Web API使用记录系列（四）OAuth授权与身份校验

 1 public partial class StartUp
 2     {
 3         /// 

 4         /// OAuth配置
 5         /// 
 6         /// 
 7         public void ConfigureAuth(IAppBuilder app)
 8         {
 9             app.UseOAuthBearerTokens(new OAuthAuthorizationServerOptions
10             {
11                 AllowInsecureHttp = true,
12                 TokenEndpointPath = new PathString("/api/token"),//授权地址
13                 AccessTokenExpireTimeSpan = TimeSpan.FromHours(24), //过期时间
14                 AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Active,
15                 Provider = new SampleAuthorizationServerProvider() //授权服务
16             });
17         }
18     }

 1 /// 

 2     /// 授权服务
 3     /// 
 4     public class SampleAuthorizationServerProvider : OAuthAuthorizationServerProvider
 5     {
 6         #region 客户端授权
 7         /// 

 8         /// 客户端验证
 9         /// 
10         /// 
11         /// 
12         public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
13         {
14             string clientId = "";
15             string clientSecret = "";
16             //获取传入的客户端id和客户端校验码
17             context.TryGetFormCredentials(out clientId, out clientSecret);
18             if (clientId == "发放的客户端id" && clientSecret == "发放的客户端校验码")
19             {
20                 context.Validated(clientId);
21             }
22             else
23             {
24                 context.SetError("invalid_client", "client is not valid");
25             }
26             return base.ValidateClientAuthentication(context);
27         }
28 
29         /// 

30         /// 客户端授权-生成access token
31         /// 
32         /// 
33         /// 
34         public override Task GrantClientCredentials(OAuthGrantClientCredentialsContext context)
35         {
36             var oAuthIdentity = new ClaimsIdentity(context.Options.AuthenticationType);
37             oAuthIdentity.AddClaim(new Claim(ClaimTypes.Name, "app"));//可以继续加一些其它信息
38             var ticket = new AuthenticationTicket(oAuthIdentity, new AuthenticationProperties() { AllowRefresh = false });
39             context.Validated(ticket);
40             return base.GrantClientCredentials(context);
41         }
42         #endregion
43         
44         #region 用户名密码授权
45         public override Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
46         {
47             if (context.UserName == "用户名" && context.Password == "用户密码")
48             {
49                 var props = new AuthenticationProperties(new Dictionarystring, string>
50                 {
51                     {
52                         "userName", context.UserName
53                     }
54                 });
55                 var identity = new ClaimsIdentity("userinfo");
56                 identity.AddClaim(new Claim("DisplayName", "张三"));
57                 identity.AddClaim(new Claim("DutyName", "总监"));
58 
59                 var ticket = new AuthenticationTicket(identity, props);
60 
61                 context.Validated(ticket);
62             }
63             else
64             {
65                 context.SetError("invalid_user", "username or password error");
66             }
67             return base.GrantResourceOwnerCredentials(context);
68         }
69         #endregion
70 
71     }

 1           $.ajax({
 2                 url: ‘/api/token‘,
 3                 type: ‘post‘,
 4                 data: {
 5                     "grant_type": "client_credentials",
 6                     "client_id": $("#clientid").val(),
 7                     "client_secret": $("#clientscuret").val()
 8                 },
 9                 dataType: "json",
10                 success: function (data) {
11                     var accessToken = data.access_token;
12                     console.log("获取到的token："+accessToken);
13                 }
14             });    

 1 public class CustomAuthorizeAttribute:AuthorizeAttribute
 2     {
 3         protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
 4         {
 5             base.HandleUnauthorizedRequest(actionContext);
 6             actionContext.Response = new HttpResponseMessage(System.Net.HttpStatusCode.OK)
 7             {
 8                 Content = new StringContent("项目返回的数据格式数据")
 9             };
10         }
11     }