来自 4.0.0 版文档的示例中的 Identity Server 无效范围

Question

我正在使用 IdentityServer4，遵循文档 https://identityserver4.readthedocs.io/en/latest/quickstarts/1_client_credentials.html

但在使用客户端凭据请求令牌时，使用 IdentityModel 的客户端出现 invalid_scope 错误。

我可能错过了一些步骤，但我已经检查了好几次。

奇怪的是，身份服务器端点显示以下日志：

Invalid scopes requested, {"ClientId": "client", "ClientName": null, "GrantType": "client_credentials", "Scopes": null, "AuthorizationCode": null, "RefreshToken": null, "UserName": null, "AuthenticationContextReferenceClasses": null, "Tenant": null, "IdP": null, "Raw": {"grant_type": "client_credentials", "scope": "api1", "client_id": "client", "client_secret": "***REDACTED***"}, "$type": "TokenRequestValidationLog"}

Scopes 是 null 和后来的 scope 具有 api1 值，这并不奇怪吗？

我正在使用内存值。

public static class Config
{
    public static IEnumerable<IdentityResource> Ids =>
        new IdentityResource[]
        { 
            new IdentityResources.OpenId()
        };

    public static IEnumerable<ApiResource> Apis =>
        new List<ApiResource>
        {
            new ApiResource("api1", "My Api")
        };
    
    public static IEnumerable<Client> Clients =>
        new List<Client>
        {
            new Client
            {
                ClientId = "client",
                AllowedGrantTypes = GrantTypes.ClientCredentials,
                ClientSecrets =
                {
                    new Secret("secret".Sha256())
                },
                AllowedScopes = { "api1" }
            }
        };
    
}

和

public void ConfigureServices(IServiceCollection services)
{
    // uncomment, if you want to add an MVC-based UI
    //services.AddControllersWithViews();

    var builder =
        services
            .AddIdentityServer()
            .AddInMemoryApiResources(Config.Apis)
            .AddInMemoryClients(Config.Clients)
            .AddInMemoryIdentityResources(Config.Ids);

    // not recommended for production - you need to store your key material somewhere secure
    builder.AddDeveloperSigningCredential();
}

public void Configure(IApplicationBuilder app)
{
    if (Environment.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }

    // uncomment if you want to add MVC
    //app.UseStaticFiles();
    //app.UseRouting();

    app.UseIdentityServer();

    // uncomment, if you want to add MVC
    //app.UseAuthorization();
    //app.UseEndpoints(endpoints =>
    //{
    //    endpoints.MapDefaultControllerRoute();
    //});
}

我可以看到众所周知的配置，虽然它没有提到 api1 作为支持的范围。

这是客户

var client = new HttpClient();
var discovery = 
    await client.GetDiscoveryDocumentAsync("https://localhost:5001");
if (discovery.IsError)
{
    await Console.Out.WriteLineAsync("Discovery error");
    return;
}

// request token
var clientCredentialsTokenRequest =
    new ClientCredentialsTokenRequest
    {
        Address = discovery.TokenEndpoint,
        ClientId = "client",
        ClientSecret = "secret",
        Scope = "api1"
    };

var tokenResponse = 
    await client.RequestClientCredentialsTokenAsync(clientCredentialsTokenRequest);

我是否缺少任何额外的东西来进行最基本的示例工作？

---

更新 1：

好的，我已将 Identity Server 降级到 3.1.3，它可以正常工作。 对于 Identity Server 4.0.0 版本，必须进行一些更改。将在那里进行调查。

Answer 1

找到了一个issue，它为我指明了正确的方向。通过用 ApiScopes 替换 ApiResources 来修复它：

public static IEnumerable<ApiScope> Apis =>
    new List<ApiScope>
    {
        new ApiScope("api1", "My Api")
    };

和

var builder =
    services
        .AddIdentityServer()
        .AddInMemoryApiScopes(Config.Apis)
        //.AddInMemoryApiResources(Config.Apis) //OLD?
        .AddInMemoryClients(Config.Clients)
        .AddInMemoryIdentityResources(Config.Ids);

我想文档还没有更新。

我在尝试访问受保护的 Api 时仍然遇到未经授权的情况，但那是另一回事。

Answer 2

我知道为时已晚，但我想向您展示另一种解决方案。 您的 ApiResources 应该与您的 ApiScopes 匹配，因为它们稍后会匹配。这就是为什么删除 AddInMemoryApiResources 解决了你的问题。因为您关闭了“匹配功能”。希望它会对某人有所帮助。

Startup.cs

services.AddIdentityServer()
            .AddDeveloperSigningCredential()
            .AddInMemoryPersistedGrants()
            .AddInMemoryApiScopes(Config.ApiScopes)
            .AddInMemoryIdentityResources(Config.IdentityResources)
            .AddInMemoryApiResources(Config.ApiResources)
            .AddInMemoryClients(Config.Clients);

Config.cs

public static class Config
{
    public static IEnumerable<IdentityResource> IdentityResources =>
        new IdentityResource[]
        {
            new IdentityResources.OpenId()
        };

    public static IEnumerable<ApiScope> ApiScopes =>
        new ApiScope[]
        {
            new ApiScope("SignalR", "SignalR Chat")
        };

    public static IEnumerable<ApiResource> ApiResources => 
        new List<ApiResource>
        {
            new ApiResource("SignalR", "SignalR Chat")
        };

    public static IEnumerable<Client> Clients =>
        new Client[]
        {
            new Client
            {
            ClientId = "client",

            // no interactive user, use the clientid/secret for authentication
            AllowedGrantTypes = GrantTypes.ClientCredentials,

            // secret for authentication
            ClientSecrets =
            {
                new Secret("secret".Sha256())
            },

            // scopes that client has access to
            AllowedScopes = { "SignalR" }
            }
        };
}