在 IdentityServer 响应对象中添加角色答案

【问题标题】：Add Roles in IdentityServer Response object在 IdentityServer 响应对象中添加角色
【发布时间】：2017-07-30 08:28:23
【问题描述】：

我正在使用 Identity Server 3。只有当用户具有特权时，我才从 IdentityServer3 获取承载令牌，否则返回未授权。

AccessToken 的解码版本是

{
  "iss": "https://localhost:1234/core",
  "aud": "https://localhost:1234/core/resources",
  "exp": 1489060441,
  "nbf": 1489056841,
  "client_id": "app1",
  "scope": [
    "openid",
    "profile",
    "email",
    "roles",
    "app1"
  ],
  "sub": "93f7aab4-5469-4c85-8e73-5dcd859ed2a8",
  "auth_time": 1489056776,
  "idp": "idsrv",
  "amr": [
    "password"
  ]
}

我的期望是

{
  "iss": "https://localhost:1234/core",
  "aud": "https://localhost:1234/core/resources",
  "exp": 1489060441,
  "nbf": 1489056841,
  "client_id": "app1",
  "scope": [
    "openid",
    "profile",
    "email",
    "roles",
    "app1"
  ],
  "roles": [
    "Admin"
  ],
  "sub": "93f7aab4-5469-4c85-8e73-5dcd859ed2a8",
  "auth_time": 1489056776,
  "idp": "idsrv",
  "amr": [
    "password"
  ]
}

客户：

new Client
            {
                ClientId = @"APP1",
                ClientName = @"APP Implicit Client",
                Enabled = true,
                Flow = Flows.Implicit,
                RequireConsent = true,
                AllowRememberConsent = true,
                RedirectUris = new List<string> {"http://localhost:5775/callback/"},
                PostLogoutRedirectUris = new List<string> {"http://localhost:5775/logout"},
                AllowedCorsOrigins = new List<string>{ "http://localhost:5775/" },
                AllowedScopes =
                    new List<string>
                    {
                        Constants.StandardScopes.OpenId,
                        Constants.StandardScopes.Profile,
                        Constants.StandardScopes.Email,
                        Constants.StandardScopes.Roles,
                        "app1"
                    },
                AccessTokenType = AccessTokenType.Jwt
            }

用户：

new InMemoryUser
            {
                Username = "User1",
                Password = "Password123!",
                Subject = "1",
                Claims = new List<Claim>
                {
                    new Claim(Constants.ClaimTypes.GivenName, "Bala"),
                    new Claim(Constants.ClaimTypes.FamilyName, "Balamanigandan"),
                    new Claim(Constants.ClaimTypes.Email, "balamanigandan.b@gmail.com"),
                    new Claim(Constants.ClaimTypes.Role, "Admin")
                }
            }

我的WebAPI有一个方法有如下装饰[Authorize(Roles = "Admin")]，需要角色“Admin”的Bearer token

请帮助我如何在此令牌中添加角色以访问 WebAPI 中的[Authorize(Roles = "Admin")] 方法。

【问题讨论】：

标签： asp.net-web-api claims-based-identity identityserver3 user-roles authorize-attribute

【解决方案1】：

尝试将 Scope 设置为“Roles”，将 ScopeClaim 设置为“Admin”，如果您希望在“access_token”中将 ScopeType 设置为“Resource”，我看到您已经将声明用户声明为“Role”，将其更改为“Roles”

示例范围

 public static Scope Roles
    {
        get
        {
            return new Scope
            {
                Name = "Roles",
                Type = ScopeType.Resource,
                Emphasize = true,
                IncludeAllClaimsForUser = true,
                Claims = new List<ScopeClaim> 
                {
                    new ScopeClaim("Admin",true)
                }
            };
        }
    }

【讨论】：