.Net Core API权限认证 IdentityServer4实现.Net Core API接口权限认证(快速入门)

public class Config
  {
    /// <summary>
    /// 定义资源范围
    /// </summary>
    public static IEnumerable<ApiResource> GetApiResources()
    {
      return new List<ApiResource>
      {
        new ApiResource("api1", "我的第一个API")
      };
    }

    /// <summary>
    /// 定义访问的资源客户端
    /// </summary>
    /// <returns></returns>
    public static IEnumerable<Client> GetClients()
    {
      return new List<Client>
      {
        new Client{
          ClientId="client",//定义客户端ID
          ClientSecrets=
          {
            new Secret("secret".Sha256())//定义客户端秘钥
          },
          AllowedGrantTypes=GrantTypes.ResourceOwnerPassword,//授权方式为用户密码模式授权，类型可参考GrantTypes枚举
          AllowedScopes={ "api1"}//允许客户端访问的范围

        }
       };
    }

    /// <summary>
    /// 这个方法是来规范tooken生成的规则和方法的。一般不进行设置，直接采用默认的即可。
    /// </summary>
    /// <returns></returns>
    public static IEnumerable<IdentityResource> GetIdentityResources()
    {
      return new IdentityResource[]
      {
        new IdentityResources.OpenId()
      };
    }
  }

// This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
      services.AddIdentityServer()//注册服务
        .AddDeveloperSigningCredential()
        .AddInMemoryApiResources(Config.GetApiResources())//配置类定义的授权范围
        .AddInMemoryClients(Config.GetClients())//配置类定义的授权客户端
        .AddTestUsers(new List<TestUser> { new TestUser { Username = "Admin", Password = "123456", SubjectId = "001", IsActive = true } });//模拟测试用户，这里偷懒了，用户可以单独管理，最好不要直接在这里New
      services.AddControllers();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
      if (env.IsDevelopment())
      {
        app.UseDeveloperExceptionPage();
      }

      app.UseIdentityServer();//添加中间件
      
      app.UseHttpsRedirection();

      app.UseRouting();

      app.UseAuthorization();

      app.UseEndpoints(endpoints =>
      {
        endpoints.MapControllers();
      });
    }

public void ConfigureServices(IServiceCollection services)
    {
      //注册服务
      services.AddAuthentication("Bearer")
        .AddIdentityServerAuthentication(x =>
        {
          x.Authority = "http://localhost:5000";//鉴权服务地址
          x.RequireHttpsMetadata = false;
          x.ApiName = "api1";//鉴权范围
        });
      services.AddControllers();
    }

    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
      if (env.IsDevelopment())
      {
        app.UseDeveloperExceptionPage();
      }
      app.UseAuthentication();//添加鉴权认证
      app.UseHttpsRedirection();
      app.UseRouting();
        app.UseAuthorization();
      app.UseEndpoints(endpoints =>
      {
        endpoints.MapControllers();
      }); 
    }

public static IHostBuilder CreateHostBuilder(string[] args) =>
      Host.CreateDefaultBuilder(args)
      
        .ConfigureWebHostDefaults(webBuilder =>
        {
          webBuilder.UseUrls("http://*:5555");//设置启动端口号
          webBuilder.UseStartup<Startup>();
        });

[Route("api/[controller]")]
  [ApiController]
  public class TestController : ControllerBase
  {
    // GET: api/Test
    /// <summary>
    /// 方法加权
    /// </summary>
    /// <returns></returns>
    [Authorize]
    [HttpGet]
    public IEnumerable<string> Get()
    {
      return new string[] { "value1", "value2" };
    }

    /// <summary>
    /// 方法未加权 可直接访问
    /// </summary>
    /// <param name="id"></param>
    /// <returns></returns>
    // GET: api/Test/5
    [HttpGet("{id}", Name = "Get")]
    public string Get(int id)
    {
      return "value";
    }

    /// <summary>
    /// 开放获取token API 接口
    /// </summary>
    /// <returns></returns>
    [HttpGet("GetToken")]
    public async Task<string> GetToken()
    {
      var client = new HttpClient();
      var tokenResponse = await client.RequestPasswordTokenAsync(new PasswordTokenRequest
      {
        Address = "http://localhost:5000/connect/token",
        ClientId = "client",
        ClientSecret = "secret",
        Scope = "api1",
        UserName = "Admin",
        Password = "123456",
      });

      if (tokenResponse.IsError)
      {
        return tokenResponse.Error;
      }

      return tokenResponse.AccessToken;

    }
  }