如何使IdentityServer向访问令牌添加用户标识?

简短:我的客户机从IdentityServer示例服务器检索访问令牌,然后将其传递给我的WebApi。在我的控制器中,this.HttpContext.User。GetUserId()返回null(用户有其他声明)。我怀疑访问令牌中没有nameidentity声明。如何使IdentityServer包含它?

到目前为止,我尝试了什么:

• 从混合流切换到隐式流(随机尝试)

• 在我添加的IdSvrHost作用域定义中

  声明={new ScopeClaim(ClaimTypes.NameIdentifier,alwaysInclude:true)}

• 在我添加的IdSvrHost客户端定义中

  索赔={新索赔(ClaimTypes.NameIdentifier,“42”)}

(也是随机尝试)

我还在范围定义中尝试过其他范围,但都没有出现。看起来,nameidentity通常包含在身份令牌中,但对于我所知的大多数公共API,您不会向服务器提供身份令牌。

更多详细信息: IdSrvHost和Api位于不同的主机上。 控制器具有[Authorize]。事实上,我可以看到其他索赔。 Api配置有

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

app.UseIdentityServerAuthentication(options => {
    options.Authority = "http://localhost:22530/";

    // TODO: how to use multiple optional scopes?
    options.ScopeName = "borrow.slave";
    options.AdditionalScopes = new[] { "borrow.receiver", "borrow.manager" };

    options.AutomaticAuthenticate = true;
    options.AutomaticChallenge = true;
});

范围:

public static Scope Slave { get; } = new Scope {
    Name = "borrow.slave",
    DisplayName = "List assigned tasks",
    Type = ScopeType.Resource,

    Claims = {
        new ScopeClaim(ClaimTypes.NameIdentifier, alwaysInclude: true),
    },
};

和客户:

new Client {
    ClientId = "borrow_node",
    ClientName = "Borrow Node",

    Flow = Flows.Implicit,

    RedirectUris = new List<string>
    {
        "borrow_node:redirect-target",
    },

    Claims = { new Claim(ClaimTypes.NameIdentifier, "42") },

    AllowedScopes = {
        StandardScopes.OpenId.Name,
        //StandardScopes.OfflineAccess.Name,
        BorrowScopes.Slave.Name,
    },
}

身份验证URI:

request.CreateAuthorizeUrl(
            clientId: "borrow_node",
            responseType: "token",
            scope: "borrow.slave",
            redirectUri: "borrow_node:redirect-target",
            state: state,
            nonce: nonce);

我也试过

request.CreateAuthorizeUrl(
            clientId: "borrow_node",
            responseType: "id_token token",
            scope: "openid borrow.slave",
            redirectUri: "borrow_node:redirect-target",
            state: state,
            nonce: nonce);