IdentifyServer项目
IdentityServer4是用于ASP.NET Core的OpenID Connect和OAuth 2.0框架。
官网：https://identityserver4.readthedocs.io/en/latest/
- 创建Asp.net Web Core 空 模板项目,可以将基命名为：IdentityServer（名称可以随意，一般都取这个），注意必须配置Https
- 引用IdentityServer4
- 配置Config,必须是static 类
/// <summary>
/// IdentityServer4配置类
/// </summary>
public static class Config
{
/// <summary>
/// Api范围
/// </summary>
public static IEnumerable<ApiScope> ApiScopes => new[]
{
new ApiScope()
{
Name = "simple_api",
DisplayName = "Simple_API"
}
};
public static IEnumerable<Client> Clients => new[]
{
new Client()
{
ClientId = "simple_client",
ClientSecrets = new List<Secret>()
{
new Secret("simple_client_secret".Sha256())
},
AllowedGrantTypes = new List<string>(){GrantType.ClientCredentials},
AllowedScopes = { "simple_api" }//允许访问的api,可以有多个
},
//资源拥有者客户端
new Client()
{
ClientId = "simple_pass_client",
ClientSecrets = new List<Secret>()
{
new Secret("simple_client_secret".Sha256())
},
AllowedGrantTypes = new List<string>(){GrantType.ResourceOwnerPassword},
AllowedScopes = { "simple_api" }//允许访问的api,可以有多个
},
//配置OICD 重定向
new Client()
{
ClientId = "simple_mvc_client",
ClientName = "Simple Mvc Client",
ClientSecrets = new List<Secret>()
{
new Secret("simple_client_secret".Sha256())
},
AllowedGrantTypes = new List<string>(){GrantType.AuthorizationCode}, //授权码许可协议
//登录成功的跳转地址(坑点：必须使用Https！！！)
RedirectUris = {"https://localhost:4001/signin-oidc"}, //mvc客户端的地址，signin-oidc:标准协议里的端点名称
//登出后的跳转地址
PostLogoutRedirectUris = {"https://localhost:4001/signout-callback-oidc"},
AllowedScopes =
{
IdentityServerConstants.StandardScopes.OpenId,
IdentityServerConstants.StandardScopes.Profile, //IdentityResources中定义了这两项，在这里也需要声明
"simple_api"
},//允许访问的api,可以有多个
RequireConsent = true //是否需要用户点同意
},
};
//资源拥有者(TestUser只是IdentifyServer4提供的一个测试用户)
public static List<TestUser> Users = new List<TestUser>()
{
new TestUser()
{
SubjectId = "1",
Username = "admin",
Password = "123"
}
};
//定义身份资源（标准的oidc(OpenId Connect)）
public static IEnumerable<IdentityResource> IdentityResources = new List<IdentityResource>()
{
new IdentityResources.OpenId(),
new IdentityResources.Profile(),//档案信息(昵称，头像。。。)
};
}
- 在
StartUp.cs 中的ConfigureServices 方法中配置如下：
public void ConfigureServices(IServiceCollection services)
{
services.AddControllersWithViews();
services.AddIdentityServer()
.AddDeveloperSigningCredential() //默认的生成的密钥（运行后，会在项目根目录下生成文件 tempkey.jwk）
.AddInMemoryClients(Config.Clients) //注册客户端
.AddInMemoryApiScopes(Config.ApiScopes) //注册api访问范围
.AddTestUsers(Config.Users) //注册资源拥有者
.AddInMemoryIdentityResources(Config.IdentityResources); //用户的身份资源信息（例如：显示昵称，头像，等等信息）
}
- 在
StartUp.cs 中的 Configure 配置如下代码
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
app.UseStaticFiles();
app.UseRouting();
app.UseIdentityServer();
app.UseAuthorization();
app.UseEndpoints(endpoint =>
{
endpoint.MapDefaultControllerRoute();
});
}
- 运行测试地址：https://localhost:5000/.well-known/openid-configuration
