角度登录“例外：关联失败。未知位置“

Question

我的应用程序由2个元素组成：IdentityServer4主机（Asp.NET Core 2.2应用程序，带有Asp.NET标识），监听http://localhost:5000 Angular客户端应用程序（Angular v.7.2.12），听取http://localhost:5002

我希望angular客户端针对IS4进行身份验证：登录表单ID是IS4页面中托管的表单。成功登录后，应将用户重定向回角度页面。对于角度oidc集成，我遵循了项目：https://github.com/elanderson/Angular-Core-IdentityServer

登录实际上运行良好（我看到IS4返回的正确令牌，IS4日志中没有错误），但重定向URI不起作用。而不是返回到原始的角度页面（http://localhost/5002），我有一个例外“相关失败。未知位置“

我尝试使用另一个ASP.NET Core测试应用程序进行相同的登录并且它可以工作，因此它似乎与角度集成有关。

IS4内存中角度客户端配置

new Client
            {
                ClientId = "gekoo.webSPA",
                ClientName = "MVC SPA Client",
                AllowedGrantTypes = GrantTypes.Implicit,
                AllowAccessTokensViaBrowser = true,

                RedirectUris = { "http://localhost:5002/signin-oidc" },                    
                PostLogoutRedirectUris = { "http://localhost:5002" },},

                AllowedCorsOrigins = { "http://localhost:5002" },

                AllowedScopes = new List<string>
                {
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Profile,
                    "api1"
                },

                AlwaysIncludeUserClaimsInIdToken = true,

                RequireConsent = false,
            },

Startup.cs ConfigureServices中的Aspnet核心客户端应用程序配置

services.AddAuthentication(options =>
        {
            options.DefaultScheme = "Cookies";
            //options.DefaultChallengeScheme = "oidc";
            options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
        })
            .AddCookie()
            .AddOpenIdConnect(options =>
            {
                options.Authority = "http://localhost:5000";
                options.RequireHttpsMetadata = false;

                options.ResponseType = "code id_token";
                options.Scope.Add("gekoo.webSPA");
                options.Scope.Add("offline_access");
                options.ClientId = "gekoo.webSPA";

                options.ClaimActions.Remove("auth_type");
                options.GetClaimsFromUserInfoEndpoint = true;
                options.SaveTokens = true;
            });

Angular客户端oidc配置：

const openIdImplicitFlowConfiguration = new OpenIDImplicitFlowConfiguration();
openIdImplicitFlowConfiguration.stsServer = authUrl;

openIdImplicitFlowConfiguration.redirect_url = originUrl + '/signin-oidc';
console.log('redirect_url=' + openIdImplicitFlowConfiguration.redirect_url);

openIdImplicitFlowConfiguration.client_id = 'gekoo.webSPA';
openIdImplicitFlowConfiguration.response_type = 'id_token token';
openIdImplicitFlowConfiguration.scope = 'openid profile api1';

openIdImplicitFlowConfiguration.post_logout_redirect_uri = originUrl + '/home';
console.log('post_logout_redirect_uri=' + openIdImplicitFlowConfiguration.post_logout_redirect_uri);

openIdImplicitFlowConfiguration.forbidden_route = '/forbidden';
openIdImplicitFlowConfiguration.unauthorized_route = '/unauthorized';
openIdImplicitFlowConfiguration.auto_userinfo = true;
openIdImplicitFlowConfiguration.log_console_warning_active = true;
openIdImplicitFlowConfiguration.log_console_debug_active = true;
openIdImplicitFlowConfiguration.max_id_token_iat_offset_allowed_in_seconds = 10;

const authWellKnownEndpoints = new AuthWellKnownEndpoints();
//authWellKnownEndpoints.setWellKnownEndpoints(
authWellKnownEndpoints.issuer = authUrl;

authWellKnownEndpoints.jwks_uri = authUrl + '/.well-known/openid-configuration/jwks';
authWellKnownEndpoints.authorization_endpoint = authUrl + '/connect/authorize';
authWellKnownEndpoints.token_endpoint = authUrl + '/connect/token';
authWellKnownEndpoints.userinfo_endpoint = authUrl + '/connect/userinfo';
authWellKnownEndpoints.end_session_endpoint = authUrl + '/connect/endsession';
authWellKnownEndpoints.check_session_iframe = authUrl + '/connect/checksession';
authWellKnownEndpoints.revocation_endpoint = authUrl + '/connect/revocation';
authWellKnownEndpoints.introspection_endpoint = authUrl + '/connect/introspect';
authWellKnownEndpoints.introspection_endpoint = authUrl + '/connect/introspect';

Answer 1

您混合了两种不同的方法：在IdSrv（和Angular）中使用"gekoo.webSPA"注册"GrantTypes.Implicit"客户端，但也创建了另一个（ASP.NET MVC）客户端应用程序，具有相同的名称，但ResponseType = "code id_token"。因此，您的Angular应用程序会触发一个挑战，但响应会由ASP.Net后端处理，从而导致失败。实际上你可以在没有任何MVC的情况下托管你的Angular，或者使用this QA作为参考。