三个网站：
1. www.cnblogs.com 用户直接面对和使用的web应用 以后简称w
2.passport.cnblogs.com 认证服务器，可以访问用户表的用户名和密码 以后简称p
3.users.cnblogs.com 给其它应用程序提供服务,本例当中只是提供授权用户的个人信息，例如手机 邮箱等信息 以后简称u
利用 Microsoft.Owin.Security 来实现oauth2 的授权码模式
主要流程：
1. w判断自己网站的cookie有没有，如果没有，跳转到自己的登录页
2.w登录页 action 记录下需要跳转的url地址，切换到 第三方登录 模式，返回401
3. w的第三方登录发现自己是当前的登录模式，而且状态码还是401，接管response,不再返回401,而是重定向至p站的Authorize
4.p站的Authorize查看当前用户是否已经登录，如果登录，返回授权页（大致内容是：你是否同意 第三方网站w使用你的个人信息） 注：这个地方也可以直接返回授权码，即不再需要用户确认一次，参见下方代码
5.用户同意后，p站生成授权码，并将请求过来的state参数附加在返回的url后，跳转回w网站
6.w网站拿到code和state后，首先检查state是否和当初请求时一样，然后在服务器构造一个新的请求，到p站拿回真实的access_token和refresh_token等信息
7.w网站用access_token到u站获取到用户的信息，然后构造ClaimsIdentity,在w网站登录,登录成功以后取出第2步存入的访问url，跳转
一些关键代码
w网站启动
//
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType=DefaultAuthenticationTypes.ApplicationCookie,
LoginPath=new PathString("/Account/Login")
});
//这段代码的作用是，如果第三方登录中没有配置SignInAsAuthenticationType
//则需要开启以后，在/Account/OAuthLoginCallBack 中获取到ExternalCookie 然后再实现当前网站的登录
//在OAuthLoginCallBack中再提及这部分代码
//app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);
//使用第三方登录的配置
//此处的oauth是参照修改Microsoft.Owin.Security.Google 而来
//不复杂，但有几处暗坑
//关于callbackpath ,由于oauth2.0 的规范要求 请求code和请求access_token的url中的redirect_uri 必须一致，所以增加了一个第三方登录完毕以后跳回来的地址
app.UseAxOAuth2Authentication(new AxOAuth2AuthenticationOptions()
{
TokenEndpoint="http://localhost:8099/token",
AuthorizeEndpoint="http://localhost:8099/oauth/authorize",
UserInfoEndpoint="http://localhost:8053/User/UserIdInfo",
ClientId="clientId",
ClientSecret="ClientSecret",
CallbackPath=new PathString("/Account/OAuthLoginCallBack"),
SignInAsAuthenticationType=DefaultAuthenticationTypes.ApplicationCookie
});
w网站 /Account/Login 完成 流程中第一步 第二步的功能
[AllowAnonymous]
public ActionResult Login(string returnUrl)
{
var properties = new AuthenticationProperties
{
RedirectUri=returnUrl
};
//AxOauth是我的第三方登录模块的名称 //
HttpContext.GetOwinContext().Authentication.Challenge(properties, "AxOauth");return new HttpUnauthorizedResult();
}
实现流程第三步 AxOAuth2AuthenticationHandler中的第一个主要函数 ，参考 Microsoft.Owin.Security.Google修改
protected override Task ApplyResponseChallengeAsync()
{ //401判断
if (Response.StatusCode != 401)
{
return Task.FromResult<object>(null);
}
//如果在login中不 Challenge 此处就会为null
var challenge = Helper.LookupChallenge(Options.AuthenticationType, Options.AuthenticationMode);
if (challenge != null)
{
var baseUri =
Request.Scheme +
Uri.SchemeDelimiter +
Request.Host +
Request.PathBase;
var currentUri =
baseUri +
Request.Path +
Request.QueryString;
var redirectUri =
baseUri +
Options.CallbackPath;
var properties = challenge.Properties;
if (string.IsNullOrEmpty(properties.RedirectUri))
{
properties.RedirectUri = currentUri;
}
// OAuth2 10.12 CSRF
GenerateCorrelationId(properties);
var queryStrings = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
{
{"response_type", "code"},
{"client_id", Options.ClientId},
{"redirect_uri", redirectUri}
};
// space separated
var scope = string.Join(" ", Options.Scope);
if (string.IsNullOrEmpty(scope))
{
// Google OAuth 2.0 asks for non-empty scope. If user didn‘t set it, set default scope to
// "openid profile email" to get basic user information.
