【ASP.NET Core分布式项目实战】（三）整理IdentityServer4 MVC授权、Consent功能实现

前言

由于之前的博客都是基于其他的博客进行开发，现在重新整理一下方便以后后期使用与学习

新建IdentityServer4服务端

服务端也就是提供服务，如QQ Weibo等。

新建项目解决方案AuthSample.

新建一个ASP.NET Core Web Application 项目MvcCookieAuthSample，选择模板Web 应用程序 不进行身份验证。

给网站设置默认地址     http://localhost:5000

第一步：添加Nuget包：IdentityServer4

添加IdentityServer4 引用：

Install-Package IdentityServer4

第二步：添加Config.cs配置类

然后添加配置类Config.cs：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using IdentityServer4;
using IdentityServer4.Models;
using IdentityServer4.Test;

namespace MvcCookieAuthSample
{
    public class Config
    {
        //所有可以访问的Resource
        public static IEnumerable GetApiResources()
        {
            return new List()
            {
                new ApiResource("api1","API Application")
            };
        }

        //客户端
        public static IEnumerable GetClients()
        {
            return new List
            {
                new Client{
                    ClientId="mvc",
                    AllowedGrantTypes=GrantTypes.Implicit,//模式：隐式模式
                    ClientSecrets={//私钥
                        new Secret("secret".Sha256())
                    },
                    AllowedScopes={//运行访问的资源
                        IdentityServerConstants.StandardScopes.Profile,
                        IdentityServerConstants.StandardScopes.OpenId,
                    },
                    RedirectUris={"http://localhost:5001/signin-oidc"},//跳转登录到的客户端的地址
                    PostLogoutRedirectUris={"http://localhost:5001/signout-callback-oidc"},//跳转登出到的客户端的地址
                    RequireConsent=false//是否需要用户点击确认进行跳转
                }
            };
        }

        //测试用户
        public static List GetTestUsers()
        {
            return new List
            {
                new TestUser{
                    SubjectId="10000",
                    Username="wyt",
                    Password="password"
                }
            };
        }

        //定义系统中的资源
        public static IEnumerable GetIdentityResources()
        {
            return new List
            {
                //这里实际是claims的返回资源
                new IdentityResources.OpenId(),
                new IdentityResources.Profile(),
                new IdentityResources.Email()
            };
        }

    }
}

View Code

 

第三步：添加Startup配置

引用命名空间：

using IdentityServer4;

然后打开Startup.cs 加入如下：

services.AddIdentityServer()
                .AddDeveloperSigningCredential()//添加开发人员签名凭据
                .AddInMemoryApiResources(Config.GetApiResources())//添加内存apiresource
                .AddInMemoryClients(Config.GetClients())//添加内存client
                .AddInMemoryIdentityResources(Config.GetIdentityResources())//添加系统中的资源
                .AddTestUsers(Config.GetTestUsers());//添加测试用户

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    ...
    app.UseIdentityServer();
    ...
}

注册登录实现

我们还需要新建一个ViewModels，在ViewModels中新建RegisterViewModel.cs和LoginViewModel.cs来接收表单提交的值以及来进行强类型视图

using System.ComponentModel.DataAnnotations;

namespace MvcCookieAuthSample.ViewModels
{
    public class RegisterViewModel
    {
        [Required]//必须的
        [DataType(DataType.EmailAddress)]//内容检查是否为邮箱
        public string Email { get; set; }

        [Required]//必须的
        [DataType(DataType.Password)]//内容检查是否为密码
        public string Password { get; set; }

        [Required]//必须的
        [DataType(DataType.Password)]//内容检查是否为密码
        public string ConfirmedPassword { get; set; }
    }
}

View Code

using System;
using System.Collections.Generic;
using System.ComponentModel.DataAnnotations;
using System.Linq;
using System.Threading.Tasks;

namespace MvcCookieAuthSample.ViewModels
{
    public class LoginViewModel
    {

        [Required]
        public string UserName { get; set; }

        [Required]//必须的
        [DataType(DataType.Password)]//内容检查是否为密码
        public string Password { get; set; }
    }
}

View Code

在Controllers文件夹下新建AdminController.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;

namespace MvcCookieAuthSample.Controllers
{
    public class AdminController : Controller
    {
        public IActionResult Index()
        {
            return View();
        }
    }
}

View Code

在Views文件夹下新建Admin文件夹，并在Admin文件夹下新建Index.cshtml

@{
    ViewData["Title"] = "Admin";
}
@ViewData["Title"]

Admin Page

View Code

在Controllers文件夹下新建AccountController.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using IdentityServer4.Test;
using Microsoft.AspNetCore.Identity;
using MvcCookieAuthSample.ViewModels;
using Microsoft.AspNetCore.Authentication;

namespace MvcCookieAuthSample.Controllers
{
    public class AccountController : Controller
    {
        private readonly TestUserStore _users;
        public AccountController(TestUserStore users)
        {
            _users = users;
        }

        //内部跳转
        private IActionResult RedirectToLocal(string returnUrl)
        {
            if (Url.IsLocalUrl(returnUrl))
            {//如果是本地
                return Redirect(returnUrl);
            }

            return RedirectToAction(nameof(HomeController.Index), "Home");
        }

        //添加验证错误
        private void AddError(IdentityResult result)
        {
            //遍历所有的验证错误
            foreach (var error in result.Errors)
            {
                //返回error到model
                ModelState.AddModelError(string.Empty, error.Description);
            }
        }

        public IActionResult Register(string returnUrl = null)
        {
            ViewData["returnUrl"] = returnUrl;
            return View();
        }

        [HttpPost]
        public async Task Register(RegisterViewModel registerViewModel, string returnUrl = null)
        {
            return View();
        }

        public IActionResult Login(string returnUrl = null)
        {
            ViewData["returnUrl"] = returnUrl;
            return View();
        }

