C# Identity Server 4和ASP.NET Web表单客户端-授予类型无效

我在本地安装了Identity Server 4，并添加了一个MVC Net Core客户端，没有任何问题

但我无法让我的.Net Framework Web表单应用程序正常工作

当我尝试点击About（Secure page）.aspx页面时，出现以下错误：

“抱歉，出现错误：未经授权的\u客户端
客户端“”的授权类型无效

我尝试过各种各样的格兰特类型，但都没有成功

我觉得ID4中的客户端设置不正确。各种博客帖子都说我应该使用代码授权，但其他人说我应该使用id_令牌

我已在ID4服务器应用程序中按如下方式设置客户端：

new Client
{
    ClientId = "aspx",
    ClientSecrets = { new Secret("secret".Sha256()) },

    AllowedGrantTypes = GrantTypes.HybridAndClientCredentials,                

    //My web forms aspx client
    RedirectUris = { "http://localhost:5969/" },

    //My web forms aspx client
    PostLogoutRedirectUris = { "http://localhost:5969/" },

    AllowOfflineAccess = true,
    AllowAccessTokensViaBrowser = true,

    RequirePkce = false,

    AllowedScopes =
    {
        IdentityServerConstants.StandardScopes.OpenId,
        IdentityServerConstants.StandardScopes.Profile                    
    },
}

我的Web窗体应用程序中的Startup.cs（我使用的是\WebFormsClient\sample from）

我有点困惑，到底是什么https://localhost:5001/connect/userinfo 应该是-我拿到了401

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions()
        {
            AuthenticationType = "Cookies",
            ExpireTimeSpan = TimeSpan.FromMinutes(10),
            SlidingExpiration = true
        });

        JwtSecurityTokenHandler.InboundClaimTypeMap.Clear();
      
        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {                
            AuthenticationType = "oidc",
            SignInAsAuthenticationType = "Cookies",                
            Authority = "https://localhost:5001/",
            ClientId = "aspx",
            RedirectUri = "http://localhost:5969/",
            PostLogoutRedirectUri = "http://localhost:5969/",
            ResponseType = "id_token token",
            Scope = "openid profile email",
            UseTokenLifetime = false,
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                SecurityTokenValidated = async n =>
                {
                    var claims_to_exclude = new[]
                    {
                        "aud", "iss", "nbf", "exp", "nonce", "iat", "at_hash"
                    };

                    var claims_to_keep =
                        n.AuthenticationTicket.Identity.Claims
                        .Where(x => false == claims_to_exclude.Contains(x.Type)).ToList();
                    claims_to_keep.Add(new Claim("id_token", n.ProtocolMessage.IdToken));

                    if (n.ProtocolMessage.AccessToken != null)
                    {
                        claims_to_keep.Add(new Claim("access_token", n.ProtocolMessage.AccessToken));

                        var userInfoClient = new UserInfoClient(new Uri("https://localhost:5001/connect/userinfo"), n.ProtocolMessage.AccessToken);
                        var userInfoResponse = await userInfoClient.GetAsync();
                        var userInfoClaims = userInfoResponse.Claims
                            .Where(x => x.Item1 != "sub") // filter sub since we're already getting it from id_token
                            .Select(x => new Claim(x.Item1, x.Item2));
                        claims_to_keep.AddRange(userInfoClaims);
                    }

                    var ci = new ClaimsIdentity(
                        n.AuthenticationTicket.Identity.AuthenticationType,
                        "name", "role");
                    ci.AddClaims(claims_to_keep);

                    n.AuthenticationTicket = new Microsoft.Owin.Security.AuthenticationTicket(
                        ci, n.AuthenticationTicket.Properties
                    );
                },
                RedirectToIdentityProvider = n =>
                {
                    if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest)
                    {
                        var id_token = n.OwinContext.Authentication.User.FindFirst("id_token")?.Value;
                        n.ProtocolMessage.IdTokenHint = id_token;
                    }

                    return Task.FromResult(0);
                }
            }
        });
        app.UseStageMarker(PipelineStage.Authenticate);
    }
}

“id_token token”是，因此您需要将其包含在您的

AllowGrantTypes

中

---

对于，它只是根据您使用的访问令牌返回关于用户的声明。获得401响应可能意味着您没有传递有效的访问令牌。如果您需要额外的用户声明，并且您只有一个访问令牌而没有ID令牌，那么它可能非常有用。

“ID\U令牌令牌”是隐式流，因此您需要将其包含在

AllowedGrantTypes

中。打开并观察identity server上的跟踪级别日志记录也非常有用；它非常详细地阐述了问题所在。非常好-非常有效！我设置AllowedGrantTypes=GrantTypes.Implicit并从web表单中删除了“电子邮件”范围很好-我将添加一个答案；随便接受吧。