scope = "openid profile email";
}
AddQueryString(queryStrings, properties, "scope", scope);
AddQueryString(queryStrings, properties, "access_type", Options.AccessType);
AddQueryString(queryStrings, properties, "approval_prompt");
AddQueryString(queryStrings, properties, "login_hint");
var state = Options.StateDataFormat.Protect(properties);
queryStrings.Add("state", state);
var authorizationEndpoint = WebUtilities.AddQueryString(Options.AuthorizeEndpoint,
queryStrings);
var redirectContext = new AxOAuth2ApplyRedirectContext(
Context, Options,
properties, authorizationEndpoint);
Options.Provider.ApplyRedirect(redirectContext);
}
return Task.FromResult<object>(null);
}
p站启动代码Startup.Auth.cs Paths自己定义，相关的provider可以阅读其它相关资料
app.UseCookieAuthentication(new CookieAuthenticationOptions
{
AuthenticationType=Paths.AuthenticationType,
LoginPath=new PathString(Paths.LoginPath),
LogoutPath=new PathString(Paths.LogoutPath),
});
app.UseOAuthBearerTokens(new OAuthAuthorizationServerOptions
{
AuthorizeEndpointPath=new PathString(Paths.AuthorizePath),
TokenEndpointPath=new PathString(Paths.TokenPath),
AccessTokenExpireTimeSpan=TimeSpan.FromHours(2),
Provider=new AuthorizationServerProvider(),
AuthorizationCodeProvider=new AuthorizationCodeProvider(),
RefreshTokenProvider=new RefreshTokenProvider(),
ApplicationCanDisplayErrors=true,
#if DEBUG
//HTTPS is allowed only AllowInsecureHttp = false
AllowInsecureHttp=true,
#endif
});
p站的 Authorize
public ActionResult Authorize()
{
//是否要求必须用户显示授权 弹出确认授权的页面
var userGrant = ConfigurationManager.AppSettings["oAuthUserGrant"]=="1";
IAuthenticationManager authentication = HttpContext.GetOwinContext().Authentication;
AuthenticateResult ticket = authentication.AuthenticateAsync(Paths.AuthenticationType).Result;
ClaimsIdentity identity = ticket?.Identity;
if (identity==null)
{
//如果没有验证通过，则必须先通过身份验证，跳转到验证方法
authentication.Challenge(Paths.AuthenticationType);
return new HttpUnauthorizedResult();
}
if (Request.HttpMethod!="POST"&&userGrant)
{
return View();
}
//返回给其它系统的用户身份只是在当前系统内的身份基础上增加了role
identity=new ClaimsIdentity(identity.Claims, "Bearer");
//hardcode添加一些Claim，正常是从数据库中根据用户ID来查找添加
identity.AddClaim(new Claim(ClaimTypes.Role, "GetUserInfo"));
authentication.SignIn(new AuthenticationProperties() { IsPersistent=true }, identity);
return View();
}
w站的 OAuthLoginCallBack,此处很简单，AxOAuth2AuthenticationHandler 已经把其它工作做完了
[AllowAnonymous]
public ActionResult OAuthLoginCallBack(string returnUrl)
{
return Redirect(returnUrl??"/");
}
AxOAuth2AuthenticationHandler 中的另两个主要函数，其它内容请参照Microsoft.Owin.Security.Google
private async Task<bool> InvokeReplyPathAsync()
{
if (Options.CallbackPath.HasValue && Options.CallbackPath == Request.Path)
{
// TODO: error responses
//会调用下方的函数
var ticket = await AuthenticateAsync();
if (ticket == null)
{
_logger.WriteWarning("Invalid return state, unable to redirect.");
Response.StatusCode = 500;
return true;
}
var context = new AxOAuth2ReturnEndpointContext(Context, ticket);
context.SignInAsAuthenticationType = Options.SignInAsAuthenticationType;
context.RedirectUri = ticket.Properties.RedirectUri;
await Options.Provider.ReturnEndpoint(context);
//已经设置了type,则会登录，就不再需要callback中去实现登录了
if (context.SignInAsAuthenticationType != null &&
context.Identity != null)
{
var grantIdentity = context.Identity;
if (
!string.Equals(grantIdentity.AuthenticationType, context.SignInAsAuthenticationType,
StringComparison.Ordinal))
{
grantIdentity = new ClaimsIdentity(grantIdentity.Claims, context.SignInAsAuthenticationType,
grantIdentity.NameClaimType, grantIdentity.RoleClaimType);
}
Context.Authentication.SignIn(context.Properties, grantIdentity);
}
//下方的RedirectUri 是在当处那个Login中记录的
if (!context.IsRequestCompleted && context.RedirectUri != null)
{
var redirectUri = context.RedirectUri;
if (context.Identity == null)
