ASP身份角色沒有出現在使用IdentityServer v3的客戶端

感覺我在IdentityServer或客戶端配置中丟失了某些東西。我已經從ASP成員身份升級到Identity，然後轉而使用IdentityServer使用SSO。我可以通過Identity Server登錄，然後返回到客戶端應用程序，我可以在其中調試並查看UserKey和聲明，但我在聲明中看不到任何角色，並且user.IsInRole（roleName）始終返回false。ASP身份角色沒有出現在使用IdentityServer v3的客戶端

的IdentityServer配置：

public class Scopes 
{ 
    public static IEnumerable<Scope> Get() 
    { 
     return new Scope[] 
     { 
      StandardScopes.OpenId, 
      StandardScopes.Profile, 
      StandardScopes.Email, 
      StandardScopes.AllClaims, 
      StandardScopes.Roles, 
      StandardScopes.OfflineAccess, 
      new Scope 
      { 
       IncludeAllClaimsForUser = true, 
       Name = "read", 
       DisplayName = "Read data", 
       Type = ScopeType.Resource, 
       Emphasize = false, 
      }, 
      new Scope 
      { 
       Name = "write", 
       DisplayName = "Write data", 
       Type = ScopeType.Resource, 
       Emphasize = false, //true 
      }, 
      new Scope 
      { 
       Name = "forbidden", 
       DisplayName = "Forbidden scope", 
       Type = ScopeType.Resource, 
       Emphasize = false //true 
      } 
     }; 
    } 
} 



public static class Clients 
{ 
    public static IEnumerable<Client> Get() 
    { 
     return new[] 
    { 
     new Client 
     { 
      Enabled = true, 
      ClientName = "MVC Client", 
      ClientId = "implicitclient", 
      Flow = Flows.Implicit, 
      AllowedScopes = new List<string> { 
       Constants.StandardScopes.OpenId, 
       Constants.StandardScopes.Profile, 
       Constants.StandardScopes.Email, 
       Constants.StandardScopes.Roles 
      }, 

      RedirectUris = new List<string> 
      { 
       "https://localhost:44301/" 
      } 
     }, 
     new Client 
     { 
      Enabled = true, 
      ClientName = "MyClientName", 
      ClientId = "myclientName", 
      Flow = Flows.Implicit, 
      AllowedScopes = new List<string> { 
       Constants.StandardScopes.OpenId, 
       Constants.StandardScopes.Profile, 
       Constants.StandardScopes.Email, 
       Constants.StandardScopes.Roles, 
       "read", 
       "write" 
      }, 
      RedirectUris = new List<string> 
      { 
       "https://localhost:44302/" 
      } 
     } 
    }; 
    } 
} 


public static IdentityServerServiceFactory Configure() 
    { 
     var factory = new IdentityServerServiceFactory(); 

     var scopeStore = new InMemoryScopeStore(Scopes.Get()); 
     factory.ScopeStore = new Registration<IScopeStore>(scopeStore); 
     var clientStore = new InMemoryClientStore(Clients.Get()); 
     factory.ClientStore = new Registration<IClientStore>(clientStore); 

     factory.CorsPolicyService = new Registration<ICorsPolicyService>(new DefaultCorsPolicyService { AllowAll = true }); 

     return factory; 
    }

客戶端配置（MVC應用5）：

public void Configuration(IAppBuilder app) 
    { 
     JwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, string>(); 

     app.UseCookieAuthentication(new CookieAuthenticationOptions 
     { 
      AuthenticationType = "Cookies" 
     }); 

     app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions 
     { 
      ClientId = "myclientname", 
      Authority = "https://localhost:44300/core", //Constants.BaseAddress, //STS Server Address 
      RedirectUri = "https://localhost:44302/", //This site 
      ResponseType = "id_token token", 
      //Scope = "openid email write", 
      Scope = "openid email roles", 

      SignInAsAuthenticationType = "Cookies", 

      Notifications = new OpenIdConnectAuthenticationNotifications 
      { 
       SecurityTokenValidated = async n => 
       { 
        var token = n.ProtocolMessage.AccessToken; 

        // persist access token in cookie 
        if (!string.IsNullOrEmpty(token)) 
        { 
         n.AuthenticationTicket.Identity.AddClaim(
          new Claim("access_token", token)); 
        } 
       } 
      } 
     }); 
    } 
}

任何建議非常感謝！

來源

2015-11-05 LightningShield

使用CustomUserService？ –

謝謝，是否有任何鏈接到維基/文檔，進一步解釋這一點。我見過你可以添加一個CustomUserService，但我不清楚如何解決這個問題？ – LightningShield

https://github.com/IdentityServer/IdentityServer3.Samples/tree/master/source/CustomUserService –

該範圍內的角色只有一個範圍要求，「作用」，這個範圍要求具有以下特性「AlwaysIncludeinIdToken」設置爲false，這意味着如果你問「令牌」 RESPONSE_TYPE它不會被隱式發送。（這是我的理解，也許不是那麼簡單）

先嚐試刪除「令牌」 RESPONSE_TYPE，並要求只爲「的OpenID」和「角色」範圍。如果這解決了問題，那麼它不會隱式發送它們。

您需要明確地詢問其餘索賠，即未在「id_ 令牌」請求中發送的索賠。您需要使用您獲得的access_token端點和「userinfo」端點。（如文檔中的尖端搜索正確使用端點）

編輯：UserInfo Documentation，這也許有用如何調用USERINFO端點。

來源

2015-11-18 16:29:03 Selvaticus

謝謝，我到了那裏與用戶信息終端！ – LightningShield

ASP身份角色沒有出現在使用IdentityServer v3的客戶端

回答

相關問題