从数据存储实现动态OAuthBearerServerOptions AccessTokenExpireTimeSpan值

Question

这篇文章的上下文涉及ASP.NET Web API 2.2 + OWIN环境是一个同时具有OWIN服务器和Web Api的应用程序.

背景:

在启动类,必须指定OAuthBearerServerOptions其提供给OAuthBearerAuthenticationProvider.这些选项是在OWIN服务器启动期间创建的.在OAuthBearerServerOptions上,我必须指定AccessTokenExpireTimeSpan,以便我可以确保令牌过期.

问题

我必须能够基于每个身份验证请求动态指定过期时间跨度.我不确定这是否可以做到并且在想:

• 可以吗？
• 如是; 在哪一点上我可以执行此查找并分配到期日期？

启动配置内容:

    var config = new HttpConfiguration();

    WebApiConfig.Register(config);


    var container = builder.Build();
    config.DependencyResolver = new AutofacWebApiDependencyResolver(container);

    var OAuthServerOptions = new OAuthAuthorizationServerOptions()
    {
        AllowInsecureHttp = true,
        TokenEndpointPath = new PathString("/OAuth"),
        AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(**THIS NEEDS TO BE DYNAMIC**)),
        Provider = new AuthorizationServerProvider()
    };

    //STOP!!!!!!!!
    //DO NOT CHANGE THE ORDER OF THE BELOW app.Use statements!!!!!

    //Token Generation 
    app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll); //this MUST come before oauth registration
    app.UseOAuthAuthorizationServer(OAuthServerOptions);
    app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions()
    {
        Provider = new BearerProvider()
    });
    app.UseAutofacMiddleware(container); //this MUST come before UseAutofacWebApi
    app.UseAutofacWebApi(config);//this MUST come before app.UseWebApi
    app.UseWebApi(config);

我开始搞乱BearerProvider类(请参阅上面的app.UseOAuthBearerAuthentication以了解我使用此类的位置)以及具体的ValidateIdentity方法,但不确定这是否是auth工作流中设置此值的正确点.这似乎是合适的,但我寻求验证我的立场.

public class BearerProvider : OAuthBearerAuthenticationProvider
{
    public override async Task RequestToken(OAuthRequestTokenContext context)
    {
        await base.RequestToken(context);

        //No token? attempt to retrieve from query string
        if (String.IsNullOrEmpty(context.Token))
        {
            context.Token = context.Request.Query.Get("access_token");

        }
    }
    public override Task ValidateIdentity(OAuthValidateIdentityContext context)
    {
        //context.Ticket.Properties.ExpiresUtc= //SOME DB CALL TO FIND OUT EXPIRE VALUE..IS THIS PROPER?
        return base.ValidateIdentity(context);
    }
}

提前致谢!

Answer 1

设置context.Options.AccessTokenExpireTimeSpan实际上将更改全局值,并影响所有不适用于原始需求的请求.

正确的位置是TokenEndpoint方法.

public override Task TokenEndpoint(OAuthTokenEndpointContext context)
{
    ...

    if (someCondition)
    {
        context.Properties.ExpiresUtc = GetExpirationDateFromDB();
    }

    ...
}