目录
- IdentityServer4源码解析_1_项目结构
- IdentityServer4源码解析_2_元数据接口
- IdentityServer4源码解析_3_认证接口
- IdentityServer4源码解析_4_令牌发放接口
- IdentityServer4源码解析_5_查询用户信息接口
- [IdentityServer4源码解析_6_结束会话接口]
- [IdentityServer4源码解析_7_查询令牌信息接口]
- [IdentityServer4源码解析_8_撤销令牌接口]
简介
Security源码解析系列介绍了微软提供的各种认证架构，其中OAuth2.0，OpenIdConnect属于远程认证架构，所谓远程认证，是指token的颁发是由其他站点完成的。
IdentityServer4是基于OpenIdConnect协议的认证中心框架，可以帮助我们快速搭建微服务认证中心。
初学者可能看到生涩的概念比较头疼，可以将OAuth, OpenIdConnect协议简单理解成需求文档，idsv4基于需求提供了一系列的api实现。
对于idsv还不太了解的可以看下面的资料，本系列主要学习梳理idsv4的源码，结合协议加深理解。
晓晨姐姐系列文章
https://www.cnblogs.com/stulzq/p/8119928.html
官方文档
https://identityserver4.readthedocs.io/en/latest/
项目结构
项目地址如下
https://github.com/IdentityServer/IdentityServer4
克隆到本地，项目结构如图
核心项目是IdentityServer4，其余的都是与微软框架集成、以及处理持久化的项目。
项目结构如图。Endpoints文件夹就是接口文件，我们先看下依赖注入、中间件的代码，然后看下每个接口。
依赖注入
public static IIdentityServerBuilder AddIdentityServer(this IServiceCollection services)
{
var builder = services.AddIdentityServerBuilder();
builder
.AddRequiredPlatformServices()
.AddCookieAuthentication()
.AddCoreServices()
.AddDefaultEndpoints()
.AddPluggableServices()
.AddValidators()
.AddResponseGenerators()
.AddDefaultSecretParsers()
.AddDefaultSecretValidators();
// provide default in-memory implementation, not suitable for most production scenarios
builder.AddInMemoryPersistedGrants();
return builder;
}
- AddRequiredPlatformServices - 注入平台服务
- IHttpContextAccessor：HttpContext访问器
- IdentityServerOptions：配置类
public static IIdentityServerBuilder AddRequiredPlatformServices(this IIdentityServerBuilder builder)
{
builder.Services.TryAddSingleton();
builder.Services.AddOptions();
builder.Services.AddSingleton(
resolver => resolver.GetRequiredService>().Value);
builder.Services.AddHttpClient();
return builder;
}
- AddCookieAuthentication - 注入cookie服务
- 注入名称为idsrv的cookie认证架构
- 注入IAuthenticationService的实现IdentityServerAuthenticationService
- 注入IAuthenticationHandlerProvider的实现FederatedSignoutAuthenticationHandlerProvider
public static IIdentityServerBuilder AddCookieAuthentication(this IIdentityServerBuilder builder)
{
builder.Services.AddAuthentication(IdentityServerConstants.DefaultCookieAuthenticationScheme)
.AddCookie(IdentityServerConstants.DefaultCookieAuthenticationScheme)
.AddCookie(IdentityServerConstants.ExternalCookieAuthenticationScheme);
builder.Services.AddSingleton, ConfigureInternalCookieOptions>();
builder.Services.AddSingleton, PostConfigureInternalCookieOptions>();
builder.Services.AddTransientDecorator();
builder.Services.AddTransientDecorator();
return builder;
}
- AddCoreServices - 注入核心服务
///
/// Adds the core services.
///
/// The builder.