        [HttpPost]
        public async Task Login(LoginViewModel loginViewModel, string returnUrl = null)
        {
            if (ModelState.IsValid)
            {
                ViewData["returnUrl"] = returnUrl;
                var user = _users.FindByUsername(loginViewModel.UserName);

                if (user==null)
                {
                    ModelState.AddModelError(nameof(loginViewModel.UserName), "UserName not exists");
                }
                else
                {
                    if (_users.ValidateCredentials(loginViewModel.UserName,loginViewModel.Password))
                    {
                        //是否记住
                        var prop = new AuthenticationProperties
                        {
                            IsPersistent = true,
                            ExpiresUtc = DateTimeOffset.UtcNow.Add(TimeSpan.FromMinutes(30))
                        };

                        await Microsoft.AspNetCore.Http.AuthenticationManagerExtensions.SignInAsync(HttpContext, user.SubjectId, user.Username, prop);
                    }
                }

                return RedirectToLocal(returnUrl);
            }

            return View();
        }

        public async Task Logout()
        {
            await HttpContext.SignOutAsync();
            return RedirectToAction("Index", "Home");
        }
    }
}

View Code

然后在Views文件夹下新增Account文件夹并新增Register.cshtml与Login.cshtml视图

@{
    ViewData["Title"] = "Register";
}

@using MvcCookieAuthSample.ViewModels;
@model RegisterViewModel;

@ViewData["Title"]
@ViewData["Message"]

class="row">
    
class="col-md-4">
        @* 这里将asp-route-returnUrl="@ViewData["returnUrl"]，就可以在进行register的post请求的时候接收到returnUrl *@
        
"post" asp-route-returnUrl="@ViewData["returnUrl"]">
            
Create a new account.
            


           @*统一显示错误信息*@
            
class="text-danger" asp-validation-summary="All">

            
class="form-group">
                for="Email">
                for="Email" class="form-control" />
                for="Email" class="text-danger">
            
            
class="form-group">
                for="Password">
                for="Password" class="form-control" />
                for="Password" class="text-danger">
            
            
class="form-group">
                for="ConfirmedPassword">
                for="ConfirmedPassword" class="form-control" />
                for="ConfirmedPassword" class="text-danger">
            
            "submit" class="btn btn-default">Register
        
    

View Code

@{
    ViewData["Title"] = "Login";
}

@using MvcCookieAuthSample.ViewModels;
@model LoginViewModel;

class="row">
    
class="col-md-4">
        

            
"post" asp-controller="Account" asp-action="Login"  asp-route-returnUrl="@ViewData["returnUrl"]">
                
Use a local account to log in.
                


                 @*统一显示错误信息*@
                
class="text-danger" asp-validation-summary="All">

                
class="form-group">
                    for="UserName">
                    for="UserName" class="form-control" />
                    for="UserName" class="text-danger">
                

                
class="form-group">
                    for="Password">
                    for="Password" type="password" class="form-control" />
                    for="Password" class="text-danger">
                

                
class="form-group">
                    "submit" class="btn btn-default">Log in
                

            
        
    


@section Scripts
    {
    @await Html.PartialAsync("_ValidationScriptsPartial")
}

View Code

我们接下来要修改_Layout.cshtml视图页面判断注册/登陆按钮是否应该隐藏

完整的_Layout.cshtml代码:

    "utf-8" />
    "viewport" content="width=device-width, initial-scale=1.0" />
    

    "Development">
        "stylesheet" href="~/lib/bootstrap/dist/css/bootstrap.css" />
        "stylesheet" href="~/css/site.css" />
    
    "Development">
        "stylesheet" href="https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.7/css/bootstrap.min.css"
              asp-fallback-href="~/lib/bootstrap/dist/css/bootstrap.min.css"
              asp-fallback-test-class="sr-only" asp-fallback-test-property="position" asp-fallback-test-value="absolute" />
        "stylesheet" href="~/css/site.min.css" asp-append-version="true" />
    


    
class="navbar navbar-inverse navbar-fixed-top">
        
class="container">
            
class="navbar-header">
                "button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
                    class="sr-only">Toggle navigation
                    class="icon-bar">
                    class="icon-bar">
                    class="icon-bar">
                
                "" asp-controller="Home" asp-action="Index" class="navbar-brand">MvcCookieAuthSample
            
            
class="navbar-collapse collapse">
                
class="nav navbar-nav">
                    
"" asp-controller="Home" asp-action="Index">Home
                    
"" asp-controller="Home" asp-action="About">About
                    
"" asp-controller="Home" asp-action="Contact">Contact
                


                @if (User.Identity.IsAuthenticated)
                {
                    
"Logout" asp-controller="Account" method="post">
                        
class="nav navbar-nav navbar-right">
                            

                                "Welcome" asp-controller="Admin" asp-action="Index">@User.Identity.Name
                            
                            

                                "submit" class="btn btn-link navbar-btn navbar-link">Log out
                            
                        
                    


                }
                else
                {
                    
class="nav navbar-nav navbar-right">
                        
"" asp-controller="Account" asp-action="Register">Register
                        
"" asp-controller="Account" asp-action="Login">Log in
                    

                }


            
        
    
    
class="container body-content">
        @RenderBody()
        

        

            
© 2018 - MvcCookieAuthSample
        
    

    "Development">
        
        
        
    
    "Development">
        
        
        
    

    @RenderSection("Scripts", required: false)

View Code

最后给AdminController加上  [Authorize]  特性标签即可　　

然后我们就可以运行网站，输入用户名和密码进行登录了

新建客户端 

新建一个MVC网站MvcClient 

dotnet new mvc --name MvcClient

给网站设置默认地址     http://localhost:5001

MVC的网站已经内置帮我们实现了Identity，所以我们不需要再额外添加Identity引用

添加认证

services.AddAuthentication(options =>
{
    options.DefaultScheme = "Cookies";//使用Cookies认证
    options.DefaultChallengeScheme = "oidc";//使用oidc
})
.AddCookie("Cookies")//配置Cookies认证
.AddOpenIdConnect("oidc",options=> {//配置oidc
    options.SignInScheme = "Cookies";
    options.Authority = "http://localhost:5000";
    options.RequireHttpsMetadata = false;

    options.ClientId = "mvc";
    options.ClientSecret = "secret";
    options.SaveTokens = true;
});

