来自 IProfileService 的其他声明集在 MVC 客户端的 OpenIdConnect 处理程序中不可用

Question

我使用。net Core上运行的身份服务器4与。net Framework v4.6.2 MVC应用程序。我使用配置文件服务来设置来自身份服务器的额外声明:

public async Task GetProfileDataAsync(ProfileDataRequestContext context)
        {
            if (context.Caller.Equals("ClaimsProviderAccessToken") || context.Caller.Equals("ClaimsProviderIdentityToken"))
            {
                foreach (var group in groups)
                {
                    // Custom logic to add additional claims.
                    context.IssuedClaims.Add(new Claim(ClaimTypes.Role, groupName));
                }
            }
        }
        public Task IsActiveAsync(IsActiveContext context)
        {
            return Task.CompletedTask;
        }

当我尝试使用。net Core MVC客户端时，从这里设置的附加声明可用于客户端。但是，对于在ASP中运行的MVC客户端来说。. NET框架中，这些声明在context.AuthenticationTicket.Identity.Claims中不可用。但是当我检查context.ProtocolMessage.AccessToken的访问令牌时，声明就在那里。

 app.UseCookieAuthentication(new CookieAuthenticationOptions
                                            {
                                                ExpireTimeSpan = new TimeSpan(0, Configuration.SessionTimeoutInMinutes, 0),
                                                SlidingExpiration = true,
                                                CookieSameSite = Microsoft.Owin.SameSiteMode.None,
                                                CookieSecure = CookieSecureOption.Always
                                            });
                app.UseOpenIdConnectAuthentication(
                    new OpenIdConnectAuthenticationOptions
                    {
                        
                        ClientId = clientId,
                        Authority = authority,
                        RedirectUri = redirectUri,
                        PostLogoutRedirectUri = redirectUri,
                        ResponseType = "id_token token",
                        Scope = "openid profile roles api",
                        TokenValidationParameters = new TokenValidationParameters
                        {
                            ValidateIssuer = false,
                        },
                        Notifications = new OpenIdConnectAuthenticationNotifications()
                        {
                            SecurityTokenValidated = (context) =>
                            {
                                // The claims are not available here.
                                foreach (var claim in context.AuthenticationTicket.Identity.Claims.Where(x => x.Type == JwtClaimTypes.Role).ToList())
                                {
                                    context.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Role, claim.Value));
                                }
                                // But, the claims are available in the access token.
                                context.Response.Cookies.Append("access-token", context.ProtocolMessage.AccessToken, new Microsoft.Owin.CookieOptions() { SameSite = Microsoft.Owin.SameSiteMode.None, Secure = true });
                                return Task.FromResult(0);
                            },
                        }
                    });

这里出了什么问题?请让我知道如果我需要张贴更多的代码。

Answer 1

在身份服务器中注册MVC客户端时使用AlwaysIncludeUserClaimsInIdToken = true