oauth2：“userinfo 端点缺少子声明”Microsost 开放 ID 连接 - OIDC 客户端答案

【问题标题】：oauth2 : "sub claim is missing from userinfo endpoint" Microsost open ID Connect - OIDC CLientoauth2：“userinfo 端点缺少子声明”Microsost 开放 ID 连接 - OIDC 客户端
【发布时间】：2020-01-15 04:34:27
【问题描述】：

我正在使用 microsoft OidcClient 用于 oauth2.0 的 google 帐户，我得到了

“用户信息端点缺少子声明”错误。”

任何人都可以建议我是否遗漏了什么或做错了什么。

public async Task Authorize ()
{
    InitializeComponent ();

    var providerInformation = new ProviderInformation
    {
        IssuerName = "accounts.google.com",
        AuthorizeEndpoint = "https://accounts.google.com/o/oauth2/auth",
        TokenEndpoint = "https://oauth2.googleapis.com/token",
        //UserInfoEndpoint = "https://openidconnect.googleapis.com/v1/userinfo",
        UserInfoEndpoint = "https://www.googleapis.com/oauth2/v3/tokeninfo", 
        KeySet = new JsonWebKeySet()
    };

    var scope = "https://www.googleapis.com/auth/fitness.blood_glucose.read https://www.googleapis.com/auth/fitness.body.read https://www.googleapis.com/auth/fitness.activity.read https://www.googleapis.com/auth/fitness.blood_pressure.read"; https://www.googleapis.com/auth/fitness.blood_glucose.read https://www.googleapis.com/auth/fitness.body.read https://www.googleapis.com/auth/fitness.activity.read https://www.googleapis.com/auth/fitness.blood_pressure.read"; 

    var options = new OidcClientOptions
    {
        Authority = "https://accounts.google.com/o/oauth2/auth",
        ClientId = "xyz",
        Scope = scope,
        RedirectUri = "com.abc.xyzt:/oauthredirect",
        Browser = browser,
        ProviderInformation = providerInformation,
        //ResponseMode = OidcClientOptions.AuthorizeResponseMode.Redirect,
        TokenClientCredentialStyle = IdentityModel.Client.ClientCredentialStyle.AuthorizationHeader
    };

    _client = new OidcClient(options);
    await _client.LoginAsync(new LoginRequest());
}

我收到了 6 种不同类型的声明，但我没有收到图书馆正在寻找的 JwtClaimTypes.Subject "sub"。

谁能帮助或建议如何解决这个问题？

【问题讨论】：

标签： c# oauth-2.0 google-oauth identitymodel

【解决方案1】：

我找到了解决方案。我提供了太多信息。而不是让库根据服务发现端点进行计算。

public async Task Authorize ()
{
            var discovery = new DiscoveryPolicy
            {
                ValidateEndpoints = false,
                Authority = "https://accounts.google.com"
            };

            OidcClientOptions oidcClientOptions = new OidcClientOptions
            {
                Authority = "https://accounts.google.com",
                ClientId = "2345678",
                Scope = "https://www.googleapis.com/auth/fitness.body.read",
                RedirectUri = "com.abc.xyz",
                Browser = IoCRegistry.Locate<IBrowser>(),
                ResponseMode = OidcClientOptions.AuthorizeResponseMode.Redirect,
                Policy = new Policy
                {
                    Discovery = discovery,
                    RequireAccessTokenHash = false 
                }
            };

           var _client = new OidcClient(oidcClientOptions);
           var result = await _client.LoginAsync(new LoginRequest());
}

【讨论】：