/// ();
builder.Services.AddTransient();
builder.Services.AddTransient();
builder.Services.AddTransient();
builder.Services.AddTransient();
builder.Services.AddTransient();
// todo: remove in 3.0
#pragma warning disable CS0618 // Type or member is obsolete
builder.Services.AddTransient();
#pragma warning restore CS0618 // Type or member is obsolete
builder.Services.AddTransient();
builder.Services.AddTransient();
builder.Services.AddTransient();
builder.Services.AddScoped();
builder.Services.AddTransient(typeof(MessageCookie<>));
builder.Services.AddCors();
builder.Services.AddTransientDecorator();
return builder;
}
- AddDefaultEndpoints - 注入接口
- AuthorizeCallbackEndpoint：认证回调接口
- AuthorizeEndpoint：认证接口
- CheckSessionEndpoint：检查会话接口
- DeviceAuthorizationEndpoint：设备认证接口
- DiscoveryEndpoint：元数据键接口
- DiscoveryEndpoint：元数据接口
- EndSessionCallbackEndpoint：结束会话回调接口
- EndSessionEndpoint：结束会话接口
- IntrospectionEndpoint：查询令牌信息接口
- TokenRevocationEndpoint：撤销令牌接口
- TokenEndpoint：发放令牌接口
- UserInfoEndpoint：查询用户信息接口
注入所有默认接口，包括接口名称和地址。请求进来之后，路由类EndPointRouter通过路由来寻找匹配的处理器。
public static IIdentityServerBuilder AddDefaultEndpoints(this IIdentityServerBuilder builder)
{
builder.Services.AddTransient();
builder.AddEndpoint(EndpointNames.Authorize, ProtocolRoutePaths.AuthorizeCallback.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.Authorize, ProtocolRoutePaths.Authorize.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.CheckSession, ProtocolRoutePaths.CheckSession.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.DeviceAuthorization, ProtocolRoutePaths.DeviceAuthorization.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.Discovery, ProtocolRoutePaths.DiscoveryWebKeys.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.Discovery, ProtocolRoutePaths.DiscoveryConfiguration.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.EndSession, ProtocolRoutePaths.EndSessionCallback.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.EndSession, ProtocolRoutePaths.EndSession.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.Introspection, ProtocolRoutePaths.Introspection.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.Revocation, ProtocolRoutePaths.Revocation.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.Token, ProtocolRoutePaths.Token.EnsureLeadingSlash());
builder.AddEndpoint(EndpointNames.UserInfo, ProtocolRoutePaths.UserInfo.EnsureLeadingSlash());
return builder;
}
- AddPluggableServices - 注入可插拔服务
public static IIdentityServerBuilder AddPluggableServices(this IIdentityServerBuilder builder)
{
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient, ProtectedDataMessageStore>();
builder.Services.TryAddTransient, ProtectedDataMessageStore>();
builder.Services.TryAddTransient, ProtectedDataMessageStore>();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.AddJwtRequestUriHttpClient();
builder.AddBackChannelLogoutHttpClient();
//builder.Services.AddHttpClient();
//builder.Services.AddHttpClient();
builder.Services.AddTransient();
builder.Services.AddTransient();
builder.Services.TryAddTransient();
builder.Services.AddDistributedMemoryCache();
return builder;
}
- AddValidators - 注入校验类
public static IIdentityServerBuilder AddValidators(this IIdentityServerBuilder builder)
{
// core
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
// optional
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
return builder;
}
- AddResponseGenerators - 注入响应生成类
public static IIdentityServerBuilder AddResponseGenerators(this IIdentityServerBuilder builder)
{
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
builder.Services.TryAddTransient();
return builder;
}
- AddDefaultSecretParsers & AddDefaultSecretValidators
///
/// Adds the default secret parsers.
///
/// The builder.
/// ();
builder.Services.AddTransient();
return builder;
}
///
/// Adds the default secret validators.
///
/// The builder.
/// ();
return builder;
}
IdentityServerOptions - 配置类
///
/// The IdentityServerOptions class is the top level container for all configuration settings of IdentityServer.
///
public class IdentityServerOptions
{
///
/// Gets or sets the unique name of this server instance, e.g. https://myissuer.com.
/// If not set, the issuer name is inferred from the request
///
///
/// Unique name of this server instance, e.g. https://myissuer.com
///
public string IssuerUri { get; set; }
///
/// Gets or sets the origin of this server instance, e.g. https://myorigin.com.
/// If not set, the origin name is inferred from the request
/// Note: Do not set a URL or include a path.
///
///
/// Origin of this server instance, e.g. https://myorigin.com
///
public string PublicOrigin { get; set; }
///
/// Gets or sets the value for the JWT typ header for access tokens.
///
///
/// The JWT typ value.
///
public string AccessTokenJwtType { get; set; } = "at+jwt";
///
/// Emits an aud claim with the format issuer/resources. That's needed for some older access token validation plumbing. Defaults to false.
///
public bool EmitLegacyResourceAudienceClaim { get; set; } = false;
///
/// Gets or sets the endpoint configuration.
///
///
/// The endpoints configuration.
///
public EndpointsOptions Endpoints { get; set; } = new EndpointsOptions();
///
/// Gets or sets the discovery endpoint configuration.
///
///
/// The discovery endpoint configuration.
///
public DiscoveryOptions Discovery { get; set; } = new DiscoveryOptions();
///
/// Gets or sets the authentication options.
///
///
/// The authentication options.
///
public AuthenticationOptions Authentication { get; set; } = new AuthenticationOptions();
///
/// Gets or sets the events options.
///
///
/// The events options.
///
public EventsOptions Events { get; set; } = new EventsOptions();
///
/// Gets or sets the max input length restrictions.
///
///
/// The length restrictions.
///
public InputLengthRestrictions InputLengthRestrictions { get; set; } = new InputLengthRestrictions();
///
/// Gets or sets the options for the user interaction.
///
///
/// The user interaction options.
///
public UserInteractionOptions UserInteraction { get; set; } = new UserInteractionOptions();
///
/// Gets or sets the caching options.
///
///
/// The caching options.
///
public CachingOptions Caching { get; set; } = new CachingOptions();
///
/// Gets or sets the cors options.
///
///
/// The cors options.
