无法访问秘密路由 identityserver4 但确实收到访问令牌

Question

大家好，我正在尝试使用身份服务器通过 apitwo 访问 apione，我确实收到了访问令牌，但无法使用它从 apitwo 接收秘密数据

你们能帮我吗？ https://github.com/noahsalvadordenjo/cant-reach-secret-route 配置.cs

        public static IEnumerable<ApiResource> GetApis() => new List<ApiResource>
        {
            new ApiResource("ApiOne"),
            new ApiResource("ApiTwo"),
        };
        public static IEnumerable<Client> GetClients() => new List<Client>
        {
            new Client
            {
                ClientId = "client_id",
                ClientSecrets = { new Secret("client_secret".ToSha256())},
                AllowedGrantTypes = GrantTypes.ClientCredentials,
                AllowedScopes = { "ApiOne" }
            }
        };
        public static IEnumerable<ApiScope> GetScopes() => new List<ApiScope>
        {
            new ApiScope("ApiOne"),
            new ApiScope("ApiTwo")
        };

身份服务器启动.cs

public class Startup
    {
        // This method gets called by the runtime. Use this method to add services to the container.
        // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddIdentityServer()
                .AddInMemoryClients(Configuration.GetClients())
                .AddInMemoryApiResources(Configuration.GetApis())
                .AddInMemoryApiScopes(Configuration.GetScopes())
                .AddDeveloperSigningCredential();
            services.AddControllersWithViews();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseRouting();
            app.UseIdentityServer();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapDefaultControllerRoute();
            });
        }
    }

路由我试图从 apione secretcontroller.cs 访问

 public class SecretController : Controller
    {
        [Route("/secret")]
        [Authorize]
        public string Index()
        {
            return "Secretmessage fropm apione";
        }
    }

Homecontroller api 1 尝试访问 api 2

  public class HomeController : Controller
    {
        private readonly IHttpClientFactory httpClientFactory;

        public HomeController(IHttpClientFactory httpClientFactory)
        {
            this.httpClientFactory = httpClientFactory;
        }
        [Route("/")]
        public async Task<IActionResult> Index()
        {
            var serverClient = httpClientFactory.CreateClient();
            var discoveryDocument = await serverClient.GetDiscoveryDocumentAsync("https://localhost:44395/");
            var token = await serverClient.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
            {
                Address = discoveryDocument.TokenEndpoint,
                ClientId = "client_id",
                ClientSecret = "client_secret",

                Scope = "ApiOne"
            });
            var apiClient = httpClientFactory.CreateClient();
            apiClient.SetBearerToken(token.AccessToken);
            var response = await apiClient.GetAsync("https://localhost:44368/secret");
            var content = await response.Content.ReadAsStringAsync();
            return Ok(new {
                access_token = token.AccessToken,
                message = content
            });
        }
    }

Startup ApiOne

public class Startup
    {
        // This method gets called by the runtime. Use this method to add services to the container.
        // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddAuthentication("Bearer")
                .AddJwtBearer("Bearer", config =>
                {
                    config.Authority = "https://localhost:44395/";
                    config.Audience = "ApiOne";
                });
            services.AddControllers();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseRouting();
            app.UseAuthentication();
            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }

启动apitwo

public class Startup
    {
        // This method gets called by the runtime. Use this method to add services to the container.
        // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddAuthentication("Bearer")
                .AddJwtBearer("Bearer", config =>
                {
                    config.Authority = "https://localhost:44395/";
                    config.Audience = "ApiTwo";
                });
            services.AddHttpClient();
            services.AddControllers();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseRouting();
            app.UseAuthentication();
            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }

Answer 1

如果“client_id”是访问 apione 的客户端，则该客户端只能访问 apione 而不能访问 apitwo。尝试在 AllowedScopes 下为“client_id”添加 apitwo，如果这不起作用，那么您可能需要一个委托来调用 apitwo：

https://identityserver4.readthedocs.io/en/latest/topics/extension_grants.html