如何刷新访问令牌

Question

我有一个Asp.net 2.0核心Web应用程序,它连接到Identity Server 4应用程序进行身份验证.还涉及API.API使用访问令牌作为承载令牌.

我的创业:

services.AddAuthentication(options =>
            {
                options.DefaultScheme = "Cookies";
                options.DefaultChallengeScheme = "oidc";
            })
            .AddCookie("Cookies")
            .AddOpenIdConnect("oidc", options =>
            {
                options.SignInScheme = "Cookies";
                options.Authority = idsEndPoint;
                options.RequireHttpsMetadata = false;
                options.ClientId = "testclient";
                options.ClientSecret = "secret";
                options.ResponseType = "code id_token";
                options.SaveTokens = true;
                options.GetClaimsFromUserInfoEndpoint = true;
                options.Scope.Add("testapi");
            });

控制器:

在我的控制器中,我可以看到我的令牌,它们都已填充,我可以在API调用中使用访问令牌.

var accessToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.AccessToken);
var refreshToken = await HttpContext.GetTokenAsync(IdentityConstants.HttpContextHeaders.RefreshToken);
var idToken = await HttpContext.GetTokenAsync(OpenIdConnectParameterNames.IdToken);

题:

我的问题发生在访问令牌到期一小时后.它似乎不会自动刷新.我想知道这是否是我的身份验证中的设置,将导致它刷新它.但是我一直无法知道如何在访问令牌过期后强制它刷新访问令牌.

我目前的解决方案是自己刷新它,但我认为这将内置于cookie中间件.

Answer 1

该方法使用OpenIddict，您需要在startup.cs中实现主要配置。下一个链接是此实现的一个很好的示例。希望有用
https://github.com/openiddict/openiddict-samples/tree/dev/samples/RefreshFlow

     if (request.IsPasswordGrantType())
        {

            if (!Email_Regex_Validation.Check_Valid_Email_Regex(request.Username))
            {
                return BadRequest(Resources.RegexEmail);
            }

            SpLoginUser stored = new SpLoginUser(_context);

            string result = stored.Usp_Login_User(request.Username, request.Password);

            if (!result.Contains("successfully"))
            {
                return Forbid(OpenIddictServerDefaults.AuthenticationScheme);
            }

            // Create a new ClaimsIdentity holding the user identity.
            var identity = new ClaimsIdentity(
                OpenIddictServerDefaults.AuthenticationScheme,
                OpenIdConnectConstants.Claims.Name,
                OpenIdConnectConstants.Claims.Role);


            identity.AddClaim(Resources.issuer, Resources.secret,
                OpenIdConnectConstants.Destinations.IdentityToken);
            identity.AddClaim(OpenIdConnectConstants.Claims.Name, request.Username,
                OpenIdConnectConstants.Destinations.IdentityToken);


            var ticket = new AuthenticationTicket(new ClaimsPrincipal(identity), new AuthenticationProperties(), OpenIdConnectServerDefaults.AuthenticationScheme);
            ticket.SetScopes(OpenIdConnectConstants.Scopes.OfflineAccess);

            // Ask OpenIddict to generate a new token and return an OAuth2 token response.
            return SignIn(ticket.Principal, ticket.Properties, ticket.AuthenticationScheme);

        }