在管道中使用Authentication

app.UseAuthentication();

接下来我们在HomeController上打上  [Authorize]  标签，然后启动运行

我们这个时候访问首页http://localhost:5001会自动跳转到ocalhost:5000/account/login登录

登录之后会自动跳转回来

我们可以在Home/About页面将claim的信息显示出来

@{
    ViewData["Title"] = "About";
}
@ViewData["Title"]
@ViewData["Message"]


    @foreach (var claim in User.Claims)
    {
        
@claim.Type
        
@claim.Value

    }

View Code

 

 

 这边的内容是根据我们在IdentityServer服务中定义的返回资源决定的

Consent功能实现 

首先在ViewModels文件夹下创建两个视图模型

ScopeViewModel.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace MvcCookieAuthSample.ViewModels
{
    //领域
    public class ScopeViewModel
    {
        public string Name { get; set; }
        public string DisplayName { get; set; }
        public string Description { get; set; }
        public bool Emphasize { get; set; }
        public bool Required { get; set; }
        public bool Checked { get; set; }
    }
}

View Code

ConsentViewModel.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace MvcCookieAuthSample.ViewModels
{
    public class ConsentViewModel
    {
        public string ClientId { get; set; }
        public string ClientName { get; set; }
        public string ClientUrl { get; set; }
        public string ClientLogoUrl { get; set; }
        public bool AllowRememberConsent { get; set; }

        public IEnumerable IdentityScopes { get; set; }
        public IEnumerable ResourceScopes { get; set; }
    }
}

View Code

 

我们在MvcCookieAuthSample项目中添加新控制器ConsentController

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using MvcCookieAuthSample.ViewModels;
using IdentityServer4.Models;
using IdentityServer4.Services;
using IdentityServer4.Stores;

namespace MvcCookieAuthSample.Controllers
{
    public class ConsentController : Controller
    {
        private readonly IClientStore _clientStore;
        private readonly IResourceStore _resourceStore;
        private readonly IIdentityServerInteractionService _identityServerInteractionService;

        public ConsentController(IClientStore clientStore, IResourceStore resourceStore, IIdentityServerInteractionService identityServerInteractionService)
        {
            _clientStore = clientStore;
            _resourceStore = resourceStore;
            _identityServerInteractionService = identityServerInteractionService;
        }

        private async Task BuildConsentViewModel(string returnUrl)
        {
            var request =await _identityServerInteractionService.GetAuthorizationContextAsync(returnUrl);
            if (request == null)
                return null;

            var client =await  _clientStore.FindEnabledClientByIdAsync(request.ClientId);
            var resources =await _resourceStore.FindEnabledResourcesByScopeAsync(request.ScopesRequested);

            return CreateConsentViewModel(request, client, resources);
        }

        private ConsentViewModel CreateConsentViewModel(AuthorizationRequest request,Client client,Resources resources)
        {
            var vm = new ConsentViewModel();
            vm.ClientName = client.ClientName;
            vm.ClientLogoUrl = client.LogoUri;
            vm.ClientUrl = client.ClientUri;
            vm.AllowRememberConsent = client.AllowRememberConsent;

            vm.IdentityScopes = resources.IdentityResources.Select(i => CreateScopeViewModel(i));
            vm.ResourceScopes = resources.ApiResources.SelectMany(i =>i.Scopes).Select(i=>CreateScopeViewModel(i));

            return vm;
        }

        private ScopeViewModel CreateScopeViewModel(IdentityResource identityResource)
        {
            return new ScopeViewModel
            {
                Name = identityResource.Name,
                DisplayName = identityResource.DisplayName,
                Description = identityResource.Description,
                Required = identityResource.Required,
                Checked = identityResource.Required,
                Emphasize = identityResource.Emphasize
            };
        }

        private ScopeViewModel CreateScopeViewModel(Scope scope)
        {
            return new ScopeViewModel
            {
                Name = scope.Name,
                DisplayName = scope.DisplayName,
                Description = scope.Description,
                Required = scope.Required,
                Checked = scope.Required,
                Emphasize = scope.Emphasize
            };
        }

       [HttpGet]
        public async Task Index(string returnUrl)
        {
            var model =await BuildConsentViewModel(returnUrl);
            if (model==null)
            {

            }
            return View(model);
        }
    }
}

View Code

 

然后新建Idenx.cshtml视图和_ScopeListitem.cshtml分部视图

_ScopeListitem.cshtml

@using MvcCookieAuthSample.ViewModels;
@model ScopeViewModel

<li>
    <label>
        <input type="checkbox" name="ScopesConsented" id="[email protected]" value="@Model.Name" checked="@Model.Checked" disabled="@Model.Required"/>

        <strong>@Model.Namestrong>
        @if (Model.Emphasize)
        {
            <span class="glyphicon glyphicon-exclamation-sign">span>
        }
    label>
    @if (string.IsNullOrWhiteSpace(Model.Description))
    {
        <div>
            <label for="[email protected]">@Model.Descriptionlabel>
        div>
    }
li>

View Code

Idenx.cshtml

@using MvcCookieAuthSample.ViewModels;
@model ConsentViewModel
<p>Consent Pagep>

<div class="row page-header">
    <div class="col-sm-10">
        @if (!string.IsNullOrWhiteSpace(Model.ClientLogoUrl))
        {
            <div><img src="@Model.ClientLogoUrl" />div>
        }

        <h1>
            @Model.ClientName
            <small>希望使用你的账户small>
        h1>
    div>
div>


<div class="row">
    <div class="col-sm-8">
        <form asp-action="Index">
            @if (Model.IdentityScopes.Any())
            {
                <div>
                    <div class="panel-heading">
                        <span class="glyphicon glyphicon-user">span>
                        用户信息
                    div>
                    <ul class="list-group">
                        @foreach (var scope in Model.IdentityScopes)
                        {
                            @Html.Partial("_ScopeListitem",scope)
                        }
                    ul>
                div>
            }
            @if (Model.ResourceScopes.Any())
            {
                <div>
                    <div class="panel-heading">
                        <span class="glyphicon glyphicon-tasks">span>
                        应用权限
                    div>
                    <ul class="list-group">
                        @foreach (var scope in Model.ResourceScopes)
                        {
                            @Html.Partial("_ScopeListitem",scope)
                        }
                    ul>
                div>
            }
        form>
    div>
div>

