在Web Api中使用邮递员授权进行属性身份验证

Question

我正在使用RESTful服务,并发现Postman是GET,POST和测试API的最佳插件之一.

我在邮递员中找到了Basic Auth,No Auth,DIgest Auth,OAuth,AWS.如何测试授权控制器和方法.

我知道授权属性检查 user.Identity.IsAuthenticated

我不确定如何使用Postman在具有特定角色的控制器和方法中传递授权

[Authorize(Roles = "Admin, Super User")]

public ActionResult AdministratorsOnly()
{
    return View();
}

这是我的启动文件

  public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }

    public static string PublicClientId { get; private set; }

    // For more information on configuring authentication, please visit http://go.microsoft.com/fwlink/?LinkId=301864
    public void ConfigureAuth(IAppBuilder app)
    {
        // Configure the db context and user manager to use a single instance per request
        app.CreatePerOwinContext(ApplicationDbContext.Create);
        app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);

        // Enable the application to use a cookie to store information for the signed in user
        // and to use a cookie to temporarily store information about a user logging in with a third party login provider
        app.UseCookieAuthentication(new CookieAuthenticationOptions());
        app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

        // Configure the application for OAuth based flow
        PublicClientId = "self";
        OAuthOptions = new OAuthAuthorizationServerOptions
        {
            TokenEndpointPath = new PathString("/Token"),
            Provider = new ApplicationOAuthProvider(PublicClientId),
            AuthorizeEndpointPath = new PathString("/api/Account/ExternalLogin"),
            AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
            // In production mode set AllowInsecureHttp = false
            AllowInsecureHttp = true
        };

        // Enable the application to use bearer tokens to authenticate users
        app.UseOAuthBearerTokens(OAuthOptions);         
    }

Answer 1

1.在web api中启用CORS

在Startup.cs配置方法中将以下内容附加到IAppBuilder(如果遇到问题,请在此处阅读更多内容如何在WebAPI 2中进行CORS身份验证？)

app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);

Nuget包在这里

2.通过邮递员获取令牌

3.使用令牌并从Web api获取数据

注意:令牌响应包含access_token,它是令牌,token_type是承载.在请求中使用时,在Authorization http标头的值之间添加一个空格.auth服务器将解析令牌并在请求到达请求的控制器中的[Authorize]属性之前设置user.Identity

此外,请确保ApplicationOAuthProvider将包含当前角色的声明身份添加到令牌.否则请求将被拒绝.测试它的一种方法是只使用没有角色的[Authorize]属性,然后查看postman是否可以访问控制器