Web API 2 OWIN Bearer 令牌身份验证 - AccessTokenFormat null

Question

我有一个现有的 ASP.NET MVC 5 项目，我正在向其添加一个 Web API 2 项目。我想使用持有者令牌身份验证，并遵循了孙宏业的教程"使用 Web API 示例进行 OWIN 持有者令牌身份验证"和这个问题。

在我的Login方法中，对于行Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket);，访问令牌格式为空。知道为什么吗？

我的账户控制者：

[RoutePrefix("api")]
public class AccountController : ApiController
{        
    public AccountController() {}
    // POST api/login
    [HttpPost]
    [Route("login")]
    public HttpResponseMessage Login(int id, string pwd)
    {
        if (id > 0) // testing - not authenticating right now
        {
            var identity = new ClaimsIdentity(Startup.OAuthBearerOptions.AuthenticationType);
            identity.AddClaim(new Claim(ClaimTypes.Name, id.ToString()));
            AuthenticationTicket ticket = new AuthenticationTicket(identity, new AuthenticationProperties());
            var currentUtc = new SystemClock().UtcNow;
            ticket.Properties.IssuedUtc = currentUtc;
            ticket.Properties.ExpiresUtc = currentUtc.Add(TimeSpan.FromMinutes(30));
            var token = Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket);
            return new HttpResponseMessage(HttpStatusCode.OK)
            {
                Content = new ObjectContent<object>(new
                {
                    UserName = id.ToString(),
                    AccessToken = token
                }, Configuration.Formatters.JsonFormatter)
            };
        }
        return new HttpResponseMessage(HttpStatusCode.BadRequest);
    }
    // POST api/token
    [Route("token")]
    [HttpPost]
    public HttpResponseMessage Token(int id, string pwd)
    {
        // Never reaches here. Do I need this method?
        return new HttpResponseMessage(HttpStatusCode.OK);
    }
}

启动类：

public class Startup
{
    private static readonly ILog _log = log4net.LogManager.GetLogger(System.Reflection.MethodBase.GetCurrentMethod().DeclaringType);
    public static OAuthBearerAuthenticationOptions OAuthBearerOptions { get; private set; }
    public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }
    public static Func<MyUserManager> UserManagerFactory { get; set; }
    public static string PublicClientId { get; private set; }
    static Startup()
    {
        PublicClientId = "MyWeb";
        UserManagerFactory = () => new MyUserManager(new UserStore<MyIdentityUser>());
        OAuthBearerOptions = new OAuthBearerAuthenticationOptions();
        OAuthOptions = new OAuthAuthorizationServerOptions
        {
            TokenEndpointPath = new PathString("/api/token"),
            Provider = new MyWebOAuthProvider(PublicClientId, UserManagerFactory),
            AuthorizeEndpointPath = new PathString("/api/login"),
            AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
            AllowInsecureHttp = true
        };
    }
    public void Configuration(IAppBuilder app)
    {         
        // Enable the application to use bearer tokens to authenticate users
        app.UseOAuthBearerTokens(OAuthOptions);
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/api/login")
        });
        // Configure Web API to use only bearer token authentication.
        var config = GlobalConfiguration.Configuration;            
        config.SuppressDefaultHostAuthentication();
        config.Filters.Add(new HostAuthenticationFilter(OAuthBearerOptions.AuthenticationType));
        app.UseWebApi(config);                          
    }
}

MyIdentityUser 只是添加一个额外的属性：

public class MyIdentityUser : IdentityUser
{
    public int SecurityLevel { get; set; }
}

MyUserManager 将我的自定义用户身份验证方法调用到内部服务器：

public class MyUserManager : UserManager<MyIdentityUser>
{
    public MyUserManager(IUserStore<MyIdentityUser> store) : base(store) { }
    public MyIdentityUser ValidateUser(int id, string pwd)
    {
        LoginIdentityUser user = null;
        if (MyApplication.ValidateUser(id, pwd))
        {
            // user = ??? - not yet implemented
        }
        return user;
    }
}   