View Code

 

最后我们修改Config.cs，增加一些信息

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using IdentityServer4;
using IdentityServer4.Models;
using IdentityServer4.Test;

namespace MvcCookieAuthSample
{
    public class Config
    {
        //所有可以访问的Resource
        public static IEnumerable GetApiResources()
        {
            return new List()
            {
                new ApiResource("api1","API Application")
            };
        }

        //客户端
        public static IEnumerable GetClients()
        {
            return new List
            {
                new Client{
                    ClientId="mvc",
                    AllowedGrantTypes=GrantTypes.Implicit,//模式：隐式模式
                    ClientSecrets={//私钥
                        new Secret("secret".Sha256())
                    },
                    AllowedScopes={//运行访问的资源
                        IdentityServerConstants.StandardScopes.Profile,
                        IdentityServerConstants.StandardScopes.OpenId,
                        IdentityServerConstants.StandardScopes.Email,
                    },
                    RedirectUris={"http://localhost:5001/signin-oidc"},//跳转登录到的客户端的地址
                    PostLogoutRedirectUris={"http://localhost:5001/signout-callback-oidc"},//跳转登出到的客户端的地址
                    RequireConsent=true,//是否需要用户点击确认进行跳转,改为点击确认后进行跳转

                    ClientName="MVC Clent",
                    ClientUri="http://localhost:5001",
                    LogoUri="https://chocolatey.org/content/packageimages/aspnetcore-runtimepackagestore.2.0.0.png",
                    AllowRememberConsent=true,
                }
            };
        }

        //测试用户
        public static List GetTestUsers()
        {
            return new List
            {
                new TestUser{
                    SubjectId="10000",
                    Username="wyt",
                    Password="password",
                    
                }
            };
        }

        //定义系统中的资源
        public static IEnumerable GetIdentityResources()
        {
            return new List
            {
                //这里实际是claims的返回资源
                new IdentityResources.OpenId(),
                new IdentityResources.Profile(),
                new IdentityResources.Email()
            };
        }

    }
}

 

我们这个时候访问首页http://localhost:5001会自动跳转到ocalhost:5000/account/login登录

登录之后会自动跳转到登录确认页面

Consent 确认逻辑实现

首先我们在 ViewModels 文件夹中增加一个类 InputConsentViewModel.cs 用于接收 Consent/Index.cshtml 提交的表单信息

public class InputConsentViewModel
{
    /// 

    /// 按钮
    /// 
    public string Button { get; set; }
    /// 

    /// 接收到的勾选的Scope
    /// 
    public IEnumerable<string> ScopesConsented { get; set; }
    /// 

    /// 是否选择记住
    /// 
    public bool RememberConsent { get; set; }
    /// 

    /// 跳转地址
    /// 
    public string ReturnUrl { get; set; }
}

View Code

然后修改 ConsentViewModel.cs ，加入ReturnUrl

public class ConsentViewModel
{
    public string ClientId { get; set; }
    public string ClientName { get; set; }
    public string ClientUrl { get; set; }
    public string ClientLogoUrl { get; set; }
    public bool AllowRememberConsent { get; set; }

    public IEnumerable IdentityScopes { get; set; }
    public IEnumerable ResourceScopes { get; set; }

    public string ReturnUrl { get; set; }
}

然后修改 Consent\Index.cshtml ，加入ReturnUrl

然后修改 Controllers\ConsentController.cs 中的 BuildConsentViewModel 方法

private async Task BuildConsentViewModel(string returnUrl)
{
    AuthorizationRequest request = await _identityServerInteractionService.GetAuthorizationContextAsync(returnUrl);
    if (request == null)
    {
        return null;
    }

    Client client = await _clientStore.FindEnabledClientByIdAsync(request.ClientId);
    Resources resources = await _resourceStore.FindEnabledResourcesByScopeAsync(request.ScopesRequested);

    var vm= CreateConsentViewModel(request, client, resources);
    vm.ReturnUrl = returnUrl;
    return vm;
}

然后在 Controllers\ConsentController.cs 中添加action

[HttpPost]
public async Task Index(InputConsentViewModel viewModel)
{
    ConsentResponse consentResponse=null;
    if (viewModel.Button == "no")
    {
        consentResponse= ConsentResponse.Denied;
    }
    else if (viewModel.Button == "yes")
    {
        if (viewModel.ScopesConsented!=null&&viewModel.ScopesConsented.Any())
        {
            consentResponse = new ConsentResponse()
            {
                RememberConsent = viewModel.RememberConsent,
                ScopesConsented = viewModel.ScopesConsented
            };
        }
    }

    if ( consentResponse!=null)
    {
        var request =await _identityServerInteractionService.GetAuthorizationContextAsync(viewModel.ReturnUrl);
        await _identityServerInteractionService.GrantConsentAsync(request, consentResponse);
        return Redirect(viewModel.ReturnUrl);
    }

    var model = await BuildConsentViewModel(viewModel.ReturnUrl);
    if (model == null)
    {

    }

    return View(model);
}

View Code

然后将 ViewModels\ConsentViewModel.cs 中 ConsentViewModel 的 AllowRememberConsent 改为 RememberConsent ，这样才能与 ViewModels\InputConsentViewModel.cs 保持一致

public class ConsentViewModel:InputConsentViewModel
{
    public string ClientId { get; set; }
    public string ClientName { get; set; }
    public string ClientUrl { get; set; }
    public string ClientLogoUrl { get; set; }
    //public bool RememberConsent { get; set; }
    public IEnumerable IdentityScopes { get; set; }
    public IEnumerable ResourceScopes { get; set; }
    //public string ReturnUrl { get; set; }
}

