IdentityServer AspNetIdentity AspNetUserClaims未在客户端上填充

Question

我正在将IdentityServer3与IdentityServer 3一起使用。AspNetIdentity使用OpenId客户端，我可以成功进行身份验证，但AspNetUserClaims表中的声明不会发送到客户端。IdentityServer配置为：

1. 混合流
2. 始终发送客户声明是真实的
3. 作用域：openid配置文件电子邮件

我添加了一个基于AspNetIdentityUserService的自定义类，并覆盖了GetClaimsFromAccount方法。我提供了与原来相同的实现(https://github.com/IdentityServer/IdentityServer3.AspNetIdentity/blob/master/source/IdentityServer3.AspNetIdentity/IdentityServer3.AspNetIdentity.cs)并设置一个断点-我可以看到AspNetUserClaims中保存的所有声明，但它们不包括在客户端的claims集合中。

我的客户代码是：

OpenIdConnectAuthenticationOptions openIdConnectAuthenticationOptions = new OpenIdConnectAuthenticationOptions
{
//BackchannelTimeout = TimeSpan.FromMinutes(sessionTimeoutInMinutes),
ClientId = "xxx",
Authority = "https://xxx/core",
PostLogoutRedirectUri = "https://localhost:44304",
ResponseType = "code id_token token",
Scope = "openid profile email",
Notifications = new OpenIdConnectAuthenticationNotifications()
{
SecurityTokenValidated =  async (context) =>
{
//string userId = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.Name).Value;
var id_token = context.ProtocolMessage.IdToken;
var abc = new JwtSecurityToken(id_token);
var def = abc.Claims;
List<Claim> claims = new List<Claim>();
UserInfoClient userInfoClient = new UserInfoClient(new Uri("https://shaves2u.azurewebsites.net/core/connect/userinfo"), context.ProtocolMessage.AccessToken);
var userInfo = await userInfoClient.GetAsync();
userInfo.Claims.ToList().ForEach(ui => claims.Add(new Claim(ui.Item1, ui.Item2)));
return;
//return Task.FromResult(0);
},
RedirectToIdentityProvider = (context) =>
{
string appBaseUrl = context.Request.Scheme + "://" + context.Request.Host + context.Request.PathBase;
context.ProtocolMessage.RedirectUri = appBaseUrl + "/";
context.ProtocolMessage.PostLogoutRedirectUri = appBaseUrl + "/";
if (context.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
{
Claim idTokenHint = context.OwinContext.Authentication.User.FindFirst("id_token");
if (idTokenHint != null)
{
context.ProtocolMessage.IdTokenHint = idTokenHint.Value;
}
}
return Task.FromResult(0);
},
AuthorizationCodeReceived = (context) =>
{
ClaimsIdentity identity = context.AuthenticationTicket.Identity;
identity.AddClaim(new Claim("id_token", context.ProtocolMessage.IdToken));
context.AuthenticationTicket = new Microsoft.Owin.Security.AuthenticationTicket(identity, context.AuthenticationTicket.Properties);
return Task.FromResult(0);
},
AuthenticationFailed = (context) =>
{
if (context.Exception.Message.StartsWith("OICE_20004") || context.Exception.Message.Contains("IDX10311"))
{
context.SkipToNextMiddleware();
return Task.FromResult(0);
}
return Task.FromResult(0);
}
}
};

来自代码abc。声明不包含来自AspNetUserClaims的任何声明，userInfo.Claims.也不包含

有人能帮忙吗？

Answer 1

对于其他遇到相同问题的人，我想分享我的解决方案。最后，这变成了一个配置设置。将作用域的IncludeAllClaimsForUser设置为true。我为我的应用程序创建了一个新的作用域，但是在配置文件作用域上设置此属性也应该有效。