ABP-VNext 用戶權限管理系統實戰----擴展授權類型（單點登錄）

 一、適合場景：

1、我方系統在集成到別人的集成本臺時一般是拿別的平臺的用戶名，在我方系統進行登錄

2、我方系統是前後端分離，前端要拿到token

 

二、解決方案：自定義授權類型

我們知道Identityserver4有四種授權類型：用戶名密碼授權不適合單點登錄，因爲拿不到密碼；其它類型也不適合，因爲拿不到用戶信息。

1、繼承IExtensionGrantValidator接口

public class UserNameGrantValidator : IExtensionGrantValidator
{
public string GrantType => "username";
//1q2w3e* 進行sha256編碼後結果
public string ClientSecret => "E5Xd4yMqjP5kjWFKrYgySBju6JVfCzMyFp7n2QmMrME=";
private readonly UserManager<Volo.Abp.Identity.IdentityUser> _usermanager;
private readonly IdentityUserManager _identityUserManager;
private readonly IConfiguration _configuration;
public UserNameGrantValidator(UserManager<Volo.Abp.Identity.IdentityUser> usermanager, IdentityUserManager identityUserManager, IConfiguration configuration)
{
_configuration = configuration;
_usermanager = usermanager;
this._identityUserManager = identityUserManager;
}
public Task ValidateAsync(ExtensionGrantValidationContext context)
{
var username = context.Request.Raw.Get("username");
var auth_code = context.Request.Raw.Get("client_key");
var authcodeconfig = _configuration["ClientAuthKey"];
if (string.IsNullOrEmpty(auth_code) || string.IsNullOrEmpty(authcodeconfig) || auth_code != authcodeconfig.Sha256())
{
context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, "客戶端授權碼無效");
return Task.FromResult(1);
}
//var user = _userRepository.FirstOrDefaultAsync(x => x.Name == username);
var user = _usermanager.FindByNameAsync(username).Result;
if (user == null)
{
context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, "用戶未註冊");
return Task.FromResult(1);

}

//var claims = new List<Claim>();
//foreach (var itemClaim in user.Result.Claims)
//{
// var claim = new Claim(itemClaim.ClaimType, itemClaim.ClaimValue);
// claims.Add(claim);
//}

context.Result = new GrantValidationResult(
subject: user.Id.ToString(),
authenticationMethod: GrantType);
return Task.FromResult(0);
}
}

2、在AuthServerDataSeeder.cs文件中增加授權客戶端

 

3、注入授權類型

在AuthServerHostModule.cs類下增加方法：

 public override void PreConfigureServices(ServiceConfigurationContext context)
 {
     context.Services.PreConfigure<IIdentityServerBuilder>(builder =>
     {
         builder.AddExtensionGrantValidator<UserNameGrantValidator>();
     });
 }

4、postman請求並拿到access_token