PasswordTokenRequest 返回 invalid_client答案

【问题标题】：PasswordTokenRequest returning invalid_clientPasswordTokenRequest 返回 invalid_client
【发布时间】：2019-08-31 23:57:18
【问题描述】：

我正在尝试使用身份服务器 4 的密码从 .net 核心 api 控制器获取令牌。我收到错误 invalid_client。

这里是控制器。

   [HttpGet]
        public async Task<IActionResult> Get()
        {
            var client = new HttpClient();
            var disco =  await client.GetDiscoveryDocumentAsync("https://localhost:44321");
            var tokenResponse = await client.RequestPasswordTokenAsync(new PasswordTokenRequest
            {
                Address = disco.TokenEndpoint,
                ClientId = "htmlClient",
                ClientSecret = "secretpassword",
                UserName = "someguy@gmail.com",
                Password = "password",
                Scope = "WebApi.ReadAccess"
            });
            return Ok();
        }

这里是配置

public class Config
    {
        public static IEnumerable<ApiResource> GetApiResources()
        {
            return new List<ApiResource>
            {
                new ApiResource(
                    "WebApi.ReadAccess",
                    "WebApi API",
                    new List<string> {
                        JwtClaimTypes.Id,
                        JwtClaimTypes.Email,
                        JwtClaimTypes.Name,
                        JwtClaimTypes.GivenName,
                        JwtClaimTypes.FamilyName
                    }
                ),

                new ApiResource("WebApi.FullAccess", "WebApi API")
            };
        }

        public static IEnumerable<Client> GetClients()
        {
            return new[]
            {
                new Client
                {
                    Enabled = true,
                    ClientName = "HTML Page Client",
                    ClientId = "htmlClient",
                    AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,

                    ClientSecrets =
                    {
                        new Secret("secretpassword")
                    },

                    AllowedScopes = { "WebApi.ReadAccess" }
                }
            };
        }
    }

在configureServices的startup.cs中

 services.AddIdentityServer()
                   .AddInMemoryApiResources(Config.GetApiResources())
                   .AddInMemoryClients(Config.GetClients())
                   .AddProfileService<ProfileService>()
                   .AddDeveloperSigningCredential();

            services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme =
                                           JwtBearerDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme =
                                           JwtBearerDefaults.AuthenticationScheme;
            }).AddJwtBearer(o =>
            {
                o.Authority = "https://localhost:44321";
                o.Audience = "WebApi.ReadAccess";
                o.RequireHttpsMetadata = false;
            });

在配置中我有 app.UseIdentityServer();

public  void Configure(IApplicationBuilder app, IHostingEnvironment env, BooksContext booksContext)
{
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }
    else
    {
        app.UseHsts();
    }

    app.UseHttpsRedirection();
    app.UseIdentityServer();
    app.UseMvc();
    app.UseSwagger();
    app.UseSwaggerUI(options =>
        options.SwaggerEndpoint("/swagger/v2/swagger.json", "Book Chapter Service"));
    app.UseDefaultFiles();
    app.UseStaticFiles();
}

【问题讨论】：

标签： c# identityserver4 asp.net-core-webapi

【解决方案1】：

尝试将您的代码更改为以下代码。我已经给出了通用代码，您可以根据需要进行更改。

             return new List<ApiResource>
            {
                new ApiResource
                {
                    Name = "api",
                    DisplayName = "WebApi API",
                    Scopes =
                    {
                        new Scope("WebApi.ReadAccess", "Read write access to web api")

                    }
                },
                new ApiResource
                {
                    Name = "api",
                    DisplayName = "WebApi API",
                    Scopes =
                    {
                        new Scope("WebApi.FullAccess", "Full access to web api")

                    }
                }
            }

和

o.Audience = "api";

原因是，您的 o.Audience 名称应与 ApiResource.Name 匹配，因为它表示您的权限和受众之间的映射。例如，在您的情况下，权威https://localhost:44321 有观众可以说称为“api”。 “api”也是您的 ApiResource 的名称，它授予创建访问令牌的权限。希望这会有所帮助！

【讨论】：