如何在asp.net核心中映射声明

Question

我是asp.net核心的新手，我目前在多租户应用程序中工作。我现在卡住了，因为我不知道如何在asp.net核心中映射声明

我在尝试访问MIdAuthorizedBaseApiController的声明时遇到上述错误。

获得UserController的索赔。

我怀疑当jwt标记中的声明被映射到“User.Claims”。我在"UserController.cs"得到声明。但是我需要在MIdAuthorizedBaseApiController.cs中设置“UserContext"”。

声明可以在UserController中获得，但UserController本身继承自MIdAuthorizedBaseApiController，但声明没有在那里填充。当我尝试访问它时抛出异常。所以，何时以及如何映射jwt令牌中的声明。请参考两者上面的截图正确地提出了我的问题。

UserController.cs

[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
public class UsersController : MIdAuthorizedBaseApiController
{
     [HttpGet]
    [ProducesResponseType(200, Type = typeof(BusinessEntities.User))]
    [ProducesResponseType(400)]
    [ProducesResponseType(401)]
    public IActionResult Users()
    {
        // Get Tenant Id
        var claimsList = User.Claims.ToList();
        var tenantId = claimsList[4].Value;
        // Set the Claims
        // _claimsHelper.SetClaims(User.Claims.AsQueryable());

        var users = _userManager.Users.Include(u => u.UserRoles).ThenInclude(ur => ur.Role);//.Where(n => n.TenantId.ToString() == tenantId);

        // Using "LINQ" to Query only the required properties
        var result = from User in users
                     select new
                     {
                        Id = User.Id,
                        UserName = User.UserName,
                        Email = User.Email,
                        PhoneNumber = User.PhoneNumber,
                        // Roles = String.Join(",", (from roles in User.UserRoles select roles.Role.Name))
                     };

        // Return the result set
        if(result != null) {
            return Ok(result);
        }

        return BadRequest(_localizer["2006"]);
}

MIdAuthorizedBaseApiController.cs

[Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
public class MIdAuthorizedBaseApiController : AuthorizedApiController
{
    public MIdAuthorizedBaseApiController(UserContext usercontext):base(usercontext)
    {
        PopulateUserContext(usercontext);
    }

    private void PopulateUserContext(UserContext usercontext)
    {
        // Getting exception here when i try to populate User.Claims 
        //here
         var claim = HttpContext.User.Claims.First(c => c.Type == "UserId");

        //To be replaced with details from token
        //usercontext.UserId = Guid.Parse("3C5CD705-8DA0-4536-856B-9F39A6ABC0FA");
        usercontext.UserId = Guid.Parse("43200003-6972-4849-B80F-81896C3B5505");
        usercontext.Username = Guid.NewGuid().ToString();
        //usercontext.TenantId = Guid.Parse("28C914CE-C321-4033-BB87-E9C527249503");
        usercontext.TenantId = Guid.Parse("21550810-A8E7-438F-BBF5-CB0755087356");
        usercontext.ServerName = DateTime.Now.ToLongTimeString();
    }

授权ApiController.cs

using Agility.Core;
using Agility.Web.Filters;

namespace Agility.Web
{
  [BusinessExceptionFilter]
  public class AuthorizedApiController : BaseApiController
  {
    public AuthorizedApiController(UserContext userContext);

    public UserContext UserContext { get; set; }
  }
}

Answer 1

您可以使用HttpContextAccessor访问声明。

修改MIdAuthorizedBaseApiController以在控制器上执行IHttpContextAccessor的依赖注入：

public class MIdAuthorizedBaseApiController : AuthorizedApiController
{
    public MIdAuthorizedBaseApiController(UserContext usercontext, IHttpContextAccessor httpContextAccessor) : base(usercontext)
    {
        PopulateUserContext(usercontext, httpContextAccessor);
    }

    private void PopulateUserContext(UserContext usercontext, IHttpContextAccessor httpContextAccessor)
    {
        // Getting exception here when i try to populate User.Claims 
        //here
        var claim = httpContextAccessor.HttpContext.User.Claims;

        //To be replaced with details from token
        //usercontext.UserId = Guid.Parse("3C5CD705-8DA0-4536-856B-9F39A6ABC0FA");
        .......
    }
}

和用户控制器：

public class ValuesController : MIdAuthorizedBaseApiController
{
    public ValuesController(UserContext usercontext, IHttpContextAccessor httpContextAccessor) : base(usercontext, httpContextAccessor)
    {
    }
}

此外，您可以参考下面的链接，其中显示了如何使用JWT Bearer身份验证来保护ASP.NET Core，该身份验证使用AddJwtBearer middlerware来验证/解码JWT令牌：

https://jonhilton.net/security/apis/secure-your-asp.net-core-2.0-api-part-2---jwt-bearer-authentication/