///
public CorsOptions Cors { get; set; } = new CorsOptions();
///
/// Gets or sets the Content Security Policy options.
///
public CspOptions Csp { get; set; } = new CspOptions();
///
/// Gets or sets the validation options.
///
public ValidationOptions Validation { get; set; } = new ValidationOptions();
///
/// Gets or sets the device flow options.
///
public DeviceFlowOptions DeviceFlow { get; set; } = new DeviceFlowOptions();
///
/// Gets or sets the mutual TLS options.
///
public MutualTlsOptions MutualTls { get; set; } = new MutualTlsOptions();
}
UserIdentityServer - 中间件逻辑
- 执行校验
- BaseUrlMiddleware中间件：设置BaseUrl
- 配置CORS跨域：CorsPolicyProvider根据client信息生成动态策略
- IdentityServerMiddlewareOptions默认调用了UseAuthentication，所以如果使用IdentityServer不用重复注册Authentication中间件
- 使用MutualTlsTokenEndpointMiddleware中间件：要求客户端、服务端都使用https，默认不开启
- 使用IdentityServerMiddleware中间件：IEndpointRouter根据请求寻找匹配的IEndpointHandler，如果找到的话则由EndPointHandler处理请求。
public static IApplicationBuilder UseIdentityServer(this IApplicationBuilder app, IdentityServerMiddlewareOptions options = null)
{
app.Validate();
app.UseMiddleware();
app.ConfigureCors();
// it seems ok if we have UseAuthentication more than once in the pipeline --
// this will just re-run the various callback handlers and the default authN
// handler, which just re-assigns the user on the context. claims transformation
// will run twice, since that's not cached (whereas the authN handler result is)
// related: https://github.com/aspnet/Security/issues/1399
if (options == null) options = new IdentityServerMiddlewareOptions();
options.AuthenticationMiddleware(app);
app.UseMiddleware();
app.UseMiddleware();
return app;
}
核心中间件IdentityServerMiddleware的代码，逻辑比较清晰
- IEndpointRouter路由类旬斋匹配接口
- 匹配接口处理请求返回结果IEndpointResult
- IEndpointResult执行结果，写入上下文，返回报文
public async Task Invoke(HttpContext context, IEndpointRouter router, IUserSession session, IEventService events)
{
// this will check the authentication session and from it emit the check session
// cookie needed from JS-based signout clients.
await session.EnsureSessionIdCookieAsync();
try
{
var endpoint = router.Find(context);
if (endpoint != null)
{
_logger.LogInformation("Invoking IdentityServer endpoint: {endpointType} for {url}", endpoint.GetType().FullName, context.Request.Path.ToString());
var result = await endpoint.ProcessAsync(context);
if (result != null)
{
_logger.LogTrace("Invoking result: {type}", result.GetType().FullName);
await result.ExecuteAsync(context);
}
return;
}
}
catch (Exception ex)
{
await events.RaiseAsync(new UnhandledExceptionEvent(ex));
_logger.LogCritical(ex, "Unhandled exception: {exception}", ex.Message);
throw;
}
await _next(context);
}
看一下路由类的处理逻辑
之前AddDefaultEndpoints注入了所有默认接口，路由类可以通过依赖注入拿到所有接口信息，将请求地址与接口地址对比得到匹配的接口，然后从容器拿到对应的接口处理器。
public EndpointRouter(IEnumerable endpoints, IdentityServerOptions options, ILogger logger)
{
_endpoints = endpoints;
_options = options;
_logger = logger;
}
public IEndpointHandler Find(HttpContext context)
{
if (context == null) throw new ArgumentNullException(nameof(context));
foreach(var endpoint in _endpoints)
{
var path = endpoint.Path;
if (context.Request.Path.Equals(path, StringComparison.OrdinalIgnoreCase))
{
var endpointName = endpoint.Name;
_logger.LogDebug("Request path {path} matched to endpoint type {endpoint}", context.Request.Path, endpointName);
return GetEndpointHandler(endpoint, context);
}
}
_logger.LogTrace("No endpoint entry found for request path: {path}", context.Request.Path);
return null;
}
private IEndpointHandler GetEndpointHandler(Endpoint endpoint, HttpContext context)
{
if (_options.Endpoints.IsEndpointEnabled(endpoint))
{
var handler = context.RequestServices.GetService(endpoint.Handler) as IEndpointHandler;
if (handler != null)
{
_logger.LogDebug("Endpoint enabled: {endpoint}, successfully created handler: {endpointHandler}", endpoint.Name, endpoint.Handler.FullName);
return handler;
}
else
{
_logger.LogDebug("Endpoint enabled: {endpoint}, failed to create handler: {endpointHandler}", endpoint.Name, endpoint.Handler.FullName);
}
}
else
{
_logger.LogWarning("Endpoint disabled: {endpoint}", endpoint.Name);
}
return null;
}
总结
主干流程大致如图
idsv的代码量还是比较大的，有很多的类，但是代码还是要写的挺规范清晰，梳理下来脉络还是很明了的。