的accessToken是空的身份服務器客戶端

Question

我有以下的OpenID選項：

app.UseCookieAuthentication(new CookieAuthenticationOptions 
      { 
       AuthenticationType = "Cookies", 
      }); 



      app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions 
      { 
       AuthenticationType = "oidc", 
       SignInAsAuthenticationType = "Cookies", 
       Authority = "http://localhost:5000",    
       ClientId = "mvcClient", 
       ClientSecret = "secret", 
       RedirectUri = "http://localhost:5002/signin-oidc", 
       PostLogoutRedirectUri = "http://localhost:5002", 
       ResponseType = "code id_token",        
       Scope = "openid profile", 

       Notifications = new OpenIdConnectAuthenticationNotifications 
       { 
        SecurityTokenValidated = async n => 
        { 
         var claims_to_exclude = new[] 
         { 
          "aud", "iss", "nbf", "exp", "nonce", "iat", "at_hash" 
         }; 

         var claims_to_keep = 
          n.AuthenticationTicket.Identity.Claims 
          .Where(x => false == claims_to_exclude.Contains(x.Type)).ToList(); 
         claims_to_keep.Add(new Claim("id_token", n.ProtocolMessage.IdToken)); 




         if (n.ProtocolMessage.AccessToken != null) 
         { 
          claims_to_keep.Add(new Claim("access_token", n.ProtocolMessage.AccessToken)); 

    }  
    }  
} 
} 

我看到n.ProtocolMessage.AccessToken總是空。

我身份的服務器配置的客戶端是這樣的：

new Client() 
       { 
        ClientId = "mvcClient", 
        ClientName = "MVC Client",      
        AllowedGrantTypes = GrantTypes.HybridAndClientCredentials, 

        ClientSecrets = new List<Secret>() 
        { 
         new Secret("secret".Sha256()) 
        }, 

        // RequireConsent = false, 

        // where to redirect to after login 
        RedirectUris = { "http://localhost:5002/signin-oidc" }, 
        // where to redirect to after logout 
        PostLogoutRedirectUris = { "http://localhost:5002" }, 

        AllowedScopes = 
        { 
         StandardScopes.OpenId.Name, 
         StandardScopes.Profile.Name, 
         StandardScopes.OfflineAccess.Name, 
         StandardScopes.Roles.Name, 
         "API" 
        } 
       }, 

我想知道爲什麼n.ProtocolMessage.AccessToken爲空，我怎樣才能得到它的價值

UPDATE

如果我改變客戶端類型的混合是這樣的：

AllowedGrantTypes = GrantTypes.Hybrid，

和的responseType =「代碼id_token令牌：

我得到INVALID_REQUEST錯誤的服務器

如果我試圖讓這樣的訪問令牌（在通知）：

var client = new TokenClient("http://localhost:5000/connect/token", "mvcClient", "secret"); 
          var response = client.RequestClientCredentialsAsync("testscope").Result; 
          var accesstoken = response.AccessToken; 
          claims_to_keep.Add(new Claim("access_token", accesstoken)); 

結果令牌只有一個範圍（即測試範圍），而不是爲該客戶端定義的所有其他範圍。

Answer 1

它是空的，因爲你沒有要求訪問令牌。

ResponseType = "code id_token"手段給客戶一個「Authoriziation代碼」和「ID令牌」的回調。要獲得訪問令牌，無論是

1. 包括token在ResponseType作爲ResponseType = "code id_token token" &更新客戶端流量的混合流（代碼+令牌），因爲這就是我們現在做的事情。

或

1. 使用使用「授權碼」上ProtocolMessage可用/token終端獲取一個訪問令牌。