Identity Server 4检查预期范围openid失败

Question

我正在尝试在ASP.NET Core中首次设置Identity Server。我已经设置了所有使用数据库的东西，并创建了一个脚本来创建测试客户端，测试用户和资源。我可以请求客户端令牌并请求用户令牌，这些工作正常，但在调用connect / userinfo端点时，我收到了Forbidden响应和以下错误;

    IdentityServer4.Validation.TokenValidator[0]
          Checking for expected scope openid failed
          {
            "ValidateLifetime": true,
            "AccessTokenType": "Jwt",
            "ExpectedScope": "openid",
            "Claims": {
              "nbf": 1556641697,
              "exp": 1556645297,
              "iss": "https://localhost:5001",
              "aud": [
                "https://localhost:5001/resources",
                "customAPI"
              ],
              "client_id": "newClient",
              "sub": "75f86dd0-512e-4c9d-b298-1afa120c7d47",
              "auth_time": 1556641697,
              "idp": "local",
              "role": "admin",
              "scope": "customAPI.read",
              "amr": "pwd"
            }
          }

我不确定是什么导致了这个问题。这是我用来设置测试实体的脚本;

private static void InitializeDbTestData(IApplicationBuilder app)
        {
            using (var scope = app.ApplicationServices.GetService<IServiceScopeFactory>().CreateScope())
            {
                scope.ServiceProvider.GetRequiredService<PersistedGrantDbContext>().Database.Migrate();
                scope.ServiceProvider.GetRequiredService<ConfigurationDbContext>().Database.Migrate();
                scope.ServiceProvider.GetRequiredService<ApplicationDbContext>().Database.Migrate();

                var context = scope.ServiceProvider.GetRequiredService<ConfigurationDbContext>();

                // API Client
                Client client = new Client
                {
                    ClientId = "newClient",
                    ClientName = "Example Client Credentials Client Application",
                    AllowedGrantTypes = GrantTypes.ResourceOwnerPasswordAndClientCredentials,
                    ClientSecrets = new List<Secret>
                    {
                        new Secret("123456789".Sha256())
                    },
                    AllowedScopes = new List<string> {"customAPI.read"}
                };


                context.Clients.Add(client.ToEntity());
                context.SaveChanges();

                // Identity Resources
                IList<IdentityResource> identityResources = new List<IdentityResource>
                {
                    new IdentityResources.OpenId(),
                    new IdentityResources.Profile(),
                    new IdentityResources.Email(),
                    new IdentityResource
                    {
                        Name = "role",
                        UserClaims = new List<string> {"role"}
                    }
                };

                foreach (IdentityResource identityResource in identityResources)
                {
                    context.IdentityResources.Add(identityResource.ToEntity());
                }

                // API Resource
                ApiResource resource = new ApiResource
                {
                    Name = "customAPI",
                    DisplayName = "Custom API",
                    Description = "Custom API Access",
                    UserClaims = new List<string> {"role"},
                    ApiSecrets = new List<Secret> {new Secret("scopeSecret".Sha256())},
                    Scopes = new List<Scope>
                    {
                        new Scope("customAPI.read"),
                        new Scope("customAPI.write")
                    }
                };

                context.ApiResources.Add(resource.ToEntity());
                context.SaveChanges();


                var userManager = scope.ServiceProvider.GetRequiredService<UserManager<IdentityUser>>();

                // User
                IdentityUser user = new IdentityUser
                {
                    UserName = "JohnDoe",
                    Email = "[email protected]",
                };

                IList<Claim> claims = new List<Claim>
                {
                    new Claim(JwtClaimTypes.Email, user.Email),
                    new Claim(JwtClaimTypes.Role, "admin")
                };

                userManager.CreateAsync(user, "112222224344").Wait();
                userManager.AddClaimsAsync(user, claims).Wait();
            }
        }

我确定在设置客户端/用户时我设置了一些错误，有人可以查明它是什么吗？

Answer 1

无法看到您的客户端代码，但错误显示您在申请令牌时未请求openid范围。对Useinfo端点有效的令牌必须包含openid范围。