最后修改视图 Consent\Index.cshtml ，加入记住选项和确认按钮

@using MvcCookieAuthSample.ViewModels;
@model ConsentViewModel
Consent Page

class="row page-header">
    
class="col-sm-10">
        @if (!string.IsNullOrWhiteSpace(Model.ClientLogoUrl))
        {
            
"@Model.ClientLogoUrl" />

        }

        

            @Model.ClientId
            希望使用您的账户
        
    



class="row">
    
class="col-sm-8">
        
"Index" method="post">
            "hidden" asp-for="ReturnUrl"/>
            @if (Model.IdentityScopes.Any())
            {
                

                    
class="panel-heading">
                        class="glyphicon glyphicon-user">
                        用户信息
                    
                    
class="list-group">
                        @foreach (var scope in Model.IdentityScopes)
                        {
                            @Html.Partial("_ScopeListitem", scope)
                        }
                    
                

            }
            @if (Model.ResourceScopes.Any())
            {
                

                    
class="panel-heading">
                        class="glyphicon glyphicon-tasks">
                        应用权限
                    
                    
class="list-group">
                        @foreach (var scope in Model.ResourceScopes)
                        {
                            @Html.Partial("_ScopeListitem", scope)
                        }
                    
                

            }
            
            

                
                    "checkbox" asp-for="RememberConsent"/>
                    记住我的选择
                
            

            

                "button" value="yes" class="btn btn-primary" autofocus>同意
                "button" value="no" >取消
                @if (!string.IsNullOrEmpty(Model.ClientUrl))
                {
                    "@Model.ClientUrl" class="pull-right btn btn-default">
                        class="glyphicon glyphicon-info-sign">
                        @Model.ClientUrl
                    
                }
            
        
    

View Code

修改视图 Views\Consent\_ScopeListitem.cshtml 

@using MvcCookieAuthSample.ViewModels;
@model ScopeViewModel


    
        "checkbox" name="ScopesConsented" id="[email protected]" value="@Model.Name" checked="@Model.Checked" disabled="@Model.Required"/>
        @if (Model.Required)
        {
            "hidden" name="ScopesConsented" value="@Model.Name"/>
        }

        @Model.Name
        @if (Model.Emphasize)
        {
            class="glyphicon glyphicon-exclamation-sign">
        }
    
    
    @if (!string.IsNullOrWhiteSpace(Model.Description))
    {
        

            for="[email protected]">@Model.Description
        

    }

View Code

运行效果

Asp.Net Core2.2源码：链接: https://pan.baidu.com/s/1pndxJwqpTsHmNmfQsQ0_2w 提取码: jxwd

Consent 代码重构

新建 Services 文件夹，添加 ConsentService.cs 用于业务封装

public class ConsentService
    {
        private readonly IClientStore _clientStore;
        private readonly IResourceStore _resourceStore;
        private readonly IIdentityServerInteractionService _identityServerInteractionService;

        public ConsentService(IClientStore clientStore
            , IResourceStore resourceStore
            , IIdentityServerInteractionService identityServerInteractionService)
        {
            _clientStore = clientStore;
            _resourceStore = resourceStore;
            _identityServerInteractionService = identityServerInteractionService;
        }

        public async Task BuildConsentViewModel(string returnUrl,InputConsentViewModel model=null)
        {
            AuthorizationRequest request = await _identityServerInteractionService.GetAuthorizationContextAsync(returnUrl);
            if (request == null)
            {
                return null;
            }

            Client client = await _clientStore.FindEnabledClientByIdAsync(request.ClientId);
            Resources resources = await _resourceStore.FindEnabledResourcesByScopeAsync(request.ScopesRequested);

            var vm = CreateConsentViewModel(request, client, resources,model);
            vm.ReturnUrl = returnUrl;
            return vm;
        }

        public async Task ProcessConsent(InputConsentViewModel model)
        {
            ConsentResponse consentResponse = null;
            var result=new ProcessConsentResult();
            if (model.Button == "no")
            {
                consentResponse = ConsentResponse.Denied;
            }
            else if (model.Button == "yes")
            {
                if (model.ScopesConsented != null && model.ScopesConsented.Any())
                {
                    consentResponse = new ConsentResponse()
                    {
                        RememberConsent = model.RememberConsent,
                        ScopesConsented = model.ScopesConsented
                    };
                }
                else
                {
                    result.ValidationError = "请至少选择一个权限";
                }
            }

            if (consentResponse != null)
            {
                var request = await _identityServerInteractionService.GetAuthorizationContextAsync(model.ReturnUrl);
                await _identityServerInteractionService.GrantConsentAsync(request, consentResponse);
                result.RedirectUrl = model.ReturnUrl;
            }
            else
            {
                ConsentViewModel consentViewModel = await BuildConsentViewModel(model.ReturnUrl,model);
                result.ViewModel = consentViewModel;
            }

            return result;
        }

        #region Private Methods

        private ConsentViewModel CreateConsentViewModel(AuthorizationRequest request, Client client,
            Resources resources,InputConsentViewModel model)
        {
            var rememberConsent = model?.RememberConsent ?? true;
            var selectedScopes = model?.ScopesConsented ?? Enumerable.Empty<string>();

            var vm = new ConsentViewModel();
            vm.ClientName = client.ClientName;
            vm.ClientLogoUrl = client.LogoUri;
            vm.ClientUrl = client.ClientUri;
            vm.RememberConsent = rememberConsent;

            vm.IdentityScopes = resources.IdentityResources.Select(i => CreateScopeViewModel(i,selectedScopes.Contains(i.Name)||model==null));
            vm.ResourceScopes = resources.ApiResources.SelectMany(i => i.Scopes).Select(i => CreateScopeViewModel(i, selectedScopes.Contains(i.Name)||model==null));

            return vm;
        }

        private ScopeViewModel CreateScopeViewModel(IdentityResource identityResource,bool check)
        {
            return new ScopeViewModel()
            {
                Name = identityResource.Name,
                DisplayName = identityResource.DisplayName,
                Description = identityResource.Description,
                Required = identityResource.Required,
                Checked = check|| identityResource.Required,
                Emphasize = identityResource.Emphasize
            };
        }

        private ScopeViewModel CreateScopeViewModel(Scope scope, bool check)
        {
            return new ScopeViewModel()
            {
                Name = scope.Name,
                DisplayName = scope.DisplayName,
                Description = scope.Description,
                Required = scope.Required,
                Checked = check||scope.Required,
                Emphasize = scope.Emphasize
            };
        }
        #endregion
    }

