ASP.Net Core Identity JWT 基于角色的身份验证被禁止

Question

美好的一天。

API 用于报价共享网络应用程序。

我已经设置了基于角色的 JWT 身份验证，其中我拥有“成员”和“管理员”角色，这些角色的用户已正确注册并能够检索令牌。

到目前为止，方法（或类）只有

[Authorize]

只要有注册的令牌就可以正确访问。

现在，一旦我添加了角色，就可以访问需要特定角色的方法或类

[Authorize(Role="Admin")]

被禁止 (403)，即使我确实通过 Authorization 标头传递了正确的令牌。

请注意：我已验证用户已正确创建 (dbo.AspNetUsers)、角色已正确创建（dbo.AspNetRoles 包含“Admin”和“Member”角色）并且用户角色已正确映射 (dbo .AspNetUserRoles）。

这是 Startup 类，它包含一个由 Configure() 调用的 CreateRoles() 方法：

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }


    public void ConfigureServices(IServiceCollection services)
    {
        services.AddDbContext<QuotContext>(options =>
            options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));

        services.AddIdentity<Member, IdentityRole>()
            .AddEntityFrameworkStores<QuotContext>()
            .AddDefaultTokenProviders();

        services.Configure<IdentityOptions>(options =>
        {
            // Password settings
            options.Password.RequireDigit = false;
            options.Password.RequiredLength = 4;
            options.Password.RequireNonAlphanumeric = false;
            options.Password.RequireUppercase = false;
            options.Password.RequireLowercase = false;
            options.Password.RequiredUniqueChars = 2;

            // Lockout settings
            options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(30);
            options.Lockout.MaxFailedAccessAttempts = 10;
            options.Lockout.AllowedForNewUsers = true;

            // User settings
            options.User.RequireUniqueEmail = true;
        });


        services.AddLogging(builder =>
        {
            builder.AddConfiguration(Configuration.GetSection("Logging"))
                .AddConsole()
                .AddDebug();
        });

        JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear(); // => remove default claims

        services
            .AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;

            })
            .AddJwtBearer(cfg =>
            {
                cfg.RequireHttpsMetadata = false;
                cfg.SaveToken = true;
                cfg.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidIssuer = Configuration["JwtIssuer"],
                    ValidAudience = Configuration["JwtIssuer"],
                    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(Configuration["JwtKey"])),
                    ClockSkew = TimeSpan.Zero // remove delay of token when expire
                };
            });

        services.AddMvc();
    }


    public void Configure(IApplicationBuilder app, IHostingEnvironment env, IServiceProvider serviceProvider, QuotContext dbContext)
    {
        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
            app.UseBrowserLink();
            app.UseDatabaseErrorPage();
        }

        app.UseAuthentication();

        app.UseMvc();

        dbContext.Database.EnsureCreated();

        CreateRoles(serviceProvider).Wait();
    }

    private async Task CreateRoles(IServiceProvider serviceProvider)
    {
        //initializing custom roles 
        var RoleManager = serviceProvider.GetRequiredService<RoleManager<IdentityRole>>();
        var UserManager = serviceProvider.GetRequiredService<UserManager<Member>>();
        string[] roleNames = { "Admin", "Member" };
        IdentityResult roleResult;

        foreach (var roleName in roleNames)
        {
            var roleExist = await RoleManager.RoleExistsAsync(roleName);
            if (!roleExist)
                roleResult = await RoleManager.CreateAsync(new IdentityRole(roleName));
        }

        var poweruser = new Member
        {
            UserName = Configuration["AppSettings:AdminEmail"],
            Email = Configuration["AppSettings:AdminEmail"],
        };

        string password = Configuration["AppSettings:AdminPassword"];
        var user = await UserManager.FindByEmailAsync(Configuration["AppSettings:AdminEmail"]);

        if (user == null)
        {
            var createPowerUser = await UserManager.CreateAsync(poweruser, password);
            if (createPowerUser.Succeeded)
                await UserManager.AddToRoleAsync(poweruser, "Admin");
        }
    }
}

这是包含 Register() 和 Login() 方法的 MembersController 类：

[Authorize]
public class MembersController : Controller
{
    private readonly QuotContext _context;
    private readonly UserManager<Member> _userManager;
    private readonly SignInManager<Member> _signInManager;
    private readonly ILogger<MembersController> _logger;
    private readonly IConfiguration _configuration;

    public MembersController(QuotContext context, UserManager<Member> userManager,
        SignInManager<Member> signInManager, ILogger<MembersController> logger,
        IConfiguration configuration)
    {
        _context = context;
        _userManager = userManager;
        _signInManager = signInManager;
        _logger = logger;
        _configuration = configuration;
    }

