使用Abp vnext构建基于Duende.IdentityServer的统一授权中心(一)

原来看到很多示例都是基于IdentityServer4的统一授权中心,但是IdentityServer4维护到2022年就不再进行更新维护了,所以我选择了它的升级版Duende.IdentityServer(这个有总营收超过100W美金就需要付费的限制).

整个授权中心完成我打算分成4个部分去构建整个项目,争取在12月中旬全部完成.

第一部分(已完成):与Abp vnext进行整合,实现数据库存储,并且能够正常颁发token

第二部分(构建中):实现可视化管理后台

第三部分(未开始):实现自定义账户体系,单点登录等...

第四部分(未开始):接入网关(我还另外整了一个基于Yarp的简单网关)

注:基于Yarp的网关项目以及统一授权中心在我完成第二部分的构建时会开源出来(并不包含Duende.IdentityServer本身)

接下来讲解第一部分的实现

下图是我的解决方案(我没有使用默认的Abp vnext生成的项目模板,而是我在去掉ABP默认的模块后保留了自己觉得已经适用的基础模块创建的模板):

既然是要支持持久化到数据库,那么我就需要把原来实体类型进行改造,以客户端信息表为例,下面代码中所变更之处

a.所有实体类都继承自 Entity<Guid>并且使用GUID作为主键(Abp推荐使用GUID作为主键)

b.去掉了原有的外键关系

c.增加了字符串类型字段的长度限制

#pragma warning disable 1591

using System;
using System.Collections.Generic;
using System.ComponentModel.DataAnnotations;
using Duende.IdentityServer.Models;
using Volo.Abp.Domain.Entities;

