管 - 禁用用戶注冊 Blazor WebAssembly 應用程序與個人帳戶和 ASP.NET 核心托管 - IIS - SQLLocalDB 15.0 找不到指定的資源語言 ID 部署托管到 Azure 的 Blazor WebAssembly 應用 ASP.NET Core 如何使用 ASP.NET 核心托管發布 Blazor WebAssembly 在 ASP.NET 核心 Web 應用程序中使用存儲在應用程序中的單個用戶帳戶模擬登錄時出現 400 錯誤請求錯誤 Blazor Webassembly (PWA) 是否支持獨立的 session 存儲（不在 asp.net 內核中托管）？ 托管在 ASP.NET Core 項目上的 Blazor Webassembly 項目中的身份驗證問題 ClaimTypes.NameIdentifier 在 Blazor WebAssembly ASP.NET 核心托管中始終返回 null 從 Blazor WebAssembly (WASM) 項目調用外國 API（**不是** ASP.Net Core，托管） 移動呈現不正確 Azure 應用服務 Blazor Webassembly（ASP.NET 托管）
相關標簽
 
粵ICP備18138465號  © 2020-2024 STACKOOM.COM