    [HttpPost("register")]
    [AllowAnonymous]
    public async Task<IActionResult> Register([FromBody] RegisterModel model)
    {
        if (ModelState.IsValid)
        {
            var newMember = new Member
            {
                UserName = model.Email,
                Email = model.Email,
                PostCount = 0,
                Reputation = 10,
                ProfilePicture = "default.png"
            };

            var result = await _userManager.CreateAsync(newMember, model.Password);

            if (result.Succeeded)
            {
                _logger.LogInformation(1, "User registered.");
                await _signInManager.SignInAsync(newMember, false);

                return Ok(new { token = BuildToken(model.Email, newMember) });
            }

            _logger.LogInformation(1, "Registeration failed.");
            return BadRequest();
        }

        return BadRequest();
    }

    [HttpPost("login")]
    [AllowAnonymous]
    public async Task<IActionResult> Login([FromBody] LoginModel model)
    {
        if (ModelState.IsValid)
        {
            var result = await _signInManager.PasswordSignInAsync(model.Email,
                model.Password, model.RememberMe, lockoutOnFailure: false);

            if (result.Succeeded)
            {
                _logger.LogInformation(1, "User logged in." + _configuration["AppSettings:AdminPassword"]);
                var member = _userManager.Users.SingleOrDefault(r => r.Email == model.Email);

                return Ok(new { token = BuildToken(model.Email, member) });
            }

            _logger.LogInformation(1, "Login failed.");
            return BadRequest();
        }

        return BadRequest(ModelState);
    }

    private string BuildToken(string email, Member member)
    {
        var claims = new List<Claim>
        {
            new Claim(JwtRegisteredClaimNames.Sub, email),
            new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
            new Claim(ClaimTypes.NameIdentifier, member.Id)
        };

        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["JwtKey"]));
        var creds = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
        var expires = DateTime.Now.AddDays(Convert.ToDouble(_configuration["JwtExpireDays"]));

        var token = new JwtSecurityToken(
            _configuration["JwtIssuer"],
            _configuration["JwtIssuer"],
            claims,
            expires: expires,
            signingCredentials: creds
        );

        return new JwtSecurityTokenHandler().WriteToken(token);
    }

}

这是两种方法的示例：第一种方法需要简单的身份验证，成功访问并提供用户令牌，第二种方法即使给定管理员令牌也被禁止：

public class AuthorsController : Controller
{
    private readonly QuotContext _context;

    public AuthorsController(QuotContext context)
    {
        _context = context;
    }

    [HttpGet]
    [Authorize]
    public IEnumerable<Author> GetAuthors()
    {
        return _context.Authors;
    }

    [HttpPost]
    [Authorize(Roles = "Admin")]
    public async Task<IActionResult> PostAuthor([FromBody] Author author)
    {
        if (!ModelState.IsValid)
        {
            return BadRequest(ModelState);
        }

        _context.Authors.Add(author);
        await _context.SaveChangesAsync();

        return StatusCode(201);
    }
}

感谢您的帮助。 包含完整项目的 github 存储库：https://github.com/theStrayPointer/QuotAPI

Answer 1

我遇到了同样的问题。我刚刚找到了办法。事实上，JWT 令牌嵌入了角色。因此，您必须在生成令牌时在令牌中添加角色声明。

var roles = await _userManager.GetRolesAsync(user);
var claims = new[]
{
    new Claim(JwtRegisteredClaimNames.Sub, user.Id.ToString()),
    new Claim(JwtRegisteredClaimNames.Jti, Guid.NewGuid().ToString()),
    new Claim(JwtRegisteredClaimNames.Iat, ToUnixEpochDate(dateTime).ToString(), ClaimValueTypes.Integer64)
};

ClaimsIdentity claimsIdentity = new ClaimsIdentity(claims, "Token");
// Adding roles code
// Roles property is string collection but you can modify Select code if it it's not
claimsIdentity.AddClaims(roles.Select(role => new Claim(ClaimTypes.Role, role)));

var token = new JwtSecurityToken
(
    _configuration["Auth:Token:Issuer"],
    _configuration["Auth:Token:Audience"],
    claimsIdentity.Claims,
    expires: dateTime,
    notBefore: DateTime.UtcNow,
    signingCredentials: new SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["Auth:Token:Key"])), SecurityAlgorithms.HmacSha256)
);

找到了here和here的解释。