AspNetCore网关集成Swagger访问使用IdentityServer保护的webapi项目

创建webapi项目

　　创建四个webapi项目，两个处理业务，一个网关，一个验证中心。四个项目对应的端口如下，

ApiGateway:1999

IdentityServer:16690

Services.Api1:2108

Services.Api2:2343

添加Swagger支持

　　在两个业务项目中分别引用Swashbuckle.AspNetCore，目前是最新版本是4.0.1。在项目属性面板，设置输出xml文档，swagger可以读取xml注释生成json文件，在swagger ui页面中显示。但是选择输出xml文档后，对于没有xml注释的类和方法会显示警告，可以在项目属性面板中【错误和警告】选项，取消显示警告中添加1591，这样就可以不显示缺少xml注释的警告了。对于强迫症的你暂时可以平复一下了，当然，真的强迫症的话，肯定会全部加上xml注释的。(￢_￢)瞄

 　　Startup.ConfigureServices

public void ConfigureServices(IServiceCollection services)
        {
           services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);

            services.AddSwaggerGen(options =>
            {
                //SwaggerDoc的第一个参数要与Configure中SwaggerEndPoint中的版本名称一致
                //既可以使用版本号，也可以使用自定义名称
                options.SwaggerDoc("ServiceApiTwo", new Info
                {
                    Title = "Services.Api #two",
                    Version = "v1",
                    Description = "服务api #two",
                    License = new License
                    {
                        Name = "APL2.0",
                        Url = "https://opensource.org/licenses/Apache-2.0"
                    },
                    Contact = new Contact
                    {
                        Name = "原来是李",
                        Url = "https://www.cnblogs.com/falltakeman"
                    }
                });
                var xmlFile = $"{Assembly.GetExecutingAssembly().GetName().Name}.xml";
                var xmlPath = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, xmlFile);
                options.IncludeXmlComments(xmlPath);
                
            });
        }

　　Startup.Configure

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();

                app.UseSwagger(c=>
                {
                    c.RouteTemplate = "{documentName}/swagger.json";
                });
                app.UseSwaggerUI(u =>
                {
                    u.SwaggerEndpoint("/ServiceApiTwo/swagger.json", "ServiceApiTwo");
                    u.DocumentTitle = "Service Api #2 文档";
                });
            }
            
            app.UseMvc();
        }

 　　配置好启动项目看看。

　　通过swagger发起请求，响应正常。

 

配置网关项目

　　使用目前比较流行的开源网关服务Ocelot，APIGateway项目添加引用Ocelot、Ocelot.Provider.Consul、Ocelot.Provider.Polly、Ocelot.Cache.CacheManager，目前用到的版本是13.5.2。要在网关中统一查看各个服务的swagger文档，还需引用Swash.AspNetCore。Consul的配置先不说了。