{
"issuer": "https://localhost:5000",
"jwks_uri": "https://localhost:5000/.well-known/openid-configuration/jwks",
"authorization_endpoint": "https://localhost:5000/connect/authorize",
"token_endpoint": "https://localhost:5000/connect/token",
"userinfo_endpoint": "https://localhost:5000/connect/userinfo",
"end_session_endpoint": "https://localhost:5000/connect/endsession",
"check_session_iframe": "https://localhost:5000/connect/checksession",
"revocation_endpoint": "https://localhost:5000/connect/revocation",
"introspection_endpoint": "https://localhost:5000/connect/introspect",
"device_authorization_endpoint": "https://localhost:5000/connect/deviceauthorization",
"frontchannel_logout_supported": true,
"frontchannel_logout_session_supported": true,
"backchannel_logout_supported": true,
"backchannel_logout_session_supported": true,
"scopes_supported": [
"simple_api",
"offline_access"
],
"claims_supported": [],
"grant_types_supported": [
"authorization_code",
"client_credentials",
"refresh_token",
"implicit",
"urn:ietf:params:oauth:grant-type:device_code"
],
"response_types_supported": [
"code",
"token",
"id_token",
"id_token token",
"code id_token",
"code token",
"code id_token token"
],
"response_modes_supported": [
"form_post",
"query",
"fragment"
],
"token_endpoint_auth_methods_supported": [
"client_secret_basic",
"client_secret_post"
],
"id_token_signing_alg_values_supported": [
"RS256"
],
"subject_types_supported": [
"public"
],
"code_challenge_methods_supported": [
"plain",
"S256"
],
"request_parameter_supported": true
}
5.测试client : Post 请求 https://localhost:5000/connect/token，传递请求参数：
- 测试 客户端1（simple_client）
client_id：simple_client
client_secret：simple_client_secret
grant_type：client_credentials
{
"access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjlBMjVFQUVFMjI4RDQyOUQ0QzFEMTc1NjNENzJEQTgzIiwidHlwIjoiYXQrand0In0.eyJuYmYiOjE2MzE4ODg4MzYsImV4cCI6MTYzMTg5MjQzNiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo1MDAwIiwiY2xpZW50X2lkIjoic2ltcGxlX2NsaWVudCIsImp0aSI6IjRBNjI4QUNDODg3OTIxN0YzNzk4QTAwNTUyQjk5OTc4IiwiaWF0IjoxNjMxODg4ODM2LCJzY29wZSI6WyJzaW1wbGVfYXBpIl19.dfWw0h1bpHJy-NAyfOQBEAqthFStndAMPq7nWFAxabKm9A2Wlw4FE9t1bci2DZtgZftb4Uj4GHmibtGyqnTmc4z_OBdZ7llIW3o_LcbiUjMrefohOFGSyRuGVlbzRZb1pbcru8JoNG9k4bFrCLVWvNRUUcUTdVan6ydMkYqNQUg_NJKhKGW9n0HbuoE5nE2yM2eqHHB6IOd6uMYvWzlISfgWNvHlBGtXTGvBkfYjikf6yEz7FuKwuijDeLGPkAbb407ZzFCw-Qo_GV1I9Nzp3IrRe9n9oSSq3_h2plLuL8gNgP8L3Bb82k_LKS-wjBEtm9eLgAh1Mdn6nEL1ezutpg",
"expires_in": 3600,
"token_type": "Bearer",
"scope": "simple_api"
}
其中access_token ，这串字符串的结构就是jwt结构包装的令牌，我们可以将这个字符串放入https://jwt.ms 来进行解密看看这到底包装了啥。
{
"alg": "RS256",
"kid": "9A25EAEE228D429D4C1D17563D72DA83",
"typ": "at+jwt"
}.{
"nbf": 1631888836,
"exp": 1631892436,
"iss": "https://localhost:5000",
"client_id": "simple_client",
"jti": "4A628ACC8879217F3798A00552B99978",
"iat": 1631888836,
"scope": [
"simple_api"