View Code

Asp.Net Core2.2源码（重构）：链接: https://pan.baidu.com/s/1mVdPDfDiDVToLSV9quC5KQ 提取码: 3dsq

集成ASP.NETCore Identity

EF实现

首先我们添加一个Data文件夹

我们首先在Models文件夹下面新建ApplicationUser.cs与ApplicationUserRole.cs

ApplicationUser.cs代码：

using Microsoft.AspNetCore.Identity;

namespace MvcCookieAuthSample.Models
{
    public class ApplicationUser:IdentityUser<int>//不加int的话是默认主键为guid
    {
    }
}

ApplicationUserRole.cs代码：

using Microsoft.AspNetCore.Identity;

namespace MvcCookieAuthSample.Models
{
    public class ApplicationUserRole: IdentityRole<int>//不加int的话是默认主键为guid
    {
    }
}

然后在Data文件夹下新建一个ApplicationDbContext.cs类，使它继承IdentityDbContext

using Microsoft.AspNetCore.Identity.EntityFrameworkCore;
using Microsoft.EntityFrameworkCore;
using MvcCookieAuthSample.Models;

namespace MvcCookieAuthSample.Data
{
    public class ApplicationDbContext:IdentityDbContextint>
    {
        public ApplicationDbContext(DbContextOptions options):base(options)
        {

        }
    }
}

然后我们需要在Startup.cs添加EF的注册进来

//使用配置ApplicationDbContext使用sqlserver数据库，并配置数据库连接字符串
services.AddDbContext(options=> {
    options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection"));
});

然后我们需要在appsettings.json中配置数据库连接字符串

"ConnectionStrings": {
  "DefaultConnection": "Server=127.0.0.1;Database=aspnet-IdentitySample;Trusted_Connection=True;MultipleActiveResultSets=true;uid=sa;pwd=123456"
}

EF实现结束

Identity实现

我们需要在Startup.cs添加Identity的注册进来

//配置Identity
services.AddIdentity()
    .AddEntityFrameworkStores()
    .AddDefaultTokenProviders();

由于默认的Identity在密码上限制比较严格，我们把它改的宽松简单一点（不设置也行）

//修改Identity密码强度设置配置
services.Configure(options =>
{
    options.Password.RequireLowercase = false; //需要小写
    options.Password.RequireNonAlphanumeric = false; //需要字母
    options.Password.RequireUppercase = false; //需要大写
});

 

然后我们要修改 IdentityServer 的配置，首先要添加Nuget包

IdentityServer4.AspNetIdentity

services.AddIdentityServer()
    .AddDeveloperSigningCredential()//添加开发人员签名凭据
    .AddInMemoryApiResources(Config.GetApiResources())//添加内存apiresource
    .AddInMemoryClients(Config.GetClients())//添加内存client
    .AddInMemoryIdentityResources(Config.GetIdentityResources())//添加系统中的资源
    //.AddTestUsers(Config.GetTestUsers())//添加测试用户(这里不需要测试用户了)
    .AddAspNetIdentity();

然后我们修改AccountController，修改代码，替换掉TestUsers的功能

private readonly UserManager _userManager;//创建用户的
private readonly SignInManager _signInManager;//用来登录的
private readonly IIdentityServerInteractionService _interaction;
//依赖注入
public AccountController(UserManager userManager
    , SignInManager signInManager
    , IIdentityServerInteractionService interaction)
{
    _userManager = userManager;
    _signInManager = signInManager;
    _interaction = interaction;
}

完整的AccountController

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using IdentityServer4.Services;
using IdentityServer4.Test;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc;
using MvcCookieAuthSample.Models;
using MvcCookieAuthSample.ViewModels;

namespace MvcCookieAuthSample.Controllers
{
    public class AccountController : Controller
    {
        //private TestUserStore _users;

        //public AccountController(TestUserStore users)
        //{
        //    _users = users;
        //}

        private readonly UserManager _userManager;//创建用户的
        private readonly SignInManager _signInManager;//用来登录的
        private readonly IIdentityServerInteractionService _interaction;
        //依赖注入
        public AccountController(UserManager userManager
            , SignInManager signInManager
            , IIdentityServerInteractionService interaction)
        {
            _userManager = userManager;
            _signInManager = signInManager;
            _interaction = interaction;
        }

        public IActionResult Register(string returnUrl = null)
        {
            ViewData["returnUrl"] = returnUrl;
            return View();
        }

        [HttpPost]
        public async Task Register(RegisterViewModel registerViewModel, string returnUrl = null)
        {
            var identityUser = new ApplicationUser
            {
                Email = registerViewModel.Email,
                UserName = registerViewModel.Email,
                NormalizedUserName = registerViewModel.Email
            };
            var identityResult = await _userManager.CreateAsync(identityUser, registerViewModel.Password);
            if (identityResult.Succeeded)
            {
                return RedirectToAction("Index", "Home");
            }
            return View();
        }

        public IActionResult Login(string returnUrl = null)
        {
            ViewData["returnUrl"] = returnUrl;
            return View();
        }

        [HttpPost]
        public async Task Login(LoginViewModel loginViewModel, string returnUrl = null)
        {
            if (ModelState.IsValid)
            {
                ViewData["returnUrl"] = returnUrl;
                var user =await _userManager.FindByEmailAsync(loginViewModel.Email);
                if (user==null)
                {
                    ModelState.AddModelError(nameof(loginViewModel.Email),"UserName not exist");
                }
                else
                {
                    if (await _userManager.CheckPasswordAsync(user,loginViewModel.Password))
                    {
                        AuthenticationProperties prop = null;
                        if (loginViewModel.RememberMe)
                        {
                            prop = new AuthenticationProperties()
                            {
                                IsPersistent = true,
                                ExpiresUtc = DateTimeOffset.UtcNow.Add(TimeSpan.FromMinutes(30))
                            };
                        }