MyWebOAuthProvider（我从SPA模板中获取了这个。仅更改了GrantResourceOwnerCredentials）：

public class MyWebOAuthProvider : OAuthAuthorizationServerProvider
{
    private readonly string _publicClientId;
    private readonly Func<MyUserManager> _userManagerFactory;
    public MyWebOAuthProvider(string publicClientId, Func<MyUserManager> userManagerFactory)
    {
        if (publicClientId == null)
        {
            throw new ArgumentNullException("publicClientId");
        }
        if (userManagerFactory == null)
        {
            throw new ArgumentNullException("userManagerFactory");
        }
        _publicClientId = publicClientId;
        _userManagerFactory = userManagerFactory;
    }
    public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
    {
        using (MyUserManager userManager = _userManagerFactory())
        {
            MyIdentityUser user = null;
            var ctx = context as MyWebOAuthGrantResourceOwnerCredentialsContext;
            if (ctx != null)
            {
                user = userManager.ValidateUser(ctx.Id, ctx.Pwd);
            }                
            if (user == null)
            {
                context.SetError("invalid_grant", "The user name or password is incorrect.");
                return;
            }
            ClaimsIdentity oAuthIdentity = await userManager.CreateIdentityAsync(user,
                context.Options.AuthenticationType);
            ClaimsIdentity cookiesIdentity = await userManager.CreateIdentityAsync(user,
                CookieAuthenticationDefaults.AuthenticationType);
            AuthenticationProperties properties = CreateProperties(user.UserName);
            AuthenticationTicket ticket = new AuthenticationTicket(oAuthIdentity, properties);
            context.Validated(ticket);
            context.Request.Context.Authentication.SignIn(cookiesIdentity);
        }
    }
    public override Task TokenEndpoint(OAuthTokenEndpointContext context)
    {
        ...  // unchanged from SPA template
    }
    public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
    {
        ...  // unchanged from SPA template
    }
    public override Task ValidateClientRedirectUri(OAuthValidateClientRedirectUriContext context)
    {
        ...  // unchanged from SPA template
    }
    public static AuthenticationProperties CreateProperties(string userName)
    {
        ...  // unchanged from SPA template
    }
}

MyWebOAuthGrantResourceOwnerCredientialsContext：

public class MyWebOAuthGrantResourceOwnerCredentialsContext : OAuthGrantResourceOwnerCredentialsContext
{
    public MyWebOAuthGrantResourceOwnerCredentialsContext (IOwinContext context, OAuthAuthorizationServerOptions options, string clientId, string userName, string password, IList<string> scope)
        : base(context, options, clientId, userName, password, scope)
    { }
    public int Id { get; set; }        
    public string Pwd { get; set; }
}

如何设置访问令牌格式？我设置的是否正确？我没有针对任何外部服务进行身份验证，只是针对旧版内部服务器进行身份验证。谢谢。

Answer 1

我遇到了同样的问题 - 这与我在 Startup（） 中的初始化有关。

像你一样，我将OAuthBearerOptions存储在静态字段中：

OAuthBearerOptions = new OAuthBearerAuthenticationOptions();

但后来我错误地使用了同一类的新实例：

app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());  // wrong!

显然，解决方法是改用静态字段：

app.UseOAuthBearerAuthentication(OAuthBearerOptions);

事实上，看起来你根本不调用UseOAuthBearerAuthentication（）。 我关注了Taiseer Joudeh的这一系列优秀的帖子。

完全启动.cs：

public class Startup
{
    public static OAuthBearerAuthenticationOptions OAuthBearerOptions { get; private set; }
    public void Configuration(IAppBuilder app)
    {
        HttpConfiguration config = new HttpConfiguration();
        ConfigureOAuth(app);
        WebApiConfig.Register(config);
        app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
        app.UseWebApi(config);
    }
    public void ConfigureOAuth(IAppBuilder app)
    {
        //use a cookie to temporarily store information about a user logging in with a third party login provider
        app.UseExternalSignInCookie(Microsoft.AspNet.Identity.DefaultAuthenticationTypes.ExternalCookie);
        OAuthBearerOptions = new OAuthBearerAuthenticationOptions();
        OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions() {
            AllowInsecureHttp = true,
            TokenEndpointPath = new PathString("/token"),
            AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
            Provider = new SimpleAuthorizationServerProvider()  // see post
        };
        // Token Generation
        app.UseOAuthAuthorizationServer(OAuthServerOptions);
        app.UseOAuthBearerAuthentication(OAuthBearerOptions);
        //[Configure External Logins...]
    }
}

Answer 2

我不确定您是否仍在寻找答案 - 但这是我在 AngularJS 应用程序中使用的一些代码，用于从我的 WebAPI2 端点获取安全令牌。

    $http({
        method: 'POST', url: '/token', data: { username: uName, password: uPassword, grant_type: 'password' },
        transformRequest: function (obj) {
            var str = [];
            for (var p in obj)
                str.push(encodeURIComponent(p) + "=" + encodeURIComponent(obj[p]));
            return str.join("&");
        }
    }).success(function (data, status, headers, config) {
        console.log("http success", data);
        accessToken.value = data.access_token;
        console.log("access token = ", accessToken.value);
    }).error(function (data, status, headers, config) {
        console.log("http error", data);
    });

然后，我可以在任何其他请求的标头中传递访问令牌，以便获得身份验证验证。

Answer 3

我已经删除了示例代码，因为它在与 Web API 和 SPA 模板一起使用时可能会导致混淆。最好使用模板代码以使用 OAuth 授权服务器生成令牌。在你的方案中，应使用资源所有者密码授予对用户进行身份验证。请查看我在SPA模板上的博客，其中包含有关 http://blogs.msdn.com/b/webdev/archive/2013/09/20/understanding-security-features-in-spa-template.aspx 密码流的详细信息

无需编写自己的 Web API 来处理登录，而是需要使用 OWIN OAuth 服务器的/token 终结点来处理密码登录。