Web API 2 OWIN Bearer token authentication - AccessTokenFormat null?OWIN中IIS主机的默认OAuth AccessTokenFormat实现是什么？
默认/令牌端点工作正常，我可以得到从那里， 令牌，但我需要使用一个票AccessTokenFormat.Protect方法生成的accessToken为externalLogin。
基本上我的实现与这一个非常相似，并且我遇到了AccessTokenFormat为空的相同问题。 从documentation它说：用来保护包含在访问令牌中的信息
的数据格式。如果应用程序未提供默认数据保护提供程序，则取决于主机服务器。 IIS上的SystemWeb主机将使用ASP.NET机器密钥数据保护，并且HttpListener和其他自托管服务器将使用DPAPI数据保护。如果分配了不同的访问令牌提供程序或格式，则必须将兼容实例分配给资源服务器的OAuthBearerAuthenticationOptions.AccessTokenProvider或OAuthBearerAuthenticationOptions.AccessTokenFormat属性。
它在我看来，如果AccessTokenFormat没有分配，主机会为它提供一个基本的实现。但我不认为它在这里有效。 有没有一种方法可以找到ISecureDataFormatAccessTokenFormat的默认实现并将其手动分配给变量？
或者没有人有其他想法如何解决这个问题？
更新： 我得到了武士刀的源代码，并找到OAuthAuthorizationServerMiddleware类，从源代码中，我可以看到下面的代码：
if (Options.AccessTokenFormat == null)
{
IDataProtector dataProtecter = app.CreateDataProtector(
typeof(OAuthAuthorizationServerMiddleware).Namespace,
"Access_Token", "v1");
Options.AccessTokenFormat = new TicketDataFormat(dataProtecter);
}
在我Startup.Auth，这里是我的代码：
static Startup()
{
PublicClientId = "self";
UserManagerFactory =() => new UserManager<ApplicationUser>(new UserStore<ApplicationUser>(new ApplicationDbContext()));
OAuthOptions = new OAuthAuthorizationServerOptions()
{
TokenEndpointPath = new PathString("/Token"),
AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
Provider = new ApplicationOAuthProvider(PublicClientId, UserManagerFactory),
AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
AllowInsecureHttp = true
};
OAuthBearerOptions = new OAuthBearerAuthenticationOptions();
OAuthBearerOptions.AccessTokenFormat = OAuthOptions.AccessTokenFormat;
OAuthBearerOptions.AccessTokenProvider = OAuthOptions.AccessTokenProvider;
OAuthBearerOptions.AuthenticationMode = OAuthOptions.AuthenticationMode;
OAuthBearerOptions.AuthenticationType = OAuthOptions.AuthenticationType;
OAuthBearerOptions.Description = OAuthOptions.Description;
OAuthBearerOptions.Provider = new CustomBearerAuthenticationProvider();
OAuthBearerOptions.SystemClock = OAuthOptions.SystemClock;
}
public void ConfigureAuth(IAppBuilder app)
{
// Configure the db context and user manager to use a single instance per request
app.CreatePerOwinContext(ApplicationDbContext.Create);
app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);
app.UseOAuthAuthorizationServer(OAuthOptions);
// Enable the application to use bearer tokens to authenticate users
app.UseOAuthBearerTokens(OAuthOptions);
// Enable the application to use a cookie to store information for the signed in user
// and to use a cookie to temporarily store information about a user logging in with a third party login provider
// Configure the sign in cookie
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
LoginPath = new PathString("/Account/Login"),
Provider = new CookieAuthenticationProvider
{
OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
validateInterval: TimeSpan.FromMinutes(30),
regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
}
});
// Use a cookie to temporarily store information about a user logging in with a third party login provider
app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
}
我也有WebApiConfig
0以下// Web API configuration and services
// Configure Web API to use only bearer token authentication.
config.SuppressDefaultHostAuthentication();
config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));
我不知道为什么 app.UseOAuthAuthorizationServer(OAuthOptions);没有设置accessTokenFormat