                        //await Microsoft.AspNetCore.Http.AuthenticationManagerExtensions.SignInAsync(HttpContext,
                        //    user.SubjectId, user.Username,prop);
                        //return RedirectToLocal(returnUrl);

                        await _signInManager.SignInAsync(user, prop);
                        if (_interaction.IsValidReturnUrl(returnUrl))
                        {
                            return Redirect(returnUrl);
                        }

                        return Redirect("~/");
                    }
                    ModelState.AddModelError(nameof(loginViewModel.Password),"Wrong Password");
                }

            }
            return View(loginViewModel);
        }

        public async Task LogOut()
        {
            await _signInManager.SignOutAsync();
            //await HttpContext.SignOutAsync();
            return RedirectToAction("Index", "Home");
        }

        //内部跳转
        private IActionResult RedirectToLocal(string returnUrl)
        {
            if (Url.IsLocalUrl(returnUrl))
            {
                return Redirect(returnUrl);
            }

            return RedirectToAction("Index", "Home");
        }

        //添加验证错误
        private void AddError(IdentityResult result)
        {
            //遍历所有的验证错误
            foreach (var error in result.Errors)
            {
                //返回error到model
                ModelState.AddModelError(string.Empty, error.Description);
            }
        }
    }
}

View Code

接下来我们重新生成一下，我们需要执行shell命令生成一下数据库

dotnet ef migrations add VSInit

这时候Migrations文件夹下已经有新增的数据库更新配置文件了

DbContextSeed初始化

由于我们现在每次EF实体模型变化的时候每次都是手动更改，我们想通过代码的方式让他自动更新，或者程序启动的时候添加一些数据进去

首先，在Data文件夹下添加一个ApplicationDbContextSeed.cs初始化类

public class ApplicationDbContextSeed
{
    private UserManager _userManager;

    public async Task SeedAsync(ApplicationDbContext context, IServiceProvider services)
    {
        if (!context.Users.Any())
        {
            _userManager = services.GetRequiredService>();

            var defaultUser = new ApplicationUser
            {
                UserName = "Administrator",
                Email = "[email protected]",
                NormalizedUserName = "admin"
            };

            var result = await _userManager.CreateAsync(defaultUser, "Password$123");
            if (!result.Succeeded)
            {
                throw new Exception("初始默认用户失败");
            }
        }
    }
}

View Code

那么如何调用呢？接下来我们写一个WebHost的扩展方法类WebHostMigrationExtensions.cs来调用ApplicationDbContextSeed方法

public static class WebHostMigrationExtensions
{
    public static IWebHost MigrateDbContext(this IWebHost host, Action sedder) where TContext : DbContext
    {
        using (var scope = host.Services.CreateScope())
        {//只在本区间内有效
            var services = scope.ServiceProvider;
            var logger = services.GetRequiredService>();
            var context = services.GetService();

            try
            {
                context.Database.Migrate();
                sedder(context, services);

                logger.LogInformation($"执行DBContext {typeof(TContext).Name} seed执行成功");
            }
            catch (Exception ex)
            {
                logger.LogError(ex, $"执行DBContext {typeof(TContext).Name} seed方法失败");
            }
        }

        return host;
    }
}

View Code

那么我们程序启动的时候要怎调用呢？

要在Program.cs中执行

public static void Main(string[] args)
{
    CreateWebHostBuilder(args).Build()
        //自动初始化数据库开始
        .MigrateDbContext((context, services) =>
            {
                new ApplicationDbContextSeed().SeedAsync(context, services).Wait();
            })
        //自动初始化数据库结束
        .Run();
}

然后运行即可自动化创建数据库和数据

ProfileService实现（调试）

在 Services 文件夹下添加 ProfileService.cs 

public class ProfileService : IProfileService
    {
        private readonly UserManager _userManager;//创建用户的

        public ProfileService(UserManager userManager)
        {
            _userManager = userManager;
        }

        private async Task> GetClaimsFromUserAsync(ApplicationUser user)
        {
            var claims=new List()
            {
                new Claim(JwtClaimTypes.Subject,user.Id.ToString()),
                new Claim(JwtClaimTypes.PreferredUserName,user.UserName)
            };

            var roles =await _userManager.GetRolesAsync(user);
            foreach (var role in roles)
            {
                claims.Add(new Claim(JwtClaimTypes.Role,role));
            }

            if (!string.IsNullOrWhiteSpace(user.Avatar))
            {
                claims.Add(new Claim("avatar", user.Avatar));
            }

            return claims;
        }

        public async Task GetProfileDataAsync(ProfileDataRequestContext context)
        {
            var subjectId = context.Subject.Claims.FirstOrDefault(c => c.Type == "sub").Value;
            var user = await _userManager.FindByIdAsync(subjectId);

            var claims =await GetClaimsFromUserAsync(user);
            context.IssuedClaims = claims;
        }

        public async Task IsActiveAsync(IsActiveContext context)
        {
            context.IsActive = false;

            var subjectId = context.Subject.Claims.FirstOrDefault(c => c.Type == "sub").Value;
            var user = await _userManager.FindByIdAsync(subjectId);

            context.IsActive = user != null;
        }
    }

View Code

修改 Config.cs 中的GetClients方法

public static IEnumerable GetClients()
{
    return new Client[]
    {
        new Client()
        {
            ClientId = "mvc",
            AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,//模式：混合模式
            ClientSecrets =//私钥
            {
                new Secret("secret".Sha256())
            },
            AllowedScopes =//运行访问的资源
            {
                IdentityServerConstants.StandardScopes.OpenId,
                IdentityServerConstants.StandardScopes.Profile,
                IdentityServerConstants.StandardScopes.Email,
                IdentityServerConstants.StandardScopes.OfflineAccess,
                "api1"

