我使用的是asp.net core 3.1附带的IdentityServer模板。到目前为止一切顺利,SPA 应用程序可以使用隐式流程。现在我有一个移动应用程序,我想将其与相同的身份服务器一起使用。
因此,在 appsettings.json 中,我添加了一个新密钥 charla-mobile,并将配置文件设置为 NativeApp,假设我可以按照 https://github.com/dotnet/aspnetcore/ 使用自己的配置blob/62c098bc170f50feca15916e81cb7f321ffc52ff/src/Identity/ApiAuthorization.IdentityServer/src/Configuration/ConfigureClients.cs#L56:
"IdentityServer": {
"Key": {
"Type": "Development"
},
"Clients": {
"Charla": {
"Profile": "IdentityServerSPA"
},
"charla-mobile": {
"Enabled": true,
"Profile": "NativeApp",
"ClientName": "Charla Mobile Client (Code with PKCE)",
"RequireClientSecret" : false,
"RedirectUris": ["http://localhost:8100/implicit/authcallback", "com.appauth.demo://callback"],
"AllowedGrantTypes": [ "code", "implicit" ],
"RequirePkce": true,
"AllowedScopes": ["converse-appAPI", "openid", "profile"]
}
}
}
问题是我不断收到无效的redirect_uri,尽管我使用相同的url(http://localhost:8100/implicit/authcallback)从javascript库调用它:
Invalid redirect_uri: http: //localhost:8100/implicit/authcallback
{
"ClientId": "charla-mobile",
"ClientName": "charla-mobile",
"RedirectUri": null,
"AllowedRedirectUris": ["urn:ietf:wg:oauth:2.0:oob"],
"SubjectId": "anonymous",
"ResponseType": null,
"ResponseMode": null,
"GrantType": null,
"RequestedScopes": "",
"State": null,
"UiLocales": null,
"Nonce": null,
"AuthenticationContextReferenceClasses": null,
"DisplayMode": null,
"PromptMode": null,
"MaxAge": null,
"LoginHint": null,
"SessionId": null,
"Raw": {
"redirect_uri": "http://localhost:8100/implicit/authcallback",
"client_id": "charla-mobile",
"response_type": "code",
"state": "4qtaYswLFK",
"scope": "converse-appAPI openid profile",
"code_challenge": "opKV8gSVV5X7pQ7eTvQ3Lp40A7BXplkz4RiGkEFgBcc",
"code_challenge_method": "S256"
},
"$type": "AuthorizeRequestValidationLog"
}
按要求提供完整日志
Application started. Press Ctrl+C to shut down.
[18:38:49 DBG] CORS request made for path: /.well-known/openid-configuration from origin: http://localhost:8100
[18:38:49 DBG] CorsPolicyService allowed origin: http://localhost:8100
[18:38:49 DBG] Login Url: /auth/login
[18:38:49 DBG] Login Return Url Parameter: ReturnUrl
[18:38:49 DBG] Logout Url: /Identity/Account/Logout
[18:38:49 DBG] ConsentUrl Url: /consent
[18:38:49 DBG] Consent Return Url Parameter: returnUrl
[18:38:49 DBG] Error Url: /home/error
[18:38:49 DBG] Error Id Parameter: errorId
[18:38:49 DBG] Request path /.well-known/openid-configuration matched to endpoint type Discovery
[18:38:49 DBG] Endpoint enabled: Discovery, successfully created handler: IdentityServer4.Endpoints.DiscoveryEndpoint
[18:38:49 INF] Invoking IdentityServer endpoint: IdentityServer4.Endpoints.DiscoveryEndpoint for /.well-known/openid-configuration
[18:38:49 DBG] Start discovery request
[18:38:49 DBG] Request path /connect/authorize matched to endpoint type Authorize
[18:38:49 DBG] Endpoint enabled: Authorize, successfully created handler: IdentityServer4.Endpoints.AuthorizeEndpoint
[18:38:49 INF] Invoking IdentityServer endpoint: IdentityServer4.Endpoints.AuthorizeEndpoint for /connect/authorize
[18:38:49 DBG] Start authorize request
[18:38:49 DBG] No user present in authorize request
[18:38:49 DBG] Start authorize request protocol validation
[18:38:49 DBG] client configuration validation for client charla-mobile succeeded.
