這種情況是我的客戶可以獲取有關我的用戶的數據。沒有爲配置服務器的代碼:如何在identityserver4中使用訪問令牌?
Startup.cs
services.AddIdentityServer()
.AddTemporarySigningCredential()
.AddInMemoryIdentityResources(ApiConfiguration.GetIdentityResources()) .AddInMemoryApiResources(ApiConfiguration.GetAllResources())
.AddInMemoryClients(ApiConfiguration.GetAllClients())
.AddTestUsers(ApiConfiguration.GetUsers())
ApiConfiguration
public static IEnumerable<ApiResource> GetAllResources()
{
yield return new ApiResource
{
Name = "customAPI",
Description = "Custom API Access",
UserClaims = new List<string> { "role" },
ApiSecrets = new List<Secret> { new Secret("scopeSecret".Sha256()) },
Scopes = new List<Scope> {
new Scope("customAPI"),
}
};
}
public static IEnumerable<Client> GetAllClients()
{
yield return new Client
{
ClientId = "oauthClient",
AllowedGrantTypes = GrantTypes.ClientCredentials,
ClientSecrets = new List<Secret> {
new Secret("Password".Sha256())},
AllowedScopes = new List<string> { "customAPI" }
};
}
public static IEnumerable<IdentityResource> GetIdentityResources()
{
return new List<IdentityResource>
{
new IdentityResources.OpenId(),
new IdentityResources.Profile(),
new IdentityResources.Email(),
};
}
public static List<TestUser> GetUsers()
{
return new List<TestUser>
{
new TestUser
{
SubjectId = "2",
Username = "bob",
Password = "psw",
Claims = new List<Claim> {
new Claim(ClaimTypes.Email, "[email protected]"),
new Claim(ClaimTypes.Role, "admin")
}
}
};
}
有了這個請求:
POST /connect/token
Headers:
Content-Type: application/x-www-form-urlencoded
Body:
grant_type=client_credentials&scope=customAPI&client_id=oauthClient&client_secret=Password
客戶拿到了訪問令牌。所以我的問題是我該如何使用令牌?我需要http請求來獲取有關bob(測試用戶)的數據?
還有另一個相關的問題:如何配置api到我的客戶端可以訪問令牌特定用戶只?