标签：
三个网站：
1. www.cnblogs.com 用户直接面对和使用的web应用 以后简称w
2.passport.cnblogs.com 认证服务器，可以访问用户表的用户名和密码 以后简称p
3.users.cnblogs.com 给其它应用程序提供服务,本例当中只是提供授权用户的个人信息，例如手机 邮箱等信息 以后简称u
利用 Microsoft.Owin.Security 来实现oauth2 的授权码模式
主要流程：
1. w判断自己网站的cookie有没有，如果没有，跳转到自己的登录页
2.w登录页 action 记录下需要跳转的url地址，切换到 第三方登录 模式，返回401
3. w的第三方登录发现自己是当前的登录模式，而且状态码还是401，接管response,不再返回401,而是重定向至p站的Authorize
4.p站的Authorize查看当前用户是否已经登录，如果登录，返回授权页（大致内容是：你是否同意 第三方网站w使用你的个人信息） 注：这个地方也可以直接返回授权码，即不再需要用户确认一次，参见下方代码
5.用户同意后，p站生成授权码，并将请求过来的state参数附加在返回的url后，跳转回w网站
6.w网站拿到code和state后，首先检查state是否和当初请求时一样，然后在服务器构造一个新的请求，到p站拿回真实的access_token和refresh_token等信息
7.w网站用access_token到u站获取到用户的信息，然后构造ClaimsIdentity,在w网站登录,登录成功以后取出第2步存入的访问url，跳转
一些关键代码
w网站启动
//
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType=DefaultAuthenticationTypes.ApplicationCookie,
LoginPath=new PathString("/Account/Login")
});
//这段代码的作用是，如果第三方登录中没有配置SignInAsAuthenticationType
//则需要开启以后，在/Account/OAuthLoginCallBack 中获取到ExternalCookie 然后再实现当前网站的登录
//在OAuthLoginCallBack中再提及这部分代码
//app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
//使用第三方登录的配置
//此处的oauth是参照修改Microsoft.Owin.Security.Google 而来
//不复杂，但有几处暗坑
//关于callbackpath ,由于oauth2.0 的规范要求 请求code和请求access_token的url中的redirect_uri 必须一致，所以增加了一个第三方登录完毕以后跳回来的地址
app.UseAxOAuth2Authentication(new AxOAuth2AuthenticationOptions()
{
TokenEndpoint="http://localhost:8099/token",
AuthorizeEndpoint="http://localhost:8099/oauth/authorize",
UserInfoEndpoint="http://localhost:8053/User/UserIdInfo",
ClientId="clientId",
ClientSecret="ClientSecret",
CallbackPath=new PathString("/Account/OAuthLoginCallBack"),
SignInAsAuthenticationType=DefaultAuthenticationTypes.ApplicationCookie
});
w网站 /Account/Login 完成 流程中第一步 第二步的功能
[AllowAnonymous] public ActionResult Login(string returnUrl) { var properties = new AuthenticationProperties { RedirectUri=returnUrl };
//AxOauth是我的第三方登录模块的名称
//
HttpContext.GetOwinContext().Authentication.Challenge(properties, "AxOauth");
return new HttpUnauthorizedResult();
}
实现流程第三步 AxOAuth2AuthenticationHandler中的第一个主要函数 ，参考 Microsoft.Owin.Security.Google修改
protected override Task ApplyResponseChallengeAsync() {
//401判断 if (Response.StatusCode != 401) { return Task.FromResult<object>(null); }
//如果在login中不 Challenge 此处就会为null var challenge = Helper.LookupChallenge(Options.AuthenticationType, Options.AuthenticationMode); if (challenge != null) { var baseUri = Request.Scheme + Uri.SchemeDelimiter + Request.Host + Request.PathBase; var currentUri = baseUri + Request.Path + Request.QueryString; var redirectUri = baseUri + Options.CallbackPath; var properties = challenge.Properties; if (string.IsNullOrEmpty(properties.RedirectUri)) { properties.RedirectUri = currentUri; } // OAuth2 10.12 CSRF GenerateCorrelationId(properties); var queryStrings = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase) { {"response_type", "code"}, {"client_id", Options.ClientId}, {"redirect_uri", redirectUri} }; // space separated var scope = string.Join(" ", Options.Scope); if (string.IsNullOrEmpty(scope)) { // Google OAuth 2.0 asks for non-empty scope. If user didn‘t set it, set default scope to // "openid profile email" to get basic user information. scope = "openid profile email"; } AddQueryString(queryStrings, properties, "scope", scope); AddQueryString(queryStrings, properties, "access_type", Options.AccessType); AddQueryString(queryStrings, properties, "approval_prompt"); AddQueryString(queryStrings, properties, "login_hint"); var state = Options.StateDataFormat.Protect(properties); queryStrings.Add("state", state); var authorizationEndpoint = WebUtilities.AddQueryString(Options.AuthorizeEndpoint, queryStrings); var redirectContext = new AxOAuth2ApplyRedirectContext( Context, Options, properties, authorizationEndpoint); Options.Provider.ApplyRedirect(redirectContext); } return Task.FromResult<object>(null); }