[18:38:49 ERR] Invalid redirect_uri: http://localhost:8100/implicit/authcallback
{"ClientId": "charla-mobile", "ClientName": "charla-mobile", "RedirectUri": null, "AllowedRedirectUris": ["urn:ietf:wg:oauth:2.0:oob"], "SubjectId": "anonymous", "ResponseType": null, "ResponseMode": null, "GrantType": null, "RequestedScopes": "", "State": null, "UiLocales": null, "Nonce": null, "AuthenticationContextReferenceClasses": null, "DisplayMode": null, "PromptMode": null, "MaxAge": null, "LoginHint": null, "SessionId": null, "Raw": {"redirect_uri": "http://localhost:8100/implicit/authcallback", "client_id": "charla-mobile", "response_type": "code", "state": "G0Zn5uV8K4", "scope": "converse-appAPI openid profile", "code_challenge": "7vnsRsZRIzgf7Ti_gH-k1LY6fErlLZNrbfZlbQYCz7U", "code_challenge_method": "S256"}, "$type": "AuthorizeRequestValidationLog"}
[18:38:49 ERR] Request validation failed
[18:38:49 INF] {"ClientId": "charla-mobile", "ClientName": "charla-mobile", "RedirectUri": null, "AllowedRedirectUris": ["urn:ietf:wg:oauth:2.0:oob"], "SubjectId": "anonymous", "ResponseType": null, "ResponseMode": null, "GrantType": null, "RequestedScopes": "", "State": null, "UiLocales": null, "Nonce": null, "AuthenticationContextReferenceClasses": null, "DisplayMode": null, "PromptMode": null, "MaxAge": null, "LoginHint": null, "SessionId":
null, "Raw": {"redirect_uri": "http://localhost:8100/implicit/authcallback", "client_id": "charla-mobile", "response_type": "code", "state": "G0Zn5uV8K4", "scope": "converse-appAPI openid profile", "code_challenge": "7vnsRsZRIzgf7Ti_gH-k1LY6fErlLZNrbfZlbQYCz7U", "code_challenge_method": "S256"}, "$type": "AuthorizeRequestValidationLog"}
[18:38:49 INF] {"ClientId": "charla-mobile", "ClientName": "charla-mobile", "RedirectUri": null, "Endpoint": "Authorize", "SubjectId": null, "Scopes": "", "GrantType": null, "Error": "unauthorized_client", "ErrorDescription": "Invalid redirect_uri", "Category": "Token", "Name": "Token Issued Failure", "EventType": "Failure", "Id": 2001, "Message": null, "ActivityId": "0HM1T9FDQAMOT:00000001", "TimeStamp": "2020-08-10T16:38:49.0000000Z", "ProcessId": 13112, "LocalIpAddress": "::1:5000", "RemoteIpAddress": "::1", "$type": "TokenIssuedFailureEvent"}
我认为在代码中配置客户端以确保一切正确更容易。我在想的是,如果您错过了 ClientID,并且如果 clientID 错误,那么 IS 找不到正确的重定向URL?
我找到了这个例子这里
"IdentityServer": {
"IssuerUri": "urn:sso.company.com",
"Clients": [
{
"Enabled": true,
"ClientId": "local-dev",
"ClientName": "Local Development",
"ClientSecrets": [ { "Value": "<Insert Sha256 hash of the secret encoded as Base64 string>" } ],
"AllowedGrantTypes": [ "implicit" ],
"AllowedScopes": [ "openid", "profile" ],
"RedirectUris": [ "https://localhost:5001/signin-oidc" ],
"RequireConsent": false
}
]
这可能不是我正在寻找的答案,但我不得不放弃 asp.net core 提供的 ApiAuthorizaion 扩展,并开始使用其标准文档和配置文件配置身份服务器。
我遇到了同样的问题,我的解决方案是通过代码手动设置它(就像真正手动一样),否则redirectUri被设置为完全不同的值:
services.AddIdentityServer()
.AddApiAuthorization<ApplicationUser, AuthorizationDbContext>(options =>
{
options.Clients.AddNativeApp(
"MyApp",
app => app
.WithScopes("MyServerAPI", "openid", "profile", "offline_access")
);
var client = options.Clients.Single(c => c.ClientId == "MyApp");
client.AllowOfflineAccess = true;
client.RedirectUris.Clear();
client.RedirectUris.Add("http://localhost:4000/");
client.PostLogoutRedirectUris.Clear();
client.PostLogoutRedirectUris.Add("http://localhost:4000/");
});