　　在项目根路径下添加OcelotConfig.json配置文件。处理正常的路由转发外，要在网关swagger页面访问业务api，还需要配置swagger路由转发。

{
  "GlobalConfiguration": {
    //外部访问路径
    "BaseUrl": "http://localhost:1999",
    //限速配置
    "RateLimitOptions": {
      //白名单
      "ClientWhitelist": [],
      "EnableRateLimiting": true,
      //限制时间段，例如1s，5m，1h，1d
      "Period": "1s",
      //等待重试等待的时间间隔（秒）
      "PeriodTimespan": 1,
      //限制
      "Limit": 1,
      //自定义消息
      "QuotaExceededMessage": "单位时间内请求次数超过限制。",
      "HttpStatusCode": 999
    },
    //服务发现配置
    "ServiceDiscoveryProvider": {
      "Host": "localhost",
      "Port": 8500,
      "Type": "PollConsul",
      "PollingInterval": 1000
    },
    //熔断配置
    "QoSOptions": {
      "ExceptionsAllowedBeforeBreaking": 3,
      "DurationOfBreak": 5,
      //超时值（毫秒）
      "TimeoutValue": 5000
    }
  },
  "ReRoutes": [
    // Api#one项目配置
    {
      "UpstreamPathTemplate": "/gateway/one/{url}", //上游路径模板
      "UpstreamHttpMethod": [ "Get", "Post", "Put", "Delete" ], //上游HTTP请求方法
      "DownstreamPathTemplate": "/api/{url}", //下游路径模板
      "DownstreamScheme": "http", //下游协议 https/http
      "ServiceName": "ServiceApiOne", //服务名称（结合服务发现使用）
      "UseServiceDiscovery": true, //启用服务发现
      "LoadBalancer": "RoundRobin", //负载均衡算法：RoundRobin-轮询；LeastConnection-最少连接数(最空闲的服务器)；NoLoadBalancer-总是发送往第一个请求或者服务发现
      //下游主机与端口，允许配置多个
      "DownstreamHostAndPorts": [
        //{
        //  "Host": "ip",
        //  "Port": 80
        //},
        {
          "Host": "localhost",
          "Port": 2108
        }
      ],
      //熔断配置，在请求下游服务时使用断路
      "QoSOptions": {
        "ExceptionsAllowedBeforeBreaking": 3,
        "DurationOfBreak": 10,
        "TimeoutValue": 5000
      },
      //权限配置
      //"AuthenticationOptions": {
      //  "AuthenticationProviderKey": "Bearer",
      //  "AllowedScopes": []
      //}
    },
    // Api#two项目配置
    {
      "UpstreamPathTemplate": "/gateway/two/{url}",
      "UpstreamHttpMethod": [ "Get", "Post", "Put", "Delete" ],
      "DownstreamPathTemplate": "/api/{url}",
      "DownstreamScheme": "http",
      "ServiceName": "ServiceApiTwo",
      "UseServiceDiscovery": true,
      "LoadBalancer": "RoundRobin",
      "DownstreamHostAndPorts": [
        //{
        //  "Host": "ip",
        //  "Port": 80
        //},
        {
          "Host": "localhost",
          "Port": 2343
        }
      ],
      "QoSOptions": {
        "ExceptionsAllowedBeforeBreaking": 3,
        "DurationOfBreak": 10,
        "TimeoutValue": 5000
      },
      //"AuthenticationOptions": {
      //  "AuthenticationProviderKey": "Bearer",
      //  "AllowedScopes": []
      //}
    },
    //swagger api2配置
    {
      "UpstreamPathTemplate": "/ServiceApiTwo/swagger.json",
      "UpstreamHttpMethod": [ "Get", "Post", "Put", "Delete" ],
      "DownstreamPathTemplate": "/ServiceApiTwo/swagger.json",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 2343
        }
      ]
    },
    //swagger api1多版本配置v1.0
    {
      "UpstreamPathTemplate": "/ServiceApiOne/1.0/swagger.json",
      "UpstreamHttpMethod": [ "Get", "Post", "Put", "Delete" ],
      "DownstreamPathTemplate": "/ServiceApiOne/1.0/swagger.json",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 2108
        }
      ]
    },
    //swagger api1多版本配置v2.0
    {
      "UpstreamPathTemplate": "/ServiceApiOne/2.0/swagger.json",
      "UpstreamHttpMethod": [ "Get", "Post", "Put", "Delete" ],
      "DownstreamPathTemplate": "/ServiceApiOne/2.0/swagger.json",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 2108
        }
      ]
    }
  ]
}

　　Startup.ConfigureServices注册swagger和Ocelot网关服务，ConfigureServices中的swagger配置和业务api中一样，

services.AddOcelot(Configuration)
                .AddConsul()
                .AddCacheManager(c => c.WithDictionaryHandle())
                .AddPolly();

services.AddSwaggerGen(options =>
            {
                options.SwaggerDoc(Configuration["Swagger:Name"], new Info
                {
                    Title = Configuration["Swagger:Title"],
                    Version = Configuration["Swagger:Version"],
                    Description = Configuration["Swagger:Description"],
                    License = new License
                    {
                        Name = Configuration["Swagger:License:Name"],
                        Url = Configuration["Swagger:License:Url"]
                    },
                    Contact = new Contact
                    {
                        Name = Configuration["Swagger:Contact:Name"],
                        Email = Configuration["Swagger:Contact:Email"],
                        Url = Configuration["Swagger:Contact:Url"]
                    }
                });
            });