]
}.[Signature]
- 测试客户端2(资源拥有者客户端：simple_pass_client )
client_id：simple_pass_client
client_secret：simple_client_secret
grant_type：password(其实就是GrantType.ResourceOwnerPassword)
username:admin(与Config类中资源拥有客户端一致)
password:123(与Config类中资源拥有客户端一致)
{
"access_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IjZBQTAwQjMzQTExQzE1M0VGNTZDRkVCNzQ4RTZDQjQxIiwidHlwIjoiYXQrand0In0.eyJuYmYiOjE2MzIxNDk5MDgsImV4cCI6MTYzMjE1MzUwOCwiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NTAwMCIsImNsaWVudF9pZCI6InNpbXBsZV9wYXNzX2NsaWVudCIsInN1YiI6IjEiLCJhdXRoX3RpbWUiOjE2MzIxNDk5MDgsImlkcCI6ImxvY2FsIiwianRpIjoiNjg1QzZDQjBFRjVBQjEzMDhGM0Y1OTlFMDEwMDI3MDciLCJpYXQiOjE2MzIxNDk5MDgsInNjb3BlIjpbInNpbXBsZV9hcGkiXSwiYW1yIjpbInB3ZCJdfQ.tWCsFWnlMinuHvb4UTVK-GxSRUyhSX7GGZPYE05KsZt67K-yriNl1FBI5ZThAWU7qscrCSEBWk1yLd3LR8G3xqEyPkpT4j_xoPTToY7zOAgVHw6wJPV3NxsfzdN07AuYCiPTP9WR9DrWLWy4Iac5GxZ30pcwXNLhPugPRZLG6dUXwry18Dl8jstBHvBQSKGIcrm5HKGeKUxs2aXRg-rl2BmHedRUZK6IjGoABeeSbAUSMfsTOVMdZSXwhdznI6wsjV9YLq3-CerfCIri0BtHVmSJz7hqrq-mg88NK2CZzLEvmKzf73-FprWxdma-6xUEv6E-X4dgOAXt-EZPCSnzWA",
"expires_in": 3600,
"token_type": "Bearer",
"scope": "simple_api"
}
将access_token 放入https://jwt.ms 来进行解密查看结果，也可以与客户端1对比对比
{
"alg": "RS256",
"kid": "6AA00B33A11C153EF56CFEB748E6CB41",
"typ": "at+jwt"
}.{
"nbf": 1632149908,
"exp": 1632153508,
"iss": "https://localhost:5000",
"client_id": "simple_pass_client",
"sub": "1",
"auth_time": 1632149908,
"idp": "local",
"jti": "685C6CB0EF5AB1308F3F599E01002707",
"iat": 1632149908,
"scope": [
"simple_api"
],
"amr": [
"pwd"
]
}.[Signature]
Api 项目
- 创建一个空的asp.net core webapi
- 引用包
Microsoft.AspNetCore.Authentication.Jwt 用于做认证 - 新建一个普通的Api控制器，在需要认证的方法或者类上面加上
[Authorize]标签
[Route("Identity")]
[Authorize("MyApiScope")] //MyApiScope 这个字符串与Startup配置一致
[ApiController]
public class IdentityController : ControllerBase
{
[Authorize]
public IActionResult Get()
{
//用户信息(此时只是为了模拟返回数据，正常开发时：换成访问数据库的代码就行)
return new JsonResult(from c in User.Claims select new {c.Type, c.Value});
}
}
- 修改Startup.cs 类中ConfigureServices 方法代码
public void ConfigureServices(IServiceCollection services)
{
services.AddControllers();
services.AddAuthentication("Bearer").AddJwtBearer("Bearer", p =>
{
//oidc的服务地址(一定要用https!!)
p.Authority = "https://localhost:5000";//也就是IdentifyServer项目运行地址
//设置jwt的验证参数(默认情况下是不需要此验证的)
p.TokenValidationParameters = new TokenValidationParameters
{
ValidateAudience = false
};
});
//注册授权服务
services.AddAuthorization(p =>
{
//添加授权策略
p.AddPolicy("MyApiScope", opt =>
{
//配置鉴定用户的规则，也就是说必须通过身份认证
opt.RequireAuthenticatedUser();
//鉴定api范围的规则
opt.RequireClaim("scope", "simple_api");
});
});
}
- 在Startup.cs 类中的Configure方法添加认证方法，一定要放在
app.UseAuthorization() 前面：
app.UseAuthentication();
- 测试运行：
http://localhost:6000/identity（注意，IdentifyServer 那个项目要最先运行），记得使用Bearer形式调用，也就是在请求头中加上Authorazition：Bearer access_token(注意Bearer后面有个空格)，access_token 在上面已经获取到了
[
{
"type": "nbf",
"value": "1632061080"