            },
            RedirectUris = { "http://localhost:5001/signin-oidc" },//跳转登录到的客户端的地址
            PostLogoutRedirectUris = { "http://localhost:5001/signout-callback-oidc" },//跳转登出到的客户端的地址
            RequireConsent=true,//是否需要用户点击确认进行跳转,改为点击确认后进行跳转
            AlwaysIncludeUserClaimsInIdToken = true,
            AllowOfflineAccess = true,//允许脱机访问

            ClientName = "MVC Client",
            ClientUri = "http://localhost:5001",
            LogoUri = "https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31",
            AllowRememberConsent = true,
        }
    };
}

修改 Startup.cs 

services.AddIdentityServer()
    .AddDeveloperSigningCredential()//添加开发人员签名凭据
    .AddInMemoryApiResources(Config.GetApiResources())//添加内存apiresource
    .AddInMemoryClients(Config.GetClients())//添加内存client
    .AddInMemoryIdentityResources(Config.GetIdentityResources())//添加系统中的资源
    //.AddTestUsers(Config.GetTestUsers())//添加测试用户(这里不需要测试用户了)
    .AddAspNetIdentity()
    .Services.AddScoped();

修改MvcClient项目中的 Startup.cs 

services.AddAuthentication(options =>
    {
        options.DefaultScheme = "Cookies";//使用Cookies认证
        options.DefaultChallengeScheme = "oidc";//使用oidc
    })
    .AddCookie("Cookies")//配置Cookies认证
    .AddOpenIdConnect("oidc", options =>//配置oidc
    {
        options.SignInScheme = "Cookies";
        options.Authority = "http://localhost:5000";
        options.RequireHttpsMetadata = false;
        options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
        options.ClientId = "mvc";
        options.ClientSecret = "secret";
        options.SaveTokens = true;
        //options.GetClaimsFromUserInfoEndpoint = true;

        //options.ClaimActions.MapJsonKey("sub", "sub");
        //options.ClaimActions.MapJsonKey("preferred_username", "preferred_username");
        //options.ClaimActions.MapJsonKey("sub", "sub");
        //options.ClaimActions.MapJsonKey("avatar", "avatar");
        //options.ClaimActions.MapCustomJson("role", jobj => jobj["role"].ToString());

        options.Scope.Add("offline_access");
        options.Scope.Add("openid");
        options.Scope.Add("profile");
    });

源码：链接: https://pan.baidu.com/s/1EM-MC9N6RKb6MS2KjccIig 提取码: cq4c

集成EFCore配置Client和API

接下来的步骤是，以取代当前 AddInMemoryClients，AddInMemoryIdentityResources和AddInMemoryApiResources 在ConfigureServices在方法Startup.cs。我们将使用以下代码替换它们：

修改MvcCookieAuthSample项目中的ConfigureServices方法，copy链接字符串，这是一个官方的字符串,直接复制过来，放在上面。

const string connectionString = @"Data Source=(LocalDb)\MSSQLLocalDB;database=IdentityServer4.Quickstart.EntityFramework-2.0.0;trusted_connection=yes;";

添加包的引用

IdentityServer4.EntityFramework

引入IdentityServer4.EntityFramework的命名空间

初始化我们的数据库，OperationStore的配置。这里实际上有两套表， 一套存Client这些信息，Operation这套用来存token

加上ConfigrationStore和OperationStore以后就可以移除上面的三行代码，那三行代码之前都是从Config类里面获取数据的，先在通过数据库的方式去回去，所以这里不再需要了

services.AddIdentityServer()
    .AddDeveloperSigningCredential()//添加开发人员签名凭据
    //.AddInMemoryApiResources(Config.GetApiResources())//添加内存apiresource
    //.AddInMemoryClients(Config.GetClients())//添加内存client
    //.AddInMemoryIdentityResources(Config.GetIdentityResources())//添加系统中的资源
    .AddConfigurationStore(options =>
        {
            options.ConfigureDbContext = builder => { builder.UseSqlServer(connectionString,sql=>sql.MigrationsAssembly(migrationsAssembly)); };
        })
    // this adds the operational data from DB (codes, tokens, consents)
    .AddOperationalStore(options =>
    {
        options.ConfigureDbContext = b =>
            b.UseSqlServer(connectionString,
                sql => sql.MigrationsAssembly(migrationsAssembly));

        // this enables automatic token cleanup. this is optional.
        options.EnableTokenCleanup = true;
    })
    //.AddTestUsers(Config.GetTestUsers())//添加测试用户(这里不需要测试用户了)
    .AddAspNetIdentity()
    .Services.AddScoped();

添加数据库迁移

Add-Migration init -Context PersistedGrantDbContext -OutputDir Data/Migrations/IdentityServer/PersistedGrantDb
Add-Migration init -Context ConfigurationDbContext -OutputDir Data/Migrations/IdentityServer/ConfigurationDb

更新数据库结构

Update-Database -c ConfigurationDbContext

这时数据库会生成库和表结构

初始化数据

在Startup.cs中添加此方法以帮助初始化数据库：

private void InitializeDatabase(IApplicationBuilder app)
{
    using (var serviceScope = app.ApplicationServices.GetService().CreateScope())
    {
        serviceScope.ServiceProvider.GetRequiredService().Database.Migrate();

        var context = serviceScope.ServiceProvider.GetRequiredService();
        context.Database.Migrate();
        if (!context.Clients.Any())
        {
            foreach (var client in Config.GetClients())
            {
                context.Clients.Add(client.ToEntity());
            }
            context.SaveChanges();
        }

        if (!context.IdentityResources.Any())
        {
            foreach (var resource in Config.GetIdentityResources())
            {
                context.IdentityResources.Add(resource.ToEntity());
            }
            context.SaveChanges();
        }

        if (!context.ApiResources.Any())
        {
            foreach (var resource in Config.GetApiResources())
            {
                context.ApiResources.Add(resource.ToEntity());
            }
            context.SaveChanges();
        }
    }
}

View Code

然后我们可以从 Configure 方法中调用它：

然后运行，我们可以看到在 Clients 表中已经有了数据

源码：链接: https://pan.baidu.com/s/1BauxqrclWtlOJk9h6uxtAg 提取码: dq4e