　　Startup.Configure中，我是使用了配置文件，将业务api的swagger节点写在了配置文件中。

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                // 配置文件中的SwaggerName为业务api中是SwaggerEndPoint名称，有版本号的带上版本号
                var apis = Configuration["SwaggerApis:SwaggerName"].Split(';').ToList();
                app.UseSwagger();
                app.UseSwaggerUI(options=>
                {
                    //显示注册到网关的api接口
                    apis.ForEach(key =>
                    {
                        options.SwaggerEndpoint($"/{key}/swagger.json", key);
                    });
                    options.DocumentTitle = "api网关";
                });

            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
            }

            app.UseStaticFiles();
            app.UseCookiePolicy();

            app.UseMvc(routes =>
            {
                routes.MapRoute(
                    name: "default",
                    template: "{controller=Home}/{action=Index}/{id?}");
            });

            app.UseOcelot().Wait(); // 使用Ocelot网关中间件

        }

　　修改ApiGateway项目Program.cs将配置文件添加进来。

public static IWebHostBuilder CreateWebHostBuilder(string[] args) =>
            WebHost.CreateDefaultBuilder(args)
            .ConfigureAppConfiguration((hostingContext,config)=>
            {
                var env = hostingContext.HostingEnvironment;
                //根据环境变量加载不同的json配置
                config.AddJsonFile($"appsettings.{env.EnvironmentName}.json", optional: true, reloadOnChange: true)
                .AddJsonFile("OcelotConfig.json")//网关配置
                .AddEnvironmentVariables();//环境变量
            })
            .ConfigureLogging((hostingContext,logging)=>
            {
                logging.AddConfiguration(hostingContext.Configuration.GetSection("Logging"));
                
                logging.AddConsole();
                //添加调试日志
                logging.AddDebug();
            })
            .UseStartup<Startup>();

　　网关配置了，swagger也配置了，启动业务api和网关服务看看效果。

 　　两个业务api的swagger文档都可以正常查看。发请求看一下，结果响应404，仔细看一下，请求的服务地址是网关服务的地址，而不是业务api的地址，难道是Ocelot网关路由配置错了？使用Postman发一个GET请求看看，localhost:1999/gateway/two/values，网关转发到localhost:2343/api/values，响应正常。

 　　看swashbuckle文档这一段，将业务api中Configure加上这一段后再次通过网关发起请求，结果出现TypeError。既然出错了，打开浏览器调试工具看一下就明白了，Failed to load http://localhost:2343/api/ApiTwo: No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:1999' is therefore not allowed access.

　　网关请求业务api跨域了，要让业务api允许来自网关的请求，需要设置业务api跨域请求政策。加上下面的配置后，网关请求正常了。

　　修改Startup.Configure

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();

                app.UseSwagger(c=>
                {
                    //处理网关通过swagger访问
                    c.PreSerializeFilters.Add((swaggerDoc, httpReq) => swaggerDoc.Host = httpReq.Host.Value);
                    c.RouteTemplate = "{documentName}/swagger.json";
                });
                app.UseSwaggerUI(u =>
                {
                    u.SwaggerEndpoint("/ServiceApiTwo/swagger.json", "ServiceApiTwo");
                    u.DocumentTitle = "Service Api #2 文档";
                });
            }

            // 允许网关访问
            app.UseCors(options =>
            {
                options.WithOrigins("http://localhost:1999")
                .AllowAnyHeader()
                .AllowAnyMethod();
            });
            app.UseMvc();
        }

 