namespace Pterosaur.Authorization.Domain.Entities
{
    public class Client: Entity<Guid>
    {
        public Client() { }
        public Client(Guid id)
        {
            Id = id;
        }
        /// <summary>
        /// 是否启用
        /// </summary>
        public bool Enabled { get; set; } = true;
        /// <summary>
        /// 客户端ID
        /// </summary>
        [MaxLength(128)]
        public string ClientId { get; set; }
        /// <summary>
        /// 协议类型
        /// </summary>
        [MaxLength(64)]
        public string ProtocolType { get; set; } = "oidc";
        /// <summary>
        /// 如果设置为false，则在令牌端点请求令牌时不需要客户端机密（默认为<c>true</c>）
        /// </summary>
        public bool RequireClientSecret { get; set; } = true;
        /// <summary>
        /// 客户端名
        /// </summary>
        [MaxLength(128)]
        public string ClientName { get; set; }
        /// <summary>
        /// 描述
        /// </summary>
        [MaxLength(1024)]
        public string Description { get; set; }
        /// <summary>
        /// 客户端地址
        /// </summary>
        [MaxLength(256)]
        public string ClientUri { get; set; }
        /// <summary>
        /// 客户端LGOGO地址
        /// </summary>
        [MaxLength(512)]
        public string LogoUri { get; set; }
        /// <summary>
        /// 指定是否需要同意屏幕（默认为<c>false</c>）
        /// </summary>
        public bool RequireConsent { get; set; } = false;
        /// <summary>
        /// 指定用户是否可以选择存储同意决定（默认为<c>true</c>）
        /// </summary>
        public bool AllowRememberConsent { get; set; } = true;
        /// <summary>
        /// 当同时请求id令牌和访问令牌时，是否应始终将用户声明添加到id令牌，而不是要求客户端使用userinfo端点。 
        /// </summary>
        public bool AlwaysIncludeUserClaimsInIdToken { get; set; } = false;
        /// <summary>
        /// 是否需要验证密钥（默认为<c>true</c>）。
        /// </summary>
        public bool RequirePkce { get; set; } = true;
        /// <summary>
        /// 是否可以使用普通方法发送验证密钥（不推荐，默认为<c>false</c>） 
        /// </summary>
        public bool AllowPlainTextPkce { get; set; } = false;
        /// <summary>
        /// 是否必须在授权请求上使用请求对象（默认为<c>false</c>）
        /// </summary>
        public bool RequireRequestObject { get; set; }
        /// <summary>
        /// 控制是否通过此客户端的浏览器传输访问令牌（默认为<c>false</c>）。
        /// 当允许多种响应类型时，这可以防止访问令牌的意外泄漏。
        /// </summary>
        public bool AllowAccessTokensViaBrowser { get; set; }
        /// <summary>
        /// 客户端上基于HTTP前端通道的注销的注销URI。
        /// </summary>
        [MaxLength(512)]
        public string FrontChannelLogoutUri { get; set; }
        /// <summary>
        /// 是否应将用户的会话id发送到FrontChannelLogoutUri。默认值为<c>true</c>。
        /// </summary>
        public bool FrontChannelLogoutSessionRequired { get; set; } = true;
        /// <summary>
        /// 指定客户端上基于HTTP反向通道的注销的注销URI。
        /// </summary>
        [MaxLength(512)]
        public string BackChannelLogoutUri { get; set; }
        /// <summary>
        /// 是否应将用户的会话id发送到BackChannelLogoutUri。默认值为<c>true</c>
        /// </summary>
        public bool BackChannelLogoutSessionRequired { get; set; } = true;
        /// <summary>
        /// [是否允许脱机访问]。默认值为<c>false</c>。
        /// </summary>
        public bool AllowOfflineAccess { get; set; }
        /// <summary>
        /// 标识令牌的生存期（秒）（默认为300秒/5分钟）
        /// </summary>
        public int IdentityTokenLifetime { get; set; } = 300;
        /// <summary>
        /// 身份令牌的签名算法。如果为空，将使用服务器默认签名算法。
        /// </summary>
        [MaxLength(128)]
        public string AllowedIdentityTokenSigningAlgorithms { get; set; }
        /// <summary>
        /// 访问令牌的生存期（秒）（默认为3600秒/1小时）
        /// </summary>
        public int AccessTokenLifetime { get; set; } = 3600;
        /// <summary>
        /// 授权代码的生存期（秒）（默认为300秒/5分钟）
        /// </summary>
        public int AuthorizationCodeLifetime { get; set; } = 300;
        /// <summary>
        /// 用户同意的生存期（秒）。默认为null（无过期）
        /// </summary>
        public int? ConsentLifetime { get; set; } = null;
        /// <summary>
        /// 刷新令牌的最长生存期（秒）。默认值为2592000秒/30天
        /// </summary>
        public int AbsoluteRefreshTokenLifetime { get; set; } = 2592000;
        /// <summary>
        /// 刷新令牌的滑动生存期（秒）。默认为1296000秒/15天
        /// </summary>
        public int SlidingRefreshTokenLifetime { get; set; } = 1296000;
        /// <summary>
        /// 重用：刷新令牌时，刷新令牌句柄将保持不变
        /// 一次性：刷新令牌时将更新刷新令牌句柄 
        /// </summary>
        public int RefreshTokenUsage { get; set; } = (int)TokenUsage.OneTimeOnly;
        /// <summary>
        /// 是否应在刷新令牌请求时更新访问令牌（及其声明）。
        /// 默认值为<c>false</c>。
        /// </summary>
        public bool UpdateAccessTokenClaimsOnRefresh { get; set; } = false;
        /// <summary>
        /// 绝对：刷新令牌将在固定时间点过期（由绝对刷新令牌生命周期指定）
        /// 滑动：刷新令牌时，刷新令牌的生存期将被更新（按SlidingRefreshTokenLifetime中指定的数量）。寿命不会超过绝对寿命。
        /// </summary>
        public int RefreshTokenExpiration { get; set; } = (int)TokenExpiration.Absolute;
        /// <summary>
        /// 访问令牌类型（默认为JWT）。
        /// </summary>
        public int AccessTokenType { get; set; } = 0; // AccessTokenType.Jwt;
        /// <summary>
        /// 客户端是否允许本地登录。默认值为<c>true</c>。
        /// </summary>
        public bool EnableLocalLogin { get; set; } = true;
        /// <summary>
        /// JWT访问令牌是否应包含标识符。默认值为<c>true</c>。
        /// </summary>
        public bool IncludeJwtId { get; set; }
        /// <summary>
        /// 该值指示客户端声明应始终包含在访问令牌中，还是仅包含在客户端凭据流中。
        /// 默认值为<c>false</c>
        /// </summary>
        public bool AlwaysSendClientClaims { get; set; }
        /// <summary>
        /// 客户端声明类型前缀。默认为<c>client_</c>。
        /// </summary>
        [MaxLength(256)]
        public string ClientClaimsPrefix { get; set; } = "client_";
        /// <summary>
        /// 此客户端的用户在成对主体生成中使用的salt值。
        /// </summary>
        [MaxLength(128)]
        public string PairWiseSubjectSalt { get; set; }
        /// <summary>
        /// 自上次用户身份验证以来的最长持续时间（秒）。
        /// </summary>
        public int? UserSsoLifetime { get; set; }
        /// <summary>
        /// 设备流用户代码的类型。
        /// </summary>
        [MaxLength(128)]
        public string UserCodeType { get; set; }
        /// <summary>
        /// 设备代码生存期。
        /// </summary>
        public int DeviceCodeLifetime { get; set; } = 300;
        /// <summary>
        /// 创建时间
        /// </summary>
        public DateTime Created { get; set; } = DateTime.UtcNow;
        /// <summary>
        /// 更新时间
        /// </summary>
        public DateTime? Updated { get; set; }
        /// <summary>
        /// 最后访问时间
        /// </summary>
        public DateTime? LastAccessed { get; set; }
    }
}