},
{
"type": "exp",
"value": "1632064680"
},
{
"type": "iss",
"value": "https://localhost:5000"
},
{
"type": "client_id",
"value": "simple_client"
},
{
"type": "jti",
"value": "BE2D6DCEE4235509666475A049E58DDC"
},
{
"type": "iat",
"value": "1632061080"
},
{
"type": "scope",
"value": "simple_api"
}
]
# 控制台测试客户端（可选）
1. 新建一个控制台应用（实际开发时，使用WebMvc）
2. 引用`IdentityModel`，里面封装了
3. 在Main中编写代码：
//请求客户端（需要先安装IdentityModel）
//由于IdentityModel中大部分都是异步方法，为了方便，我们将Main方法也改成异步方法
//请求客户端（需要先安装IdentityModel）
//由于IdentityModel中大部分都是异步方法，为了方便，我们将Main方法也改成异步方法
static async Task Main(string[] args)
{
var client = new HttpClient();
//获取发现文件，也就是https://localhost:5000/.well-known/openid-configuration 这个地址的结果就是发现文档
var discoveryDocumentAsync = await client.GetDiscoveryDocumentAsync("https://localhost:5000");
if (discoveryDocumentAsync.IsError)
{
Console.WriteLine(discoveryDocumentAsync.Error);
}
//与请求https://localhost:5000/connect/token 这个是一个意思
var tokenResponse = await client.RequestClientCredentialsTokenAsync(
new ClientCredentialsTokenRequest()
{
Address = discoveryDocumentAsync.TokenEndpoint,//获取Token的方法地址（token_endpoint的值）
ClientId = "simple_client", //与Config类中一致
GrantType = OidcConstants.GrantTypes.ClientCredentials,
ClientSecret = "simple_client_secret" //与Config类中一致
}
);
if (tokenResponse.IsError)
{
Console.WriteLine(tokenResponse.Error);
}
// Console.WriteLine(tokenResponse.Json);
//此时已经拿到了accessToken,这时，就可以访问api了
var apiClient = new HttpClient { BaseAddress = new Uri("http://localhost:6000") };
apiClient.SetBearerToken(tokenResponse.AccessToken);//设置访问令牌
var httpResponseMessage = await apiClient.GetAsync("Identity");
var content = await httpResponseMessage.Content.ReadAsStringAsync();
Console.WriteLine(content);
//测试资源拥有者客户端
var resourceTokenResp = await client.RequestPasswordTokenAsync(
new PasswordTokenRequest()
{
Address = discoveryDocumentAsync.TokenEndpoint,//获取Token的方法地址（token_endpoint的值）
ClientId = "simple_pass_client", //与Config类中一致
GrantType = OidcConstants.GrantTypes.Password,
ClientSecret = "simple_client_secret", //与Config类中一致
UserName = "admin",
Password = "123"
}
);
var apiPassClient = new HttpClient { BaseAddress = new Uri("http://localhost:6000") };
apiPassClient.SetBearerToken(resourceTokenResp.AccessToken);//设置访问令牌
var httpPassResponseMessage = await apiPassClient.GetAsync("Identity");
var contentPass = await httpPassResponseMessage.Content.ReadAsStringAsync();
Console.WriteLine(contentPass);
Console.ReadKey();
}
添加IdentifyServer项目UI
- 在IdentifyServer下添加（github项目地址：）IdentityServer4.Quickstart.UI
- 安装方式：
在IdentityServer4项目下，打开cmd，执行如下命令
- 第一步：
dotnet new -i IdentityServer4.Templates::4.0.1 ，4.0.1是版本号，如果不写则使用默认，这个取决于你安装的IdentifyServer4的版本 - 第二步：
dotnet new is4ui - 执行结果如下：
F:\workspace\code\练习\IdentifyServer4\Web.Client\IdentityServer>dotnet new -i IdentityServer4.Templates::4.0.1
正在确定要还原的项目…
已还原 C:\Users\Administrator\.templateengine\dotnetcli\v5.0.201\scratch\restore.csproj (用时 9.67 sec)。
