ASP.NET Core 3.0 中获取当前经过身份验证的用户名的方法是什么？

Question

我正在研究最新的 ASP.NET Core 3.0 Angular 模板。我需要知道的是我们如何在ActionFilterAttribute.

该ClaimTypes.NameIdentifier返回当前用户ID，ClaimTypes.Name返回的用户名是空。

这是我的代码：

其中getUser有一个UserId的d15f997a-6f65-4eb2-aecb-8b525361ae50

我还在 Startup 类中注册了 IHttpContextAccessor，如下所示：

public IServiceProvider ConfigureServices(IServiceCollection services)
{
        services.AddDbContext<ApplicationDbContext>(options =>
            options.UseSqlServer(
                Configuration.GetConnectionString("DefaultConnection")));

        services.AddDefaultIdentity<ApplicationUser>()
            .AddEntityFrameworkStores<ApplicationDbContext>();

        services.AddIdentityServer()
            .AddApiAuthorization<ApplicationUser, ApplicationDbContext>();

        services.AddAuthentication()
            .AddIdentityServerJwt();

        //Database Setup
        services.AddDbContext<HashooDBContext>(Configuration.GetConnectionString("DefaultConnection"));

        services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>();

        services.AddControllersWithViews();
        services.AddRazorPages();
        // In production, the Angular files will be served from this directory
        services.AddSpaStaticFiles(configuration =>
        {
            configuration.RootPath = "ClientApp/dist";
        });

        return ContainerSetup.InitializeWeb(Assembly.GetExecutingAssembly(), services);
}

控制器.cs：

[Authorize]
[ApiController]
[Route("api/[controller]/{companycode}")]
public class DashboardTransactionsController : ControllerBase
{
    [CustomAuthorizationFilter("companycode")]
    public string Get()
    {
        return "Welcome";
    }
}

请让我知道我做错了什么？

Answer 1

对于这个问题，是由于IdentityServer4没有添加JwtClaimTypes.Nameaccess_token导致的。如果你从浏览器检查access_token，你会发现它丢失了"name": "Tom",节点。

对于解决方法，您可以实现自己的ITokenService类似

public class CustomTokenService : DefaultTokenService
{
    public CustomTokenService(IClaimsService claimsProvider
        , IReferenceTokenStore referenceTokenStore
        , ITokenCreationService creationService
        , IHttpContextAccessor contextAccessor
        , ISystemClock clock
        , IKeyMaterialService keyMaterialService
        , ILogger<DefaultTokenService> logger) 
        : base(claimsProvider, referenceTokenStore, creationService, contextAccessor, clock, keyMaterialService, logger)
    {
    }

    public override async Task<Token> CreateAccessTokenAsync(TokenCreationRequest request)
    {

        Logger.LogTrace("Creating access token");
        request.Validate();

        var claims = new List<Claim>();
        claims.AddRange(await ClaimsProvider.GetAccessTokenClaimsAsync(
            request.Subject,
            request.Resources,
            request.ValidatedRequest));

        if (request.ValidatedRequest.Client.IncludeJwtId)
        {
            claims.Add(new Claim(JwtClaimTypes.JwtId, CryptoRandom.CreateUniqueId(16)));
        }
        claims.Add(new Claim(JwtClaimTypes.Name, request.Subject.GetDisplayName()));
        var issuer = Context.HttpContext.GetIdentityServerIssuerUri();
        var token = new Token(OidcConstants.TokenTypes.AccessToken)
        {
            CreationTime = Clock.UtcNow.UtcDateTime,
            Issuer = issuer,
            Lifetime = request.ValidatedRequest.AccessTokