即使添加到客户端时，Identity Server 4中缺少电子邮件范围

Question

我正在使用Angular客户端使用Identity Server 4。

在双方我都添加了相同的范围：

'openid profile offline_access email api'

但是我有一个错误：

Sorry, there was an error : invalid_scope
Invalid scope

我检查了著名的OpenID配置，我看到了：

"scopes_supported": [
  "openid",
  "profile",
  "api",
  "offline_access"

]

所以电子邮件范围不显示？

这可能是问题吗？为什么会发生？

我的身份服务器4客户端定义是：

new Client {
  ClientId = "spa",
  ClientSecrets = { new Secret("secret".Sha256()) },
  AllowedGrantTypes = GrantTypes.Code,
  RequirePkce = true,
  RequireClientSecret = false,
  AllowAccessTokensViaBrowser = true,
  AllowOfflineAccess = true,
  AllowedScopes = { 
    IdentityServerConstants.StandardScopes.OpenId,
    IdentityServerConstants.StandardScopes.Profile, 
    IdentityServerConstants.StandardScopes.Email, 
    IdentityServerConstants.StandardScopes.OfflineAccess,
    "api" 
  },  
  RedirectUris = new List<String> { 
    "https://localhost:5001",
    "https://localhost:5001/index.html",
    "https://localhost:5001/silent-refresh.html" 
  },
  PostLogoutRedirectUris = new List<String> { 
    "https://localhost:5001/" 
  },
  AllowedCorsOrigins = new List<String> { 
    "https://localhost:5001" 
  }
}

Answer 1

您需要添加一个IdentityResource：

    public static IEnumerable<IdentityResource> GetIdentityResources()
    {
        return new List<IdentityResource>
        {
            new IdentityResources.OpenId(),
            new IdentityResources.Profile(),
            new IdentityResources.Email()
        };
    }

然后在startup.cs中添加以下内容：

var identityServerBuilder = services.AddIdentityServer(...)
.AddInMemoryIdentityResources(GetIdentityResources())