下图是所有实体类图:

使用EFCore 6.0做好数据库表结构迁移工作,在自定义的DbContext上下文中添加实体类

using Microsoft.EntityFrameworkCore;
using Pterosaur.Authorization.Domain.Entities;
using Volo.Abp.Data;
using Volo.Abp.DependencyInjection;
using Volo.Abp.EntityFrameworkCore;

namespace Pterosaur.Authorization.EntityFrameworkCore
{
    [ConnectionStringName("Default")]
    public class PterosaurDbContext : AbpDbContext<PterosaurDbContext>
    {

        #region IdentityServer Entities from the modules
        public DbSet<IdentityResourceProperty> IdentityResourceProperties { get; set; }
        public DbSet<IdentityResourceClaim> IdentityResourceClaims { get; set; }
        public DbSet<IdentityResource> IdentityResources { get; set; }
        public DbSet<IdentityProvider> IdentityProviders { get; set; }
        public DbSet<DeviceFlowCodes> DeviceFlowCodes { get; set; }
        public DbSet<ApiScopeProperty> ApiScopeProperties { get; set; }
        public DbSet<ApiScopeClaim> ApiScopeClaims { get; set; }
        public DbSet<ApiScope> ApiScopes { get; set; }
        public DbSet<ApiResourceSecret> ApiResourceSecrets { get; set; }
        public DbSet<ApiResourceScope> ApiResourceScopes { get; set; }
        public DbSet<ApiResourceProperty> ApiResourceProperties { get; set; }
        public DbSet<ApiResourceClaim> ApiResourceClaims { get; set; }
        public DbSet<ApiResource> ApiResources { get; set; }

        public DbSet<Client> Clients { get; set; }
        public DbSet<ClientClaim> ClientClaims { get; set; }
        public DbSet<ClientCorsOrigin> ClientCorsOrigins { get; set; }
        public DbSet<ClientGrantType> ClientGrantTypes { get; set; }
        public DbSet<ClientIdPRestriction> ClientIdPRestrictions { get; set; }
        public DbSet<ClientPostLogoutRedirectUri> ClientPostLogoutRedirectUris { get; set; }
        public DbSet<ClientProperty> ClientProperties { get; set; }
        public DbSet<ClientRedirectUri> ClientRedirectUris { get; set; }
        public DbSet<ClientScope> ClientScopes { get; set; }
        public DbSet<ClientSecret> ClientSecrets { get; set; }
        #endregion
        
        public PterosaurDbContext(DbContextOptions<PterosaurDbContext> options): base(options)
        {

        }

        protected override void OnModelCreating(ModelBuilder builder)
        {
            builder.Seed();//此处构建种子数据
            base.OnModelCreating(builder);
        }
    }
}

