IdentityServer4 系列 【二】-- 创建鉴权端，使用PostMan获取Token

1、新建.net core 3.1 Web 空项目。

2、Nuget 增加 IdentityServer4（4.1.1）、Autofac（6.0.0）目前使用的版本

3、新建 Config.cs 配置文件 ，源码如下

using System.Collections.Generic;
using IdentityServer4.Models;
namespace IdentityServer
{
    public class Config1
    {
        public static IEnumerable<ApiResource> GetApiResources()
        {
            return new List<ApiResource>
            {
                new ApiResource("userapi"){Scopes={"userscopes"}}
            };
        }

        public static IEnumerable<ApiScope> GetApiScopes()
        {
            return new List<ApiScope>
            {
                new ApiScope("userscopes")
            };
        }

        public static IEnumerable<Client> GetClients()
        {
            return new List<Client>{
                new Client(){
                    ClientId = "webclient",
                    ClientName = "webclient",
                    AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
                    RequireClientSecret = false, //客户端不需要输入Secret
                    AllowedScopes = {"userscopes"},
                    ClientSecrets = {new Secret("webclient".Sha256())}
                }
            };
        }
    }
}

4、由于生产环境中帐号密码取之于数据库中的User表，并不是用于测试的TestUser，所以要增加两个类，一个是验证帐号密码，另一个是帐号另外的一些自定义信息

using IdentityModel;
using IdentityServer4.Validation;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Claims;
using System.Threading.Tasks;
using IdentityServer.DbModel;
namespace IdentityServer
{
    public class ResourceOwnerPasswordValidatorcs : IResourceOwnerPasswordValidator
    {
        public async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
        {
            UserServices userServices = new UserServices();
            UserDbModel user = userServices.UserValidator(context.UserName, context.Password);
            if (user != null)
            {
                List<Claim> claims = new List<Claim>() {
                    new Claim("username",user.USERNAME)

                };
                context.Result = new GrantValidationResult(
                    context.UserName,
                    OidcConstants.AuthenticationMethods.Password,
                    claims
                    );
            }
            else
            {
                context.Result = new GrantValidationResult(
                    IdentityServer4.Models.TokenRequestErrors.InvalidGrant,
                    "invalid custom credential"
                    );
            }
            await Task.CompletedTask;
        }
    }
}

using IdentityServer4.Models;
using IdentityServer4.Services;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace IdentityServer
{
    /// <summary>
    /// 获取用户信息并返回给客户端
    /// </summary>
    public class ProfileService : IProfileService
    {
        /// <summary>
        /// 获取用户信息
        /// </summary>
        /// <param name="context"></param>
        /// <returns></returns>
        public Task GetProfileDataAsync(ProfileDataRequestContext context)
        {
            return Task.Run(()=> {
                try
                {
                    //用户信息
                    var claims = context.Subject.Claims.ToList();

                    //获取用户信息
                    context.IssuedClaims = claims.ToList();
                }
                catch (Exception ex)
                {
                    //log your error
                }
            });            
        }
        /// <summary>
        /// 获取或设置一个值，该值指示主题是否处于活动状态并且可以接收令牌。
        /// </summary>
        /// <param name="context"></param>
        /// <returns></returns>
        public Task IsActiveAsync(IsActiveContext context)
        {
            return Task.Run(()=> { context.IsActive = true; });             
        }
    }
}

5、修改Startup.cs文件

ConfigureServices 方法中添加IdentityServer设置，与跨域设置

//设置IdentityServer4 
services.AddIdentityServer()
            .AddInMemoryApiResources(Config.GetApiResources())
            .AddInMemoryApiScopes(Config.GetApiScopes())
            .AddInMemoryClients(Config.GetClients())
            .AddResourceOwnerValidator<ResourceOwnerPasswordValidatorcs>()
            .AddProfileService<ProfileService>()
            .AddDeveloperSigningCredential();

//设置跨域
            services.AddCors(options =>
            {
                options.AddPolicy("any", builder =>
                {
                    builder.WithOrigins("*");
                });
            });

Configure 方法中添加设置

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseCors("any");

            app.UseRouting();

            app.UseIdentityServer();
        }

6、此时，鉴权端已经使用开发完成，启动即可。

7、使用postman获取Token

以后可以将config的配置都写入数据库中，进行读取。至此鉴权端已经完成，下面介绍资源端开发。