p站启动代码Startup.Auth.cs Paths自己定义，相关的provider可以阅读其它相关资料
app.UseCookieAuthentication(new CookieAuthenticationOptions { AuthenticationType=Paths.AuthenticationType, LoginPath=new PathString(Paths.LoginPath), LogoutPath=new PathString(Paths.LogoutPath), }); app.UseOAuthBearerTokens(new OAuthAuthorizationServerOptions { AuthorizeEndpointPath=new PathString(Paths.AuthorizePath), TokenEndpointPath=new PathString(Paths.TokenPath), AccessTokenExpireTimeSpan=TimeSpan.FromHours(2), Provider=new AuthorizationServerProvider(), AuthorizationCodeProvider=new AuthorizationCodeProvider(), RefreshTokenProvider=new RefreshTokenProvider(), ApplicationCanDisplayErrors=true, #if DEBUG //HTTPS is allowed only AllowInsecureHttp = false AllowInsecureHttp=true, #endif });
p站的 Authorize
public ActionResult Authorize() { //是否要求必须用户显示授权 弹出确认授权的页面 var userGrant = ConfigurationManager.AppSettings["oAuthUserGrant"]=="1"; IAuthenticationManager authentication = HttpContext.GetOwinContext().Authentication; AuthenticateResult ticket = authentication.AuthenticateAsync(Paths.AuthenticationType).Result; ClaimsIdentity identity = ticket?.Identity; if (identity==null) { //如果没有验证通过，则必须先通过身份验证，跳转到验证方法 authentication.Challenge(Paths.AuthenticationType); return new HttpUnauthorizedResult(); } if (Request.HttpMethod!="POST"&&userGrant) { return View(); } //返回给其它系统的用户身份只是在当前系统内的身份基础上增加了role identity=new ClaimsIdentity(identity.Claims, "Bearer"); //hardcode添加一些Claim，正常是从数据库中根据用户ID来查找添加 identity.AddClaim(new Claim(ClaimTypes.Role, "GetUserInfo")); authentication.SignIn(new AuthenticationProperties() { IsPersistent=true }, identity); return View(); }
w站的 OAuthLoginCallBack,此处很简单，AxOAuth2AuthenticationHandler 已经把其它工作做完了
[AllowAnonymous] public ActionResult OAuthLoginCallBack(string returnUrl) { return Redirect(returnUrl??"/"); }
AxOAuth2AuthenticationHandler 中的另两个主要函数，其它内容请参照Microsoft.Owin.Security.Google
private async Task<bool> InvokeReplyPathAsync() { if (Options.CallbackPath.HasValue && Options.CallbackPath == Request.Path) { // TODO: error responses //会调用下方的函数 var ticket = await AuthenticateAsync(); if (ticket == null) { _logger.WriteWarning("Invalid return state, unable to redirect."); Response.StatusCode = 500; return true; } var context = new AxOAuth2ReturnEndpointContext(Context, ticket); context.SignInAsAuthenticationType = Options.SignInAsAuthenticationType; context.RedirectUri = ticket.Properties.RedirectUri; await Options.Provider.ReturnEndpoint(context);
//已经设置了type,则会登录，就不再需要callback中去实现登录了 if (context.SignInAsAuthenticationType != null && context.Identity != null) { var grantIdentity = context.Identity; if ( !string.Equals(grantIdentity.AuthenticationType, context.SignInAsAuthenticationType, StringComparison.Ordinal)) { grantIdentity = new ClaimsIdentity(grantIdentity.Claims, context.SignInAsAuthenticationType, grantIdentity.NameClaimType, grantIdentity.RoleClaimType); } Context.Authentication.SignIn(context.Properties, grantIdentity); }
//下方的RedirectUri 是在当处那个Login中记录的 if (!context.IsRequestCompleted && context.RedirectUri != null) { var redirectUri = context.RedirectUri; if (context.Identity == null) { // add a redirect hint that sign-in failed in some way redirectUri = WebUtilities.AddQueryString(redirectUri, "error", "access_denied"); } Response.Redirect(redirectUri); context.RequestCompleted(); } return context.IsRequestCompleted; } return false; }
