微服務系列之授權認證(二) identity server 4

public async Task<Client> CreateClient(ClientEntity clientEntity)
        {
            if (_dbContext.Clients.Any(m => m.ClientName == clientEntity.ClientName))
                throw new Exception("clientName Duplicate");
            if (_dbContext.Clients.Any(m => m.ClientId == clientEntity.ClientId))
                throw new Exception("clientId Duplicate");
            IdentityServer4.EntityFramework.Entities.Client client = new IdentityServer4.EntityFramework.Entities.Client()
            {
                ClientId = clientEntity.ClientId,
                ClientSecrets = new List<IdentityServer4.EntityFramework.Entities.ClientSecret>()
                        {
                            new IdentityServer4.EntityFramework.Entities.ClientSecret(){
                                 Value=clientEntity.Sha256Secret,
                                 Description=clientEntity.Secret
                            }
                        },
                ClientName = clientEntity.ClientName,
                // ClientUri = clientEntity.ClientUri,
                Description = clientEntity.Description,
                AccessTokenType = 1,
                RequireConsent = clientEntity.RequireConsent,
                AccessTokenLifetime = clientEntity.AccessTokenLifetime,
                AllowOfflineAccess = true,
                RedirectUris = new List<IdentityServer4.EntityFramework.Entities.ClientRedirectUri>(),
                PostLogoutRedirectUris = new List<IdentityServer4.EntityFramework.Entities.ClientPostLogoutRedirectUri>(),
                AllowedGrantTypes = new List<IdentityServer4.EntityFramework.Entities.ClientGrantType>(),
                Claims = new List<IdentityServer4.EntityFramework.Entities.ClientClaim>()
            };

            if (clientEntity.RedirectUris.Count > 0)
            {
                foreach (var url in clientEntity.RedirectUris)
                {
                    client.RedirectUris.Add(new IdentityServer4.EntityFramework.Entities.ClientRedirectUri()
                    {
                        RedirectUri = url
                    });
                }

            }
            if (clientEntity.PostLogoutRedirectUris.Count > 0)
            {
                foreach (var url in clientEntity.PostLogoutRedirectUris)
                {
                    client.PostLogoutRedirectUris.Add(new IdentityServer4.EntityFramework.Entities.ClientPostLogoutRedirectUri()
                    {
                        PostLogoutRedirectUri = url
                    });
                }

            }

            //平臺預設開放這三個型別
            var typeList = new List<string>() { "hybrid", "client_credentials", "delegation" };
            typeList.ForEach(type =>
            {
                client.AllowedGrantTypes.Add(new IdentityServer4.EntityFramework.Entities.ClientGrantType()
                {
                    GrantType = type
                });
            });

            var res = await _dbContext.Clients.AddAsync(client);
            await _dbContext.SaveChangesAsync();
            return res.Entity;
        }

        public async Task<Client> UpdateClient(ClientEntity clientEntity)
        {
            if (_dbContext.Clients.Any(m => m.ClientName == clientEntity.ClientName && m.Id != clientEntity.Id))
                throw new Exception("clientName Duplicate");
            var client = await _dbContext.Clients
                                            .Include(x => x.AllowedGrantTypes)
                                            .Include(x => x.RedirectUris)
                                            .Include(x => x.PostLogoutRedirectUris)
                                            .Include(x => x.AllowedScopes)
                                            .Include(x => x.ClientSecrets)
                                            .Include(x => x.Claims)
                                            .Include(x => x.IdentityProviderRestrictions)
                                            .Include(x => x.AllowedCorsOrigins)
                                            .Include(x => x.Properties)
                                            .FirstOrDefaultAsync(x => x.Id == clientEntity.Id);
            if (client == null)
                throw new Exception("Client Not Exists!");
            client.ClientName = clientEntity.ClientName;
            client.Description = clientEntity.Description;
            client.AccessTokenLifetime = clientEntity.AccessTokenLifetime;
            client.RequireConsent = clientEntity.RequireConsent;
            client.Enabled = clientEntity.Enabled;
            client.RedirectUris = new List<IdentityServer4.EntityFramework.Entities.ClientRedirectUri>();
            client.PostLogoutRedirectUris = new List<IdentityServer4.EntityFramework.Entities.ClientPostLogoutRedirectUri>();
            client.AllowedScopes = new List<IdentityServer4.EntityFramework.Entities.ClientScope>();
            client.AllowedGrantTypes = new List<IdentityServer4.EntityFramework.Entities.ClientGrantType>();

            if (clientEntity.RedirectUris.Count > 0)
            {
                foreach (var url in clientEntity.RedirectUris)
                {
                    client.RedirectUris.Add(new IdentityServer4.EntityFramework.Entities.ClientRedirectUri { RedirectUri = url });
                }
            }

            if (clientEntity.PostLogoutRedirectUris.Count > 0)
            {
                foreach (var url in clientEntity.PostLogoutRedirectUris)
                {
                    client.PostLogoutRedirectUris.Add(new IdentityServer4.EntityFramework.Entities.ClientPostLogoutRedirectUri { PostLogoutRedirectUri = url });
                }

