具有 Windows 身份验证和自定义声明的 IdentityServer4

Question

我对Windows身份验证和自定义声明有问题。
我有一个带有窗口身份验证的身份服务器，User.Identity.Name 显示我的 AD 名称。 但是我不明白，我应该如何将存储中的一些属性添加到该用户。我现在有这样的东西：

var claims = new List<Claim> {
new Claim("devhomepage", "www.devsite.com", ClaimValueTypes.String)};
var userIdentity = new ClaimsIdentity(claims, "siteinfo");
User.AddIdentity(userIdentity);
await HttpContext.SignInAsync(User);
return RedirectToLocal(returnUrl);

而且它不起作用：-(我的客户将未获得授权。

这是服务器的配置

new Client
{
ClientId = "mvc",
ClientName = "MVC Client",
AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,
ClientSecrets =
{
new Secret("secret".Sha256())
},
RedirectUris = {"http://localhost:60640/signin-oidc"},// where to redirect to after login
PostLogoutRedirectUris = {"http://localhost:60640/signout-callback-oidc"},// where to redirect to after logout
AllowedScopes = new List<string>
{
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile,
},
AllowOfflineAccess = true,
RequireConsent = false

并且不是客户端

services.AddAuthentication(options =>
{
options.DefaultScheme = "Cookies";
options.DefaultChallengeScheme = "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect("oidc", options =>
{
options.SignInScheme = "Cookies";
options.Authority = "http://localhost:49245/";
options.RequireHttpsMetadata = false;
options.ClientId = "mvc";
options.ClientSecret = "secret";
options.ResponseType = "code id_token";
options.GetClaimsFromUserInfoEndpoint = true;
options.SaveTokens = true;
});

Answer 1

对于 SignIn，我必须使用 Microsoft.AspNetCore.Identity.SignInManager 类和方法 SignInAsync(/*我应该租用一个 TUser 对象，我存储在我的数据库中，并与我的 AD 帐户进行映射 */(

若要使用自定义声明(将用于 IS4 中具有自定义声明的所有示例(，请执行以下操作：

public class ProfileService : IProfileService
{
protected UserManager<IdentityUser> _userManager;
public ProfileService(UserManager<IdentityUser> userManager)
{
_userManager = userManager;
}
public async Task GetProfileDataAsync(ProfileDataRequestContext context)
{
//>Processing
var user = await _userManager.GetUserAsync(context.Subject);
//my custom claims
var claims = new List<Claim>
{
new Claim("devhomepage", "www"),
new Claim("reporting","reps")
};
context.IssuedClaims.AddRange(claims);
}
public async Task IsActiveAsync(IsActiveContext context)
{
//>Processing
var user = await _userManager.GetUserAsync(context.Subject);
context.IsActive = (user != null);
}
}

但是这项服务我必须在我的身份服务之后注册

services.AddIdentityServer()
...
services.AddTransient<IProfileService, ProfileService>();
}

的配置服务