WebAPI 2 - OAuth 2 拦截授权令牌

Question

我创建了一个简单的 Web 服务 - WebAPI 2 使用托管在 IIS 上的 owin 在我的启动文件中

public void Configuration(IAppBuilder app)
    {
        // For more information on how to configure your application, visit http://go.microsoft.com/fwlink/?LinkID=316888
        ConfigureOAuth(app);
        var configuration = new HttpConfiguration();
        WebApiConfig.Register(configuration);
        app.UseWebApi(configuration);
        app.UseCors(CorsOptions.AllowAll);
    }

    public void ConfigureOAuth(IAppBuilder app)
    {
        var oAuthServerOptions = new OAuthAuthorizationServerOptions()
        {
            AllowInsecureHttp = true,
            TokenEndpointPath = new PathString("/token"),
            AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
            Provider = new SimpleAuthorizationServerProvider()
        };

        // Token Generation
        app.UseOAuthAuthorizationServer(oAuthServerOptions);
        app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

    }

并创建了一个带有授权属性的简单控制器。在身份模型中，我添加了用户调用服务器时想要阅读的信息

var identity = new ClaimsIdentity(context.Options.AuthenticationType);
        identity.AddClaim(new Claim("sub", context.UserName));
        identity.AddClaim(new Claim("role", "user"));
        identity.AddClaim(new Claim("session", "50"));

对于我想要获取会话值的每个请求，有没有办法做到这一点？如何添加中间件来拦截令牌授权过程？

Answer 1

您可以在控制器操作中尝试这样的操作：

IPrincipal x = ControllerContext.RequestContext.Principal;
ClaimsIdentity ci = x.Identity as ClaimsIdentity;
string session = ci.FindFirst("session").Value;