Templates Short Name Language Tags
---------------------------------------------------- ------------------- ---------- ----------------------
Console Application console [C#],F#,VB Common/Console
Class library classlib [C#],F#,VB Common/Library
WPF Application wpf [C#],VB Common/WPF
WPF Class library wpflib [C#],VB Common/WPF
WPF Custom Control Library wpfcustomcontrollib [C#],VB Common/WPF
WPF User Control Library wpfusercontrollib [C#],VB Common/WPF
Windows Forms App winforms [C#],VB Common/WinForms
Windows Forms Control Library winformscontrollib [C#],VB Common/WinForms
Windows Forms Class Library winformslib [C#],VB Common/WinForms
Worker Service worker [C#],F# Common/Worker/Web
Unit Test Project mstest [C#],F#,VB Test/MSTest
NUnit 3 Test Project nunit [C#],F#,VB Test/NUnit
NUnit 3 Test Item nunit-test [C#],F#,VB Test/NUnit
xUnit Test Project xunit [C#],F#,VB Test/xUnit
Razor Component razorcomponent [C#] Web/ASP.NET
Razor Page page [C#] Web/ASP.NET
MVC ViewImports viewimports [C#] Web/ASP.NET
MVC ViewStart viewstart [C#] Web/ASP.NET
Blazor Server App blazorserver [C#] Web/Blazor
Blazor WebAssembly App blazorwasm [C#] Web/Blazor/WebAssembly
ASP.NET Core Empty web [C#],F# Web/Empty
IdentityServer4 with AdminUI is4admin [C#] Web/IdentityServer4
IdentityServer4 with ASP.NET Core Identity is4aspid [C#] Web/IdentityServer4
IdentityServer4 Empty is4empty [C#] Web/IdentityServer4
IdentityServer4 with Entity Framework Stores is4ef [C#] Web/IdentityServer4
IdentityServer4 with In-Memory Stores and Test Users is4inmem [C#] Web/IdentityServer4
IdentityServer4 Quickstart UI (UI assets only) is4ui [C#] Web/IdentityServer4
ASP.NET Core Web App (Model-View-Controller) mvc [C#],F# Web/MVC
ASP.NET Core Web App webapp [C#] Web/MVC/Razor Pages
ASP.NET Core with Angular angular [C#] Web/MVC/SPA
ASP.NET Core with React.js react [C#] Web/MVC/SPA
ASP.NET Core with React.js and Redux reactredux [C#] Web/MVC/SPA
Razor Class Library razorclasslib [C#] Web/Razor/Library
ASP.NET Core Web API webapi [C#],F# Web/WebAPI
ASP.NET Core gRPC Service grpc [C#] Web/gRPC
dotnet gitignore file gitignore Config
global.json file globaljson Config
NuGet Config nugetconfig Config
Dotnet local tool manifest file tool-manifest Config
Web Config webconfig Config
Solution File sln Solution
Protocol Buffer File proto Web/gRPC
Examples:
dotnet new mvc --auth Individual
dotnet new nunit -f net472
dotnet new --help
dotnet new is4admin --help
F:\workspace\code\练习\IdentifyServer4\Web.Client\IdentityServer>dotnet new is4ui
The template "IdentityServer4 Quickstart UI (UI assets only)" was created successfully.
F:\workspace\code\练习\IdentifyServer4\Web.Client\IdentityServer>
此时，你回到vs中，可以看到IdentityServer项目中会多出wwwroot,QuickStart,Views 这几个文件夹，表示成功了！！
友情提示：如果dotnet new -i IdentityServer4.Templates::4.0.1 命令如果已经执行过了，下次就不需要重新执行了，只需要执行dotnet new is4ui 命令即可!!!