 使用IdentityServer4保护webapi

 　　先前已经创建IdentityServer项目，添加引用IdentityServer4.AspNetIdentity(2.5.0)、IdentityServer4.EntityFramework(2.5.0)。新建一个类IdentityServerConfig，里面定义四个方法GetApiResources、GetIdentityResources、GetClients、GetTestUsers，具体代码就不贴了，看一下Startup。生产环境的话，当然要用数据库，这里不讨论IdentityServer4的使用。

public void ConfigureServices(IServiceCollection services)
        {
            services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_2);

            services.AddIdentityServer()
                .AddDeveloperSigningCredential()
                .AddInMemoryPersistedGrants()
                .AddTestUsers(IdentityServerConfig.GetTestUsers())
                .AddInMemoryIdentityResources(IdentityServerConfig.GetIdentityResources())
                .AddInMemoryApiResources(IdentityServerConfig.GetApiResources())
                .AddInMemoryClients(IdentityServerConfig.GetClients(Configuration));
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseIdentityServer();

            app.UseMvc();
        }

　　将网关和两个api项目对应的ApiResources和Clients分别为api-gateway、service-api-one、service-api-two，两个api客户端AllowedScope为自己，网关的AllowedScope为自己和两个api客户端。在需要保护的三个项目中添加引用IdentityServer4.AccessTokenValidation(2.7.0)，修改Startup的ConfigureServices，添加如下代码。

//使用IdentityServer4
            services.AddAuthentication(IdentityServerAuthenticationDefaults.AuthenticationScheme)
                .AddIdentityServerAuthentication(options =>
                {
                    options.ApiName = "service-api-two";
                    options.Authority = "http://localhost:16690"; // IdentityServer验证服务
                    options.RequireHttpsMetadata = false;
                    options.EnableCaching = true;
                });

　　Startup.Configure中添加app.UseAuthentication();

　　要在swagger中访问需要验证的api，需要在swagger配置中添加安全验证。

services.AddSwaggerGen(options =>
            {
                //SwaggerDoc的第一个参数要与Configure中SwaggerEndPoint中的版本名称一致
                //既可以使用版本号，也可以使用自定义名称
                options.SwaggerDoc("ServiceApiTwo", new Info
                {
                    Title = "Services.Api #two",
                    Version = "v1",
                    Description = "服务api #two",
                    License = new License
                    {
                        Name = "MIT",
                        Url = "https://mit-license.org/"
                    },
                    Contact = new Contact
                    {
                        Name = "原来是李",
                        Url = "http://www.cnblogs.com/falltakeman"
                    }
                });
                var xmlFile = $"{Assembly.GetExecutingAssembly().GetName().Name}.xml";
                var xmlPath = Path.Combine(AppDomain.CurrentDomain.BaseDirectory, xmlFile);
                options.IncludeXmlComments(xmlPath);
                // swagger访问需要验证的api
                options.AddSecurityDefinition("Bearer", new ApiKeyScheme
                {
                    In = "header",
                    Name = "Authorization",
                    Type = "apiKey",
                    Description = "Bearer {token}"
                });
                options.AddSecurityRequirement(new Dictionary<string, IEnumerable<string>>
                {
                    {
                        "Bearer",
                        Enumerable.Empty<string>()
                    }
                });
            });

　　在api控制器中，在需要保护的api上添加[Authorize]特性，没有授权的情况下访问受限api会报401错误。

 　　使用postman获取token，在swagger中填写token，再次发起请求，响应正常。

 　　在ApiGateway的Startup.ConfigureServices添加Authentication，在Services.AddSwaggerGen添加相应代码，启动项目在app.UseOcelot().Wait()抛出异常：Scheme already exists: BearerIdentityServerAuthenticationJwt. 最终使用了下面的方式。在ApiGateway项目中通过swagger也可以访问业务api了。

Action<IdentityServerAuthenticationOptions> isaOpt = option =>
            {
                option.Authority = Configuration["IdentityService:Uri"];
                option.RequireHttpsMetadata = Convert.ToBoolean(Configuration["IdentityService:UseHttps"]);
                option.ApiName = Configuration["IdentityService:ApiName"];
                option.ApiSecret = Configuration["IdentityService:ApiSecret"];
                option.SupportedTokens = SupportedTokens.Both;
            };
            services.AddAuthentication().AddIdentityServerAuthentication(Configuration["IdentityService:DefaultScheme"], isaOpt);

　　但是配置中的IdentityService:DefaultScheme不可以是"Bearer"，试验配置的是"IdentityBearer"，不知为何不可以是"Bearer"，不知道有没有懂这个的可以指点一二。

the end...