在控制器中生成令牌

Question

我使用Owin和ASP.NET Identity來使用OAuth令牌來保護我的Web API方法。令牌子系統設置如下：

var oauthOptions = new OAuthAuthorizationServerOptions() 
{ 
    TokenEndpointPath = new PathString("/Token"), 
    Provider = new SimpleAuthorizationServerProvider(), 
    AccessTokenFormat = new TicketDataFormat(app.CreateDataProtector(typeof(OAuthAuthorizationServerMiddleware).Namespace, "Access_Token", "v1")), 
    RefreshTokenFormat = new TicketDataFormat(app.CreateDataProtector(typeof(OAuthAuthorizationServerMiddleware).Namespace, "Refresh_Token", "v1")), 
    AccessTokenProvider = new AuthenticationTokenProvider(), 
    RefreshTokenProvider = new AuthenticationTokenProvider(), 
    AccessTokenExpireTimeSpan = TimeSpan.FromDays(14), 
    AllowInsecureHttp = true 
}; 

app.UseOAuthAuthorizationServer(oauthOptions); 
app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions()); 

它適用於基於用戶名/密碼請求令牌，然後消耗這些令牌。但是，由於用戶在點擊呈現SPA的控制器時已經通過身份驗證，我想在我的視圖中生成令牌並將其傳遞給Javascript代碼，而不必再次登錄SPA。

所以我的問題是：我如何手動生成我的令牌，所以我可以將它包含在我的SPA視圖中？

Answer 1

你可以通過調用OAuthBearerOptions.AccessTokenFormat.Protect(ticket)產生控制器內訪問令牌和代碼將看起來像下面：

 private JObject GenerateLocalAccessTokenResponse(string userName) 
    { 

     var tokenExpiration = TimeSpan.FromDays(1); 

     ClaimsIdentity identity = new ClaimsIdentity(OAuthDefaults.AuthenticationType); 

     identity.AddClaim(new Claim(ClaimTypes.Name, userName)); 

     var props = new AuthenticationProperties() 
     { 
      IssuedUtc = DateTime.UtcNow, 
      ExpiresUtc = DateTime.UtcNow.Add(tokenExpiration), 
     }; 

     var ticket = new AuthenticationTicket(identity, props); 

     var accessToken = Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket); 

     JObject tokenResponse = new JObject(
            new JProperty("userName", userName), 
            new JProperty("access_token", accessToken), 
            new JProperty("token_type", "bearer"), 
            new JProperty("expires_in", tokenExpiration.TotalSeconds.ToString()), 
            new JProperty(".issued", ticket.Properties.IssuedUtc.ToString()), 
            new JProperty(".expires", ticket.Properties.ExpiresUtc.ToString()) 
    ); 

     return tokenResponse; 
    } 

而且你需要聲明你OAuthBearerOptions爲static財產類Startup.cs

但是，如果您希望爲訪問令牌實施靜默刷新而不要求用戶再次登錄，那麼您應該考慮實施刷新令牌授予，不要按照您的建議進行。您可以閱讀我的詳細blog post，瞭解如何在使用AngularJS構建的SPA中生成刷新令牌。

希望這回答你的問題。