从持票人令牌生成身份

Question

有没有办法将持有人令牌字符串并在asp.net中手动将其转换为Identity对象？

干杯， 阿齐兹

Answer 1

令牌只是持有索赔，它只是用来验证到资源。如果其中一项索赔持有用户信息，您可以创建一个身份并向其分配索赔。

public void ValidateBearerToken(OwinContext context) 
{ 
    try 
    { 
     var tokenHandler = new JwtSecurityTokenHandler(); 
     byte[] securityKey = GetBytes("some key"); //this should come from a config file 

     SecurityToken securityToken; 

     var validationParameters = new TokenValidationParameters() 
     { 
      ValidAudience = "http://localhost:2000", 
      IssuerSigningToken = new BinarySecretSecurityToken(securityKey), 
      ValidIssuer = "Self" 
     }; 

     var auth = context.Request.Headers["Authorization"]; 

     if (!string.IsNullOrWhiteSpace(auth) && auth.Contains("Bearer")) 
     { 
      var token = auth.Split(' ')[1]; 

      var principal = tokenHandler.ValidateToken(token, validationParameters, out securityToken); 

      context.Request.User = principal; 
     } 
    } 
    catch (Exception ex) 
    { 
     var message = ex.Message; 
    } 
} 

Answer 2

首先，您需要创建一些基于令牌的声明，然后创建ClaimsIdentity并使用它来授权用户。

public ActionResoult Login(string token) 
{ 
    if(_tokenManager.IsValid(token))   
    { 
     // optionally you have own user manager which returns roles and user name from token 
     // no matter how you store users and roles 
     var user=_myUserManager.GetUserRoles(token); 

     // user is valid, going to authenticate user for my App 
     var ident = new ClaimsIdentity(
      new[] 
      { 
       // adding following 2 claim just for supporting default antiforgery provider 
       new Claim(ClaimTypes.NameIdentifier, token), 
       new Claim("http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider", "ASP.NET Identity", "http://www.w3.org/2001/XMLSchema#string"), 

       // an optional claim you could omit this 
       new Claim(ClaimTypes.Name, user.Username), 

       // populate assigned user's role form your DB 
       // and add each one as a claim 
       new Claim(ClaimTypes.Role, user.Roles[0]), 
       new Claim(ClaimTypes.Role, user.Roles[1]), 
       // and so on 
      }, 
      DefaultAuthenticationTypes.ApplicationCookie); 

     // Identity is sign in user based on claim don't matter 
     // how you generated it    
     HttpContext.GetOwinContext().Authentication.SignIn(
      new AuthenticationProperties { IsPersistent = false }, ident); 

     // auth is succeed, just from a token 
     return RedirectToAction("MyAction"); 
    } 
    // invalid user   
    ModelState.AddModelError("", "We could not authorize you :("); 
    return View(); 
} 

现在你可以使用Authorize过滤器，以及：

[Authorize] 
public ActionResult Foo() 
{ 
} 

// since we injected user roles to Identity we could do this as well 
[Authorize(Roles="admin")] 
public ActionResult Foo() 
{ 
    // since we injected our authentication mechanism to Identity pipeline 
    // we have access current user principal by calling also 
    // HttpContext.User 
} 

而且我鼓励你有看Token Based Authentication Sample从我的github回购是一个非常简单的工作示例。