接下构建一条测试用的客户端信息种子数据

using Microsoft.EntityFrameworkCore;
using Pterosaur.Authorization.Domain.Entities;
using System;

namespace Pterosaur.Authorization.EntityFrameworkCore
{
    public static class ModelBuilderExtensions
    {
        public static void Seed(this ModelBuilder modelBuilder)
        {
            var id = Guid.NewGuid();
            modelBuilder.Entity<Client>().HasData(
                new Client(id) 
                {
                    ClientId = "pterosaur.io",
                    ClientName = "pterosaur.io",
                    Description = "pterosaur.io"
                }
            );

            modelBuilder.Entity<ClientSecret>().HasData(
                new ClientSecret(Guid.NewGuid())
                {
                    ClientId= id,
                    Created=DateTime.Now,
                    Expiration=DateTime.Now.AddYears(10),
                    Value= "pterosaur.io",
                    Description = "pterosaur.io"
                }
            );
            modelBuilder.Entity<ClientScope>().HasData(
                new ClientScope(Guid.NewGuid())
                {
                    ClientId = id,
                    Scope="api"
                }
           );
        }
    }
}

执行完数据库迁移脚本命令,就能看到数据库表了

 接下来就是如何让IdentityServer从数据库读取了,这里我们需要实现几个核心接口,这个参考了它本身的EFCore的实现,不过我想改造成适配Abp vnext的所以折腾了下:

IClientStore 接口: 客户端存储接口,实现了此接口IdentityServer就会从指定的实现去读取客户端数据,代码实现如下

using Duende.IdentityServer.Models;
using Duende.IdentityServer.Stores;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Volo.Abp.Domain.Repositories;
using Mapster;
using Volo.Abp.Uow;

namespace Pterosaur.Authorization.Domain.Services.IdentityServer
{
    public class ClientStoreManager : IClientStore
    {
        private readonly IClientManager _clientManager;
        public ClientStoreManager(IClientManager clientManager)
        {
            _clientManager = clientManager;
        }
        public async Task<Client> FindClientByIdAsync(string clientId)
        {
            //
            var client =await _clientManager.GetClientDetail(clientId);
            if (client == null)
            {
                return null;
            }
            var result = new Client();
            TypeAdapter.Adapt(client, result);
            result.AllowedCorsOrigins = client.ClientCorsOrigins.Select(c => c.Origin).ToList();
            result.AllowedGrantTypes = client.ClientGrantTypes.Select(c => c.GrantType).ToList();
            result.AllowedScopes = client.AllowedScopes.Select(c => c.Scope).ToList();
            result.Claims = client.ClientClaims.Select(c => new ClientClaim() { Type = c.Type, Value = c.Value, ValueType = c.ValueType }).ToList();

            
            result.ClientSecrets = client.ClientSecrets.Select(c => new Secret() { Description = c.Description, Expiration = c.Expiration, Type = c.Type, Value = c.Value.Sha256() }).ToList();
            result.IdentityProviderRestrictions = client.ClientIdPRestrictions.Select(c => c.Provider).ToList();
            result.PostLogoutRedirectUris = client.ClientPostLogoutRedirectUris.Select(c => c.PostLogoutRedirectUri).ToList();
            result.Properties = client.ClientProperties.ToDictionary(c => c.Key, c => c.Value);
            result.RedirectUris = client.ClientRedirectUris.Select(c => c.RedirectUri).ToList();
            return result;
        }
    }
}

IResourceStore 接口: Api资源存储接口,代码实现如下(代码其实有很多地方可以优化的,不过我想的是先实现功能先)

using Duende.IdentityServer.Models;
using Duende.IdentityServer.Services;
using Duende.IdentityServer.Stores;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Linq.Expressions;
using System.Text;
using System.Threading.Tasks;
using Volo.Abp.Domain.Repositories;
using Mapster;
using Volo.Abp.Uow;

namespace Pterosaur.Authorization.Domain.Services.IdentityServer
{
    public class ResourceStoreManager : IResourceStore
    {
        //
        private readonly IApiResourceManager _apiResourceManager;
        private readonly IApiScopeManager _apiScopeManager;
        private readonly IIdentityResourceManager _identityResourceManager;
        public ResourceStoreManager(IApiResourceManager apiResourceManager, IApiScopeManager apiScopeManager, IIdentityResourceManager identityResourceManager)
        {
            _apiResourceManager = apiResourceManager;
            _apiScopeManager = apiScopeManager;
            _identityResourceManager= identityResourceManager;
        }
        /// <summary>
        /// 根据API资源名称获取API资源数据
        /// </summary>
        /// <param name="apiResourceNames"></param>
        /// <returns></returns>
        /// <exception cref="ArgumentNullException"></exception>
        public async Task<IEnumerable<ApiResource>> FindApiResourcesByNameAsync(IEnumerable<string> apiResourceNames)
        {
            if (apiResourceNames == null) throw new ArgumentNullException(nameof(apiResourceNames));