- 在Configure 方法中注册路由与授权
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
app.UseStaticFiles();
app.UseRouting();
app.UseIdentityServer();
app.UseAuthorization();
app.UseEndpoints(endpoint =>
{
endpoint.MapDefaultControllerRoute();
});
}
创建Mvc客户端（你的正文或者说你的系统）
这个客户端，其实就是你要做的系统。
- 创建项目Identity.MvcClient 项目（这个名字你随便写）
- 引用
Microsoft.AspNetCore.Authentication.OpenIdConnect - 在你需要受保护的控制器或者视图上添加
[Authorize]标签 - 在startup.cs 类中
ConfigureServices 方法中添加oidc（OpenId Connect） 认证
public void ConfigureServices(IServiceCollection services)
{
services.AddControllersWithViews();
JwtSecurityTokenHandler.DefaultMapInboundClaims = false;
services.AddAuthentication(p =>
{
p.DefaultScheme = "Cookies";
p.DefaultChallengeScheme = "oidc";
})
.AddCookie("Cookies")
.AddOpenIdConnect("oidc", p =>
{
p.Authority = "https://localhost:5000";//IdentityServer 项目的运行地址，一定要用Https
p.ClientId = "simple_mvc_client";
p.ClientSecret = "simple_client_secret";
p.ResponseType = "code";//使用授权码形式
p.SaveTokens = true; //把令牌保存在cookie里
p.Scope.Add("simple_api");//验证令牌中，是否包含simple_api
});
}
- 在 Configure方法添加认证中间件，注意：必须放在
app.UseAuthorization()前面
app.UseAuthentication();
- 运行IdentityServer项目与Mvc项目，此时，如果访问受保护的资源时，则到自动跳转至IdentityServer项目登录页面,登录成功之后，会立即返回刚刚你所访问的受保护的资源页面，配置成功！！
- 实现退出登录。随意在一个控制器中创建一个方法，表示退出登录
//实现退出页面
public IActionResult Logout()
{
//清除Cookies,与oidc信息
return SignOut("Cookies", "oidc");
}
配置EF Core
- 在IdentityServer 项目中添加引用：
IdentityServer4.EntityFrameworkIdentityServer4.EntityFramework implements the required stores and services using the following DbContexts:
- ConfigurationDbContext - used for configuration data such as clients, resources, and scopes
- PersistedGrantDbContext - used for temporary operational data such as authorization codes, and refresh tokens
- 在IdentityServer 项目中添加引用：
Microsoft.EntityFrameworkCore.SqlServer - Startup.cs 中配置：
var migrationsAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name;
const string connectionString = @"server=.;uid=sa;pwd=123456;database=ids4_oauth;trusted_connection=yes;";
services.AddIdentityServer()
.AddConfigurationStore(options =>
{
options.ConfigureDbContext = b => b.UseSqlServer(connectionString,
sql => sql.MigrationsAssembly(migrationsAssembly));
})
.AddOperationalStore(options =>
{
options.ConfigureDbContext = b => b.UseSqlServer(connectionString,
sql => sql.MigrationsAssembly(migrationsAssembly));
});
- 安装install the Entity Framework Core CLI 环境
dotnet tool install --global dotnet-ef --version 3.1.19
引用包：Microsoft.EntityFrameworkCore.Design
- 在IdentifyServer项目文件夹中，打开命令行工具，执行数据迁移命令
dotnet ef migrations add InitialIdentityServerPersistedGrantDbMigration -c PersistedGrantDbContext -o Data/Migrations/IdentityServer/PersistedGrantDb
dotnet ef migrations add InitialIdentityServerConfigurationDbMigration -c ConfigurationDbContext -o Data/Migrations/IdentityServer/ConfigurationDb
dotnet ef migrations add InitialApplicationDbMigration -c ApplicationDbContext -o Data/Migrations/IdentityServer/ApplicationDb
或者
在程序包管理控制台：
add-migration InitApplicationDbMigration -c ApplicationDbContext
update-database InitApplicationDbMigration -c ApplicationDbContext
此时在~/Data/Migrations/IdentityServer下就会有你新创建的代码了
6.在Startup.cs 类中，初始化数据库，
public void Configure(IApplicationBuilder app)
{
// this will do the initial DB population
InitializeDatabase(app);
// the rest of the code that was already here
// ...
}
private void InitializeDatabase(IApplicationBuilder app)
{
using (var serviceScope = app.ApplicationServices.GetService<IServiceScopeFactory>().CreateScope())
{
serviceScope.ServiceProvider.GetRequiredService<PersistedGrantDbContext>().Database.Migrate();
var context = serviceScope.ServiceProvider.GetRequiredService<ConfigurationDbContext>();
context.Database.Migrate();
if (!context.Clients.Any())
{
foreach (var client in Config.Clients)
{
context.Clients.Add(client.ToEntity());
}
context.SaveChanges();
}
if (!context.IdentityResources.Any())
{
foreach (var resource in Config.IdentityResources)
{
context.IdentityResources.Add(resource.ToEntity());
}
context.SaveChanges();
}
if (!context.ApiScopes.Any())
{
foreach (var resource in Config.ApiScopes)
{
context.ApiScopes.Add(resource.ToEntity());
}
context.SaveChanges();
}
}
}
安装IdentityServer4 证书
- 安装OpenSSL工具 ，官网下载地址：https://slproweb.com/products/Win32OpenSSL.html
- 在CMD中执行以下命令
openssl req -newkey rsa:2048 -nodes -keyout cas.clientservice.key -x509 -days 365 -out cas.clientservice.cer