{
// add a redirect hint that sign-in failed in some way
redirectUri = WebUtilities.AddQueryString(redirectUri, "error", "access_denied");
}
Response.Redirect(redirectUri);
context.RequestCompleted();
}
return context.IsRequestCompleted;
}
return false;
}
protected override async Task<AuthenticationTicket> AuthenticateCoreAsync()
{
AuthenticationProperties properties = null;
try
{
string code = null;
string state = null;
var query = Request.Query;
var values = query.GetValues("code");
if (values != null && values.Count == 1)
{
code = values[0];
}
values = query.GetValues("state");
if (values != null && values.Count == 1)
{
state = values[0];
}
properties = Options.StateDataFormat.Unprotect(state);
if (properties == null)
{
return null;
}
// OAuth2 10.12 CSRF
if (!ValidateCorrelationId(properties, _logger))
{
return new AuthenticationTicket(null, properties);
}
var requestPrefix = Request.Scheme + "://" + Request.Host;
var redirectUri = requestPrefix + Request.PathBase + Options.CallbackPath;
// Build up the body for the token request
var body = new List<KeyValuePair<string, string>>();
body.Add(new KeyValuePair<string, string>("grant_type", "authorization_code"));
body.Add(new KeyValuePair<string, string>("code", code));
body.Add(new KeyValuePair<string, string>("redirect_uri", redirectUri));
body.Add(new KeyValuePair<string, string>("client_id", Options.ClientId));
body.Add(new KeyValuePair<string, string>("client_secret", Options.ClientSecret));
// Request the token from p
var tokenResponse =
await _httpClient.PostAsync(Options.TokenEndpoint, new FormUrlEncodedContent(body));
tokenResponse.EnsureSuccessStatusCode();
var text = await tokenResponse.Content.ReadAsStringAsync();
// Deserializes the token response
var response = JObject.Parse(text);
var accessToken = response.Value<string>("access_token");
if (string.IsNullOrWhiteSpace(accessToken))
{
_logger.WriteWarning("Access token was not found");
return new AuthenticationTicket(null, properties);
}
// Get the user from u
var request = new HttpRequestMessage(HttpMethod.Get, Options.UserInfoEndpoint);
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
var graphResponse = await _httpClient.SendAsync(request, Request.CallCancelled);
graphResponse.EnsureSuccessStatusCode();
text = await graphResponse.Content.ReadAsStringAsync();
var user = JsonSerializeHelper.Deserialize<UserInfo>(text);
var context = new AxOAuth2AuthenticatedContext(Context, user, response);
context.Identity = new ClaimsIdentity(Options.AuthenticationType,ClaimsIdentity.DefaultNameClaimType,ClaimsIdentity.DefaultRoleClaimType);
context.Identity.AddClaim(new Claim("http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider", "ASP.NET Identity"));
if (!string.IsNullOrEmpty(user.Id))
{
context.Identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.Id,
ClaimValueTypes.String, Options.AuthenticationType));
}
if (!string.IsNullOrEmpty(user.Name))
{
context.Identity.AddClaim(new Claim(ClaimTypes.Name, user.Name, ClaimValueTypes.String,
Options.AuthenticationType));
}
if (!string.IsNullOrEmpty(user.Email))
{
context.Identity.AddClaim(new Claim(ClaimTypes.Email, user.Email, ClaimValueTypes.String,
Options.AuthenticationType));
}
context.Properties = properties;
await Options.Provider.Authenticated(context);
return new AuthenticationTicket(context.Identity, context.Properties);
}
catch (Exception ex)
{
_logger.WriteError("Authentication failed", ex);
return new AuthenticationTicket(null, properties);
}
}
u站 Startup.Auth.cs
app.UseOAuthBearerAuthentication(new Microsoft.Owin.Security.OAuth.OAuthBearerAuthenticationOptions());
在需要控制权限的地方加上[Authorize]
配置webconfig中的machineKey和p站相同，则可以解密获取到access_token当中的用户信息
利用oauth2.0 实现内部的统一身份认证，从开始到现在能全程走通，走了很多弯路，希望能对需要了解这一块的朋友有所帮助，利用工作间隙的时间写的，比较乱，有的地方还需要完善，请谅解。
有任何疑问请留言，一起学习。