            var queryResult =await _apiResourceManager.GetApiResourcesAsync(x => apiResourceNames.Contains(x.Name));

            var apiResources = queryResult.Select(x => new ApiResource()
            {
                Description = x.Description,
                DisplayName = x.DisplayName,
                Enabled = x.Enabled,
                Name = x.Name,
                RequireResourceIndicator = x.RequireResourceIndicator,
                ShowInDiscoveryDocument = x.ShowInDiscoveryDocument,
                ApiSecrets = x.Secrets.Where(sec => sec.ApiResourceId == x.Id).Select(sec => new Secret()
                {
                    Description = sec.Description,
                    Expiration = sec.Expiration,
                    Type = sec.Type,
                    Value = sec.Value
                }).ToList(),
                
                Scopes = x.Scopes.Where(sco => sco.ApiResourceId == x.Id).Select(x => x.Scope).ToList(),
                UserClaims = x.UserClaims.Where(c => c.ApiResourceId == x.Id).Select(x => x.Type).ToList(),
                Properties=x.Properties.ToDictionary(c=>c.Key,c=>c.Value)
            })
            .ToList();
            return apiResources;
        }
        /// <summary>
        /// 根据作用域名称获取API资源数据
        /// </summary>
        /// <param name="scopeNames"></param>
        /// <returns></returns>
        /// <exception cref="ArgumentNullException"></exception>
        public async Task<IEnumerable<ApiResource>> FindApiResourcesByScopeNameAsync(IEnumerable<string> scopeNames)
        {
            if (scopeNames == null) throw new ArgumentNullException(nameof(scopeNames));
            var queryResult = await _apiResourceManager.GetApiResourcesAsync(x => x.Scopes.Where(s => scopeNames.Contains(s.Scope)).Any());

            var apiResources = queryResult.Select(x => new ApiResource()
            {
                Description = x.Description,
                DisplayName = x.DisplayName,
                Enabled = x.Enabled,
                Name = x.Name,
                RequireResourceIndicator = x.RequireResourceIndicator,
                ShowInDiscoveryDocument = x.ShowInDiscoveryDocument,
                ApiSecrets = x.Secrets.Where(sec => sec.ApiResourceId == x.Id).Select(sec => new Secret()
                {
                    Description = sec.Description,
                    Expiration = sec.Expiration,
                    Type = sec.Type,
                    Value = sec.Value
                }).ToList(),

                Scopes = x.Scopes.Where(sco => sco.ApiResourceId == x.Id).Select(x => x.Scope).ToList(),
                UserClaims = x.UserClaims.Where(c => c.ApiResourceId == x.Id).Select(x => x.Type).ToList(),
                Properties = x.Properties.ToDictionary(c => c.Key, c => c.Value)
            })
            .ToList();
            return apiResources;
        }
        /// <summary>
        /// 根据作用域名称获取作用域数据
        /// </summary>
        /// <param name="scopeNames"></param>
        /// <returns></returns>
        public async Task<IEnumerable<ApiScope>> FindApiScopesByNameAsync(IEnumerable<string> scopeNames)
        {
            var queryResult=await _apiScopeManager.GetApiScopesAsync(x => scopeNames.Contains(x.Name));
            var apiScopes = queryResult
                .Select(x => new ApiScope()
                {
                    Description = x.Description,
                    Name = x.Name,
                    DisplayName = x.DisplayName,
                    Emphasize = x.Emphasize,
                    Enabled = x.Enabled,
                    Properties = x.Properties.Where(p => p.ScopeId == x.Id).ToList().ToDictionary(x => x.Key, x => x.Value),
                    Required = x.Required,
                    ShowInDiscoveryDocument = x.ShowInDiscoveryDocument,
                    UserClaims = x.UserClaims.Where(c => c.ScopeId == x.Id).Select(c => c.Type).ToList()
                })
                .ToList();
            