            }

            foreach (string scope in clientEntity.AllowedScopes)
            {
                client.AllowedScopes.Add(new IdentityServer4.EntityFramework.Entities.ClientScope { Scope = scope });
            }

            foreach (string key in clientEntity.AllowedGrantTypes)
            {
                client.AllowedGrantTypes.Add(new IdentityServer4.EntityFramework.Entities.ClientGrantType { GrantType = key });
            }

            var res = _dbContext.Clients.Update(client);
            await _dbContext.SaveChangesAsync();
            return res.Entity;
        }

 public async Task<string> GenerateToken(int id, string nickName, string projectGroup, string contact, string useReason)
        {
            var client = await _dbContext.Clients
                                            .Include(x => x.AllowedGrantTypes)
                                            .Include(x => x.RedirectUris)
                                            .Include(x => x.PostLogoutRedirectUris)
                                            .Include(x => x.AllowedScopes)
                                            .Include(x => x.ClientSecrets)
                                            .Include(x => x.Claims)
                                            .Include(x => x.IdentityProviderRestrictions)
                                            .Include(x => x.AllowedCorsOrigins)
                                            .Include(x => x.Properties)
                                            .FirstOrDefaultAsync(x => x.Id == id);
            if (client == null)
                throw new Exception("Client Not Exists!");
            //初始化連線IdentityServer使用者端，這也是人家封裝好的http請求
            var discoveryClient = new DiscoveryClient(_identityOption.Value.Host)
            {
                Policy = new DiscoveryPolicy { RequireHttps = _identityOption.Value.Https, ValidateIssuerName = false }
            };
            //獲取endpint
            var discoveryResponse = await discoveryClient.GetAsync();
            //連線獲取token那個endpoint
            var tokenClient = new TokenClient(discoveryResponse.TokenEndpoint,
                                                  client.ClientId,
                                                  client.ClientSecrets.FirstOrDefault().Description);
            #region 計算當前client的擁有的API資源SCOPE
            var allScopes = client.AllowedScopes.Select(p => p.Scope).ToList();
            var apiResourceScopes = new List<string>();
            _dbContext.ApiResources.Include("Scopes").ToList().ForEach(api =>
            {
                if (api.Scopes.Count > 0)
                    apiResourceScopes.AddRange(api.Scopes.Select(p => p.Name).ToList());
            });
            var inScopes = apiResourceScopes.Intersect(allScopes);
            #endregion
            var scope = string.Join(" ", inScopes);
            //請求生成使用者端模式的token
            var tokenResponse = await tokenClient.RequestCustomGrantAsync("client_credentials", scope);

            if (tokenResponse.IsError)
            {
                throw new Exception(tokenResponse.Error);
            }
            else
            {
                //傳送事件
                var _key = string.Format("{0}:reference_token", tokenResponse.AccessToken).ToSha256();
                var tokenEntity = new TokenEntity(_key, nickName, projectGroup, contact, useReason, client.ClientId, tokenResponse.AccessToken);
                await _mediator.Publish<GenerateTokenEvent>(new GenerateTokenEvent(tokenEntity));
                return tokenResponse.AccessToken;
            }
        }

 public async Task<bool> AddExpiration(string token, DateTime date)
        {
            if (!_dbContext.TokenEntities.Any(p => p.Token == token))
                throw new Exception("manage token not exsits");
            //這個key是經過一定格式後進行sha256加密後，作為資料庫表PersistedGrants一個唯一標識
            var _key = string.Format("{0}:reference_token", token).ToSha256();
            var persistedGrant = _grantdbContext.PersistedGrants.FirstOrDefault(p => p.Key == _key);
            if (persistedGrant == null)
                throw new Exception("token不存在或者TOKEN已過期");
            var data = JObject.Parse(persistedGrant.Data);
            var creation = data.Value<DateTime>("CreationTime");
            var lifetime = data.Value<int>("Lifetime");

            data["Lifetime"] = (int)((date - creation).TotalSeconds);

            persistedGrant.Expiration = date;
            persistedGrant.Data = data.ToString(Newtonsoft.Json.Formatting.None);

            _grantdbContext.PersistedGrants.Update(persistedGrant);
            await _grantdbContext.SaveChangesAsync();
            return true;
        }

public class DelegationGrantValidator : IExtensionGrantValidator//需要繼承一下型別驗證擴充套件介面
    {
        private readonly ITokenValidator _validator;//identity框架已實現的token驗證服務，直接注入使用

        public DelegationGrantValidator(ITokenValidator validator)
        {
            _validator = validator;
        }

        public string GrantType => "delegation";//自定義的授權型別，我這實現的是一個token交換token的型別

        public async Task ValidateAsync(ExtensionGrantValidationContext context)
        {
            var userToken = context.Request.Raw.Get("token");//獲取被交換token

            if (string.IsNullOrEmpty(userToken))
            {
                context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant);
                return;
            }

            var result = await _validator.ValidateAccessTokenAsync(userToken);//直接使用人家實現好的token驗證服務驗證傳來的token
            if (result.IsError)
            {
                context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant);
                return;
            }

            //宣告獲取使用者，如果有使用者，說明要換取使用者token
            var sub = result.Claims.FirstOrDefault(c => c.Type == "sub")?.Value;
            if (sub != null)
            {
                context.Result = new GrantValidationResult(sub, GrantType);//換取使用者token,
                return;
            }

            // 宣告中獲取使用者端ID，如果有clientId,說明換取使用者端token
            var client_id = result.Claims.FirstOrDefault(c => c.Type == "client_id")?.Value;
            if (client_id != null)
            {
                //context.Result = new GrantValidationResult(client_id, GrantType);
                context.Result = new GrantValidationResult();//換取使用者端token
                return;
            }

            context.Result = new GrantValidationResult(TokenRequestErrors.InvalidRequest);
        }
    }

builder.AddExtensionGrantValidator<DelegationGrantValidator>();注入DI。