IdentityServer4:为Client_Credential Granttype添加自定义默认声明到客户端主体

Question

我正在使用IdentityServer4,我正在尝试在CLIENT创建令牌时向我添加自定义默认声明.如果我使用隐式流程,这是可能的,IProfileService如下所示.

public class MyProfileService : IProfileService
{
    public MyProfileService()
    {

    }
    public Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        var claims = new List<Claim>
        {
            new Claim("DemoClaimType", "DemoClaimValue")
        };
        context.IssuedClaims = claims;
        return Task.FromResult(0);
    }
    public Task IsActiveAsync(IsActiveContext context)
    {
        context.IsActive = true;
        return Task.FromResult(0);
    }
}

在我的创业公司

services.AddIdentityServer()
            .AddProfileService<MyProfileService>()

但是,这似乎与我的client_credential granttype客户端无关cannot request OpenID scopes in client credentials flow.事实证明,像名称暗示的Iprofileservice适用于Identity资源,其中OpenId范围如profile是有效的.因为我无法请求具有client_credential授权类型的配置文件范围GetProfileDataAsync永远不会被调用.

由于我只与客户合作而没有用户,我需要一种方法将声明注入令牌,而不必将它们添加到客户端对象,如下所示

    new Client
{
    ClientId = "myclient",
    ClientName = "My Client",
    AllowedGrantTypes = GrantTypes.ClientCredentials,
    ClientSecrets = {new Secret("secret".Sha256())},
    AllowedScopes = new List<string> {"api"},                    
    AllowOfflineAccess = true,

    //I Don't want to do this
    Claims = new List<Claim>
    {   
        new Claim("type","value")
    }
}

我不想要上述内容,因为我不希望声明成为数据库中client_claims的一部分.我需要在令牌请求时动态创建它.我希望我的问题现在更清楚了.

Answer 1

通过一些询问,我终于找到了如何做到这一点.我需要一种方法在请求令牌时动态地向客户端添加声明.

为了做到这一点,我必须扩展ICustomTokenRequestValidator,然后在Startup.cs彻底依赖注入中包含我的类

public class DefaultClientClaimsAdder : ICustomTokenRequestValidator
{
    public Task ValidateAsync(CustomTokenRequestValidationContext context)
    {
        context.Result.ValidatedRequest.Client.AlwaysSendClientClaims = true;
        context.Result.ValidatedRequest.ClientClaims.Add(new Claim("testtoken","testbody"))

        return Task.FromResult(0);
    }
}

在Startup.cs中配置服务

 services.AddTransient<ICustomTokenRequestValidator, DefaultClientClaimsAdder>();