namespace A.IdentityServer4Config
{
    public static class Clients
    {
        public static IEnumerable<Client> GetClients(IConfiguration configuration)
        {
            return new List<Client>
            {
                new Client
                {
                    ClientId = "B",
                    ClientSecrets = {new Secret("hashed secret for B")},
                    AllowedGrantTypes = GrantTypes.CodeAndClientCredentials,
                    AllowedScopes = {"openid", "profile", ...},
                    RedirectUris = {"https://B.azurewebsites.net/Account/oidc-callback"},
                    RequireConsent = false,
                    AccessTokenLifetime = 10 * 60,
                },
            };
        }
    }
}

在Startup.ConfigureServices中:

var identityServerBuilder = services
    .AddIdentityServer(options => {...})
    ...
    .AddInMemoryClients(Clients.GetClients(configuration))
    ...;

注意,我指定的重定向URI是一个HTTPS URI。

在B的代码中,我使用了Microsoft.Extensions.DependencyInjection.OpenIdConnectExtensions中的AddOpenIdConnect()重载之一来配置登录调用应如何进行:

services.AddAuthentication(options => {...})
    ...
    .AddOpenIdConnect(
        "oidc",
        options =>
        {
            ...

            options.Authority = "https://A.azurewebsites.net";
            options.RequireHttpsMetadata = true;

            options.ClientId = "B";
            options.ClientSecret = "secret for B";
            options.ResponseType = "code";
            options.CallbackPath = "/Account/oidc-callback"; // !!!

            options.SaveTokens = true;
            options.GetClaimsFromUserInfoEndpoint = true;

            ...
        }
    );

当我尝试在B登录时,我被带到A上的错误页。当我查看A上由IdentityServer4生成的日志时,很明显,错误的原因是B请求的重定向URI与预期的不匹配。这两个URI之间的唯一区别是A期望看到的是HTTP S URI,而B指定的是HTTP(no“S”)URI:

2018-08-16 15:20:41.307 +00:00 [Error] IdentityServer4.Endpoints.AuthorizeEndpoint: Request validation failed
2018-08-16 15:20:41.307 +00:00 [Information] IdentityServer4.Endpoints.AuthorizeEndpoint: {
"ClientId": "B",
"AllowedRedirectUris": [
    "https://B.azurewebsites.net/Account/oidc-callback"
],
"SubjectId": "anonymous",
"RequestedScopes": "",
"Raw": {
    "client_id": "B",
    "redirect_uri": "http://B.azurewebsites.net/Account/oidc-callback",
    "response_type": "code",
    "scope": "openid profile ...",
    "response_mode": "form_post",
    "nonce": "[omitted]",
    "state": "[omitted]",
    "x-client-SKU": "ID_NETSTANDARD1_4",
    "x-client-ver": "5.2.0.0"
}
}
2018-08-16 15:20:41.307 +00:00 [Information] IdentityServer4.Events.DefaultEventService: {
"Name": "Token Issued Failure",
"Category": "Token",
"EventType": "Failure",
"Id": 2001,
"ClientId": "B",
"Endpoint": "Authorize",
"Scopes": "",
"Error": "unauthorized_client",
"ErrorDescription": "Invalid redirect_uri",
"ActivityId": "[omitted]",
"TimeStamp": "2018-08-16T15:20:41Z",
"ProcessId": 10408,
"LocalIpAddress": "[omitted]",
"RemoteIpAddress": "[omitted]"
}

我不知道为什么B对A的请求默认为重定向URI的HTTP。我不知道怎么改成HTTPS。我可以放宽重定向URI是HTTPS的要求,但这似乎是错误的做法。我想知道如何让B在对A的请求中指定一个HTTPS URI。根据文档中对RemoteAuthenticationOptions.CallbackPath的描述,我认为应该通过确保“应用程序的基本路径”是HTTPS来实现;但是,我不知道怎么做,在网上搜索也没有成功。

我试过的

如上所述,我尝试完全指定重定向URI(而不是相对地)。这不起作用-它会导致应用程序在启动时崩溃。

我还尝试将CallbackPath类型设置为使用PathString.FromUriComponent()构造的PathString(使用各种绝对uri)。这不起作用。URI的协议和域部分被丢弃,并替换为如果我将相对URI作为字符串传递的话它们应该是什么(即“http”和相应的域)。

我查看了MVC客户机的各个示例中的启动类 https://github.com/IdentityServer/IdentityServer4.Samples . 我没有看到任何明显能解决这个问题的办法。