'sub'声明是openid范围或配置文件范围的一部分吗？

Question

根据OpenID Connect规范,sub声明是openid范围或profile范围的一部分？我找不到那些信息

Update1
我使用IdentityServer3进行身份验证.客户端正在向服务器发出请求,如下所示.作为回应,我没有sub按照Open ID Connect规范获得所需的声明.然而响应确实包括http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier具有作为相同的值sub是对nameidentifier相同sub要求.

这是客户要求

    public void Configuration(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = "Cookies"
        });

        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
        {
            Authority = "https://localhost:44314/identity",
            Scope = "openid",
            ClientId = "LocalHostMvcClient",
            RedirectUri = "http://localhost:34937/",
            ResponseType = "id_token",
            SignInAsAuthenticationType = "Cookies",
        }
   }

id_token响应

根据以下评论更新2我更新了客户端的启动文件

    private void TurnOffMicrosoftJWTMapping()
    {
        //The long claim names come from Microsoft’s JWT handler trying to map some claim types to .NET’s ClaimTypes class types. 
        //We can turn off this behavior with the following line of code (in Startup).
        //This also means that we need to adjust the configuration for anti-CSRF protection to the new unique sub claim type:
        AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.Subject;
        JwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, string>();
    }

然后在客户端的启动中调用此方法

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        TurnOffMicrosoftJWTMapping();

        //configure OpenIDConnect request here
    }
}

Answer 1

sub是id_token的必需声明 - 而openid范围是发出OpenID Connect身份验证请求所需的最小范围.您可以将openid与其他范围混合使用 - 但必须存在openid.

那是他们的关系.

IdentityServer根据以下内容发出标准声明类型(例如sub):

https://openid.net/specs/openid-connect-core-1_0.html#StandardClaims

它是Microsoft JWT处理程序,将这些标准声明转换为Microsoft专有声明.您可以通过以下方式关闭此烦人行为:

JwtSecurityTokenHandler.InboundClaimTypeMap.Clear()