okta + .net web api - 如何获取经过身份验证的用户电子邮件和姓名（配置文件范围数据）

Question

我的 Web api 服务器实现的代码与您在 okta 指南中看到的代码相同：
https://developer.okta.com/quickstart/#/widget/dotnet/aspnet4

public void Configuration(IAppBuilder app)
{
    // Configure JWT Bearer middleware
    // with an OpenID Connect Authority

    var authority = "https://{yourOktaDomain}.com/oauth2/default";

    var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
        authority + "/.well-known/openid-configuration",
        new OpenIdConnectConfigurationRetriever(),
        new HttpDocumentRetriever());

    app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions
    {
        AuthenticationMode = AuthenticationMode.Active,
        TokenValidationParameters = new TokenValidationParameters
        {
            ValidAudience = "api://default",
            ValidIssuer = authority,
            IssuerSigningKeyResolver = (token, securityToken, identifier, parameters) =>
            {
                var discoveryDocument = Task.Run(() => configurationManager.GetConfigurationAsync()).GetAwaiter().GetResult();
                return discoveryDocument.SigningKeys;
            }
        }
    });
}

身份验证有效，但我如何从“个人资料”范围内获得经过身份验证的用户电子邮件和姓名？
我看到的是这样的：

谢谢！

Answer 1

好吧，在这上面浪费了很多时间之后，解决方案是这些更改：

• 发送 id_token 而不是 session_token
• ValidAudience = "api://default" 到 ValidAudience = "your-application-client-id"
• ValidateAudience = true