手动生成 IdentityServer4 引用令牌并保存到 PersistedGrants 表中

Question

我已经学习了一周IdentityServer4，并成功地实现了一个简单的身份验证流程ResourceOwnedPassword流程。

现在，我正在按照本教程使用 IdentityServer4 实现 Google 身份验证。

这就是我正在做的：

启动.cs

public void ConfigureServices(IServiceCollection services)
{
    //...
    const string connectionString = @"Data Source=.SQLEXPRESS;database=IdentityServer4.Quickstart.EntityFramework-2.0.0;trusted_connection=yes;";
    var migrationsAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name;
    services.AddIdentityServer()
        .AddDeveloperSigningCredential()
        .AddProfileService<IdentityServerProfileService>()
        .AddResourceOwnerValidator<IdentityResourceOwnerPasswordValidator>()
        // this adds the config data from DB (clients, resources)
        .AddConfigurationStore(options =>
        {
            options.ConfigureDbContext = builder =>
            {
                builder.UseSqlServer(connectionString,
                    sql => sql.MigrationsAssembly(migrationsAssembly));
            };
        })
        // this adds the operational data from DB (codes, tokens, consents)
        .AddOperationalStore(options =>
        {
            options.ConfigureDbContext = builder =>
                builder.UseSqlServer(connectionString,
                    sql => sql.MigrationsAssembly(migrationsAssembly));
            // this enables automatic token cleanup. this is optional.
            options.EnableTokenCleanup = true;
            options.TokenCleanupInterval = 30;
        });
    // Add jwt validation.
    services.AddAuthentication(options =>
        {
            options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
            options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddIdentityServerAuthentication(options =>
        {
            // base-address of your identityserver
            options.Authority = "https://localhost:44386";
            options.ClaimsIssuer = "https://localhost:44386";
            // name of the API resource
            options.ApiName = "api1";
            options.ApiSecret = "secret";
            options.RequireHttpsMetadata = false;
            options.SupportedTokens = SupportedTokens.Reference;
        });
    //...
}

** 谷歌

控制器(用于处理从谷歌返回的令牌**

public class GLoginController : Controller
    {
        #region Properties
        private readonly IPersistedGrantStore _persistedGrantStore;
        private readonly IUserFactory _userFactory;
        private readonly IBaseTimeService _baseTimeService;
        private readonly ITokenCreationService _tokenCreationService;
        private readonly IReferenceTokenStore _referenceTokenStore;
        private readonly IBaseEncryptionService _baseEncryptionService;
        #endregion
        #region Constructor
        public GLoginController(IPersistedGrantStore persistedGrantStore,
            IBaseTimeService basetimeService,
            ITokenCreationService tokenCreationService,
            IReferenceTokenStore referenceTokenStore,
            IBaseEncryptionService baseEncryptionService,
            IUserFactory userFactory)
        {
            _persistedGrantStore = persistedGrantStore;
            _baseTimeService = basetimeService;
            _userFactory = userFactory;
            _tokenCreationService = tokenCreationService;
            _referenceTokenStore = referenceTokenStore;
            _baseEncryptionService = baseEncryptionService;
        }
        #endregion
        #region Methods
        [HttpGet("login")]
        [AllowAnonymous]
        public IActionResult Login()
        {
            var authenticationProperties = new AuthenticationProperties
            {
                RedirectUri = "/api/google/handle-external-login"
            };
            return Challenge(authenticationProperties, "Google");
        }
        [HttpGet("handle-external-login")]
        //[Authorize("ExternalCookie")]
        [AllowAnonymous]
        public async Task<IActionResult> HandleExternalLogin()
        {
            //Here we can retrieve the claims
            var authenticationResult = await HttpContext.AuthenticateAsync(IdentityServerConstants.ExternalCookieAuthenticationScheme);
            var principal = authenticationResult.Principal;
            var emailAddress = principal.FindFirst(ClaimTypes.Email)?.Value;
            if (string.IsNullOrEmpty(emailAddress))
                return NotFound(new ApiMessageViewModel("Email is not found"));
            // Find user by using username.
            var loadUserConditions = new LoadUserModel();
            loadUserConditions.Usernames = new HashSet<string> { emailAddress };
            loadUserConditions.Pagination = new PaginationValueObject(1, 1);
            // Find users asynchronously.
            var loadUsersResult = await _userFactory.FindUsersAsync(loadUserConditions);
            var user = loadUsersResult.FirstOrDefault();
            // User is not defined.
            if (user == null)
            {
                user = new User(Guid.NewGuid(), emailAddress);
                user.Email = emailAddress;
                user.HashedPassword = _baseEncryptionService.Md5Hash("abcde12345-");
                user.JoinedTime = _baseTimeService.DateTimeUtcToUnix(DateTime.UtcNow);
                user.Kind = UserKinds.Google;
                user.Status = UserStatuses.Active;
                //await _userFactory.AddUserAsync(user);
            }
            else
            {
                // User is not google account.
                if (user.Kind != UserKinds.Google)
                    return Forbid("User is not allowed to access system.");
            }
            var token = new Token(IdentityServerConstants.TokenTypes.IdentityToken);
            var userCredential = new UserCredential(user);
            token.Claims = userCredential.GetClaims();
            token.AccessTokenType = AccessTokenType.Reference;
            token.ClientId = "ro.client";
            token.CreationTime = DateTime.UtcNow;
            token.Audiences = new[] {"api1"};
            token.Lifetime = 3600;

            return Ok();
        }
        #endregion
    }

一切都很好，我可以从Google OAuth2返回索赔，使用Google电子邮件地址在数据库中查找用户，如果他们没有任何计数，请注册他们。

我的问题是：如何使用我在HandleExternalLogin方法中收到的 Google OAuth2 声明来生成引用令牌，将其保存到 PersistedGrants 表并返回到客户端。

这意味着当用户访问https://localhost:44386/api/google/login时，在被重定向到Google同意屏幕后，他们可以接收access_token，refresh_token由IdentityServer4生成。

谢谢

Answer 1

• 在 IdentityServer 中，令牌的种类(引用的 jwt(是可为每个客户端(应用程序(配置，请求令牌。
• AccessTokenType.Reference对TokenTypes.AccessToken无效 TokenTypes.IdentityToken就像您的代码段一样。

通常，遵循原始快速入门，然后根据需要扩展通用代码会更简单。我现在在上面的代码片段中看到的只是您的特定内容，而不是默认部分，负责创建 IdSrv 会话并重定向回客户端。

如果您仍希望手动创建令牌：

将
• ITokenService注入控制器。
• 修复我上面提到的错误：TokenTypes.AccessToken而不是TokenTypes.IdentityToken
• 呼叫var tokenHandle = await TokenService.CreateAccessTokenAsync(token);

tokenHandle是PersistedGrantStore的关键