            return apiScopes;
        }

        public async Task<IEnumerable<IdentityResource>> FindIdentityResourcesByScopeNameAsync(IEnumerable<string> scopeNames)
        {
            //身份资源数据
            var queryResult = await _identityResourceManager.GetIdentityResourcesAsync(x => scopeNames.Contains(x.Name));
            
            var identityResources = queryResult.Select(x => new IdentityResource()
            {
                Description = x.Description,
                DisplayName = x.DisplayName,
                Emphasize = x.Emphasize,
                Enabled = x.Enabled,
                Name = x.Name,
                Required = x.Required,
                ShowInDiscoveryDocument = x.ShowInDiscoveryDocument,
                Properties = x.IdentityResourceProperties.Where(p => p.IdentityResourceId == x.Id).ToDictionary(x => x.Key, x => x.Value),
                UserClaims = x.IdentityResourceClaims.Where(c => c.IdentityResourceId == x.Id).Select(c => c.Type).ToList(),
                
            })
            .ToList();
            return identityResources;
        }
        /// <summary>
        /// 获取所有资源数据
        /// </summary>
        /// <returns></returns>
        public async Task<Resources> GetAllResourcesAsync()
        {
            //身份资源数据
            var identityResourceQueryResult = await _identityResourceManager.GetIdentityResourcesAsync(null);

            var identityResources = identityResourceQueryResult.Select(x => new IdentityResource()
            {
                Description = x.Description,
                DisplayName = x.DisplayName,
                Emphasize = x.Emphasize,
                Enabled = x.Enabled,
                Name = x.Name,
                Required = x.Required,
                ShowInDiscoveryDocument = x.ShowInDiscoveryDocument,
                Properties = x.IdentityResourceProperties.Where(p => p.IdentityResourceId == x.Id).ToDictionary(x => x.Key, x => x.Value),
                UserClaims = x.IdentityResourceClaims.Where(c => c.IdentityResourceId == x.Id).Select(c => c.Type).ToList(),

            })
            .ToList();
            //api资源数据
            var apiResourceQueryResult = await _apiResourceManager.GetApiResourcesAsync(null);
            var apiResources = apiResourceQueryResult.Select(x => new ApiResource()
            {
                Description = x.Description,
                DisplayName = x.DisplayName,
                Enabled = x.Enabled,
                Name = x.Name,
                RequireResourceIndicator = x.RequireResourceIndicator,
                ShowInDiscoveryDocument = x.ShowInDiscoveryDocument,
                ApiSecrets = x.Secrets.Where(sec => sec.ApiResourceId == x.Id).Select(sec => new Secret()
                {
                    Description = sec.Description,
                    Expiration = sec.Expiration,
                    Type = sec.Type,
                    Value = sec.Value
                }).ToList(),

                Scopes = x.Scopes.Where(sco => sco.ApiResourceId == x.Id).Select(x => x.Scope).ToList(),
                UserClaims = x.UserClaims.Where(c => c.ApiResourceId == x.Id).Select(x => x.Type).ToList(),
                Properties = x.Properties.ToDictionary(c => c.Key, c => c.Value)
            })
            .ToList();
            //api作用域数据
            var apiScopeQueryResult = await _apiScopeManager.GetApiScopesAsync(null);
            var apiScopes = apiScopeQueryResult
                .Select(x => new ApiScope()
                {
                    Description = x.Description,
                    Name = x.Name,
                    DisplayName = x.DisplayName,
                    Emphasize = x.Emphasize,
                    Enabled = x.Enabled,
                    Properties = x.Properties.Where(p => p.ScopeId == x.Id).ToList().ToDictionary(x => x.Key, x => x.Value),
                    Required = x.Required,
                    ShowInDiscoveryDocument = x.ShowInDiscoveryDocument,
                    UserClaims = x.UserClaims.Where(c => c.ScopeId == x.Id).Select(c => c.Type).ToList()
                })
                .ToList();
            //返回结果
            var result = new Resources(identityResources, apiResources, apiScopes);
            return result;
        }
    }
}

IIdentityProviderStore 接口:身份资源存储接口,代码实现如下(突然发现这个接口实现还没把数据库查询剥离出去[捂脸]...脸呢...不重要...)