protected override async Task<AuthenticationTicket> AuthenticateCoreAsync() { AuthenticationProperties properties = null; try { string code = null; string state = null; var query = Request.Query; var values = query.GetValues("code"); if (values != null && values.Count == 1) { code = values[0]; } values = query.GetValues("state"); if (values != null && values.Count == 1) { state = values[0]; } properties = Options.StateDataFormat.Unprotect(state); if (properties == null) { return null; } // OAuth2 10.12 CSRF if (!ValidateCorrelationId(properties, _logger)) { return new AuthenticationTicket(null, properties); } var requestPrefix = Request.Scheme + "://" + Request.Host; var redirectUri = requestPrefix + Request.PathBase + Options.CallbackPath; // Build up the body for the token request var body = new List<KeyValuePair<string, string>>(); body.Add(new KeyValuePair<string, string>("grant_type", "authorization_code")); body.Add(new KeyValuePair<string, string>("code", code)); body.Add(new KeyValuePair<string, string>("redirect_uri", redirectUri)); body.Add(new KeyValuePair<string, string>("client_id", Options.ClientId)); body.Add(new KeyValuePair<string, string>("client_secret", Options.ClientSecret)); // Request the token from p var tokenResponse = await _httpClient.PostAsync(Options.TokenEndpoint, new FormUrlEncodedContent(body)); tokenResponse.EnsureSuccessStatusCode(); var text = await tokenResponse.Content.ReadAsStringAsync(); // Deserializes the token response var response = JObject.Parse(text); var accessToken = response.Value<string>("access_token"); if (string.IsNullOrWhiteSpace(accessToken)) { _logger.WriteWarning("Access token was not found"); return new AuthenticationTicket(null, properties); } // Get the user from u var request = new HttpRequestMessage(HttpMethod.Get, Options.UserInfoEndpoint); request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken); var graphResponse = await _httpClient.SendAsync(request, Request.CallCancelled); graphResponse.EnsureSuccessStatusCode(); text = await graphResponse.Content.ReadAsStringAsync(); var user = JsonSerializeHelper.Deserialize<UserInfo>(text); var context = new AxOAuth2AuthenticatedContext(Context, user, response); context.Identity = new ClaimsIdentity(Options.AuthenticationType,ClaimsIdentity.DefaultNameClaimType,ClaimsIdentity.DefaultRoleClaimType); context.Identity.AddClaim(new Claim("http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider", "ASP.NET Identity")); if (!string.IsNullOrEmpty(user.Id)) { context.Identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.Id, ClaimValueTypes.String, Options.AuthenticationType)); } if (!string.IsNullOrEmpty(user.Name)) { context.Identity.AddClaim(new Claim(ClaimTypes.Name, user.Name, ClaimValueTypes.String, Options.AuthenticationType)); } if (!string.IsNullOrEmpty(user.Email)) { context.Identity.AddClaim(new Claim(ClaimTypes.Email, user.Email, ClaimValueTypes.String, Options.AuthenticationType)); } context.Properties = properties; await Options.Provider.Authenticated(context); return new AuthenticationTicket(context.Identity, context.Properties); } catch (Exception ex) { _logger.WriteError("Authentication failed", ex); return new AuthenticationTicket(null, properties); } }
u站 Startup.Auth.cs
app.UseOAuthBearerAuthentication(new Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationOptions());
在需要控制权限的地方加上[Authorize]
配置webconfig中的machineKey和p站相同，则可以解密获取到access_token当中的用户信息
利用oauth2.0 实现内部的统一身份认证，从开始到现在能全程走通，走了很多弯路，希望能对需要了解这一块的朋友有所帮助，利用工作间隙的时间写的，比较乱，有的地方还需要完善，请谅解。
有任何疑问请留言，一起学习。
Microsoft.Owin.Security 自定义AuthenticationHandler 实现oauth2 的授权码模式
标签：
原文地址：http://www.cnblogs.com/forxixi/p/5864114.html
