asp.net-core – 配置ASP.Net Core以使用OIDC对Thinktecture V2进行身份验证

我正在尝试使用ASP.Net Core对Thinktecture V2进行身份验证,使用OpenID Connect(我们目前需要WS-Trust,因此无法升级).

我的配置如下

app.UseCookieAuthentication(new CookieAuthenticationoptions());

        X509Store certStore = new X509Store(StoreName.My,StoreLocation.LocalMachine);
        certStore.Open(OpenFlags.ReadOnly);

        var cert = certStore.Certificates.Find(X509FindType.FindByThumbprint,"CertThumbprint",false);

        app.USEOpenIdConnectAuthentication(new OpenIdConnectOptions
        {
            RequireHttpsMetadata = false,ClientId = _config["OpenID:ClientId"],ClientSecret = _config["OpenID:ClientSecret"],Authority = _config["OpenID:Authority"],ResponseType = OpenIdConnectResponseType.Code,PostlogoutRedirectUri = _config["OpenID:PostlogoutRedirectUri"],SignInScheme = "Cookies",CallbackPath = "/signin-oidc",TokenValidationParameters = new TokenValidationParameters()
            {
                IssuerSigningKey = new X509SecurityKey(cert[0]),},Configuration = new OpenIdConnectConfiguration
            {

                Issuer = "https://identityserver/IdentityServer/issue",AuthorizationEndpoint = "https://identityserver/IdentityServer/issue/oidc/authorize",TokenEndpoint = "https://identityserver/IdentityServer/issue/oidc/token",UserInfoEndpoint = "https://identityserver/IdentityServer/issue/oidc/userinfo",}
        });

config.json

"OpenID": {
"ClientId": "Test","ClientSecret": "{6DD502AB-2AB1-4028-BD4A-85C91790EC7B}","Authority": "https://identityserver/IdentityServer/issue/oidc","PostlogoutRedirectUri": "https://localhost:44353/" }

当我尝试验证时,我得到以下异常：

HttpRequestException：响应状态代码不表示成功：400(错误请求).

来自thinktectureIdentityServer.svclog的跟踪是

如果有人能提供任何帮助,将不胜感激.

解决方法

我通过处理OnAuthorizationCodeReceivedEvent并手动处理代码兑换来解决上述错误,我在其中添加了一个基本授权标头来授权客户端.

new OpenIdConnectOptions
{
    ...

    Events = new OpenIdConnectEvents
    {
       OnAuthorizationCodeReceived = async context =>
       {
           context.HandleCodeRedemption();

           var requestMessage = new HttpRequestMessage(HttpMethod.Post,context.Options.Configuration.TokenEndpoint);

           requestMessage.Content = new FormUrlEncodedContent(context.TokenEndpointRequest.Parameters);

           var authString = string.Format("{0}",Convert.ToBase64String(Encoding.ASCII.GetBytes(_config["OpenID:ClientId"] + ":" + _config["OpenID:ClientSecret"])));

           requestMessage.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Basic",authString);

           var responseMessage = await context.Backchannel.SendAsync(requestMessage);

           responseMessage.EnsureSuccessstatusCode();
           var tokenResonse = await responseMessage.Content.ReadAsstringAsync();
           var jsonTokenResponse = JObject.Parse(tokenResonse);
           context.TokenEndpointResponse = new OpenIdConnectMessage(jsonTokenResponse);
       }
    }

    ...

});

要进行最终调用以检索UserInfo,我必须对Identity Server进行更改,以在响应中包含与Id令牌中的主题匹配的主题.这涉及更新UserInfoController以在Get方法中添加声明.