using Duende.IdentityServer.Models;
using Duende.IdentityServer.Stores;
using Serilog;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using Volo.Abp.Domain.Repositories;
using Mapster;
using Volo.Abp.Uow;

namespace Pterosaur.Authorization.Domain.Services.IdentityServer
{
    public class IdentityProviderStoreManager: IIdentityProviderStore
    {
        private readonly IRepository<Entities.IdentityProvider> _repository;

        private readonly IUnitOfWorkManager _unitOfWorkManager;
        public IdentityProviderStoreManager(IRepository<Entities.IdentityProvider> repository, IUnitOfWorkManager unitOfWorkManager)
        {
            _repository = repository;
            _unitOfWorkManager = unitOfWorkManager;
        }

        public async Task<IEnumerable<IdentityProviderName>> GetAllSchemeNamesAsync()
        {
            using var unitOfWork = _unitOfWorkManager.Begin();
            var identityProviderNames = (await _repository.GetQueryableAsync()).Select(x => new IdentityProviderName
            {
                Enabled = x.Enabled,
                Scheme = x.Scheme,
                DisplayName = x.DisplayName
            })
            .ToList();
            return identityProviderNames;
        }

        public async Task<IdentityProvider> GetBySchemeAsync(string scheme)
        {
            using var unitOfWork = _unitOfWorkManager.Begin();
            var idp = (await _repository.GetQueryableAsync()).Where(x => x.Scheme == scheme)
                .SingleOrDefault(x => x.Scheme == scheme);
            if (idp == null) return null;

            var result = MapIdp(idp);
            if (result == null)
            {
                Log.Error("Identity provider record found in database, but mapping failed for scheme {scheme} and protocol type {protocol}", idp.Scheme, idp.Type);
            }
            return result;
        }
        /// <summary>
        /// Maps from the identity provider entity to identity provider model.
        /// </summary>
        /// <param name="idp"></param>
        /// <returns></returns>
        protected virtual IdentityProvider MapIdp(Entities.IdentityProvider idp)
        {
            if (idp.Type == "oidc")
            {
                return new OidcProvider(TypeAdapter.Adapt<IdentityProvider>(idp));
            }

            return null;
        }
    }
}

接口实现完成,还需要把接口实现注入到IdentityServer中去,我们创建一个IdentityServerBuilderExtensions的类

using Pterosaur.Authorization.Domain.Services.IdentityServer;

namespace Pterosaur.Authorization.Hosting
{
    public static class IdentityServerBuilderExtensions
    {
        public static IIdentityServerBuilder AddConfigurationStore(
            this IIdentityServerBuilder builder)
        {
            builder.AddClientStore<ClientStoreManager>();
            builder.AddResourceStore<ResourceStoreManager>();
            builder.AddIdentityProviderStore<IdentityProviderStoreManager>();
            return builder;
        }

    }
}

然后在Abp vnext项目启动模块中添加IdentityServer中间件

//注入
            var builder = context.Services.AddIdentityServer(options =>
            {

            })
            .AddConfigurationStore()
            .AddSigningCredential(new X509Certificate2(Path.Combine(environment.WebRootPath, configuration.GetSection("IdentityServer:SigningCredentialPath").Value), configuration.GetSection("IdentityServer:SigningCredentialPassword").Value));

在Program启动类中添加Abp vnext

using Pterosaur.Authorization.Hosting;
using Serilog;

var builder = WebApplication.CreateBuilder(args);
builder.Host
     .ConfigureLogging((context, logBuilder) =>
     {
         Log.Logger = new LoggerConfiguration()
          .Enrich.FromLogContext()
          .WriteTo.Console()// 日志输出到控制台
          .MinimumLevel.Information()
          .MinimumLevel.Override("Microsoft", Serilog.Events.LogEventLevel.Warning)
          .CreateLogger();
         logBuilder.AddSerilog(dispose: true);
     })
     .UseAutofac();
builder.Services.ReplaceConfiguration(builder.Configuration);
builder.Services.AddApplication<WebModule>();

var app = builder.Build();

app.InitializeApplication();

app.MapGet("/", () => "Hello World!");
app.Run();

 到此第一部分结束,我们使用Postman发起请求看看,效果图如下:

结尾附上Abp vnext 脚手架模板地址:

https://gitee.com/pterosaur-open/abp-template

项目还在继续完善中,第一版的重点会放在功能实现上,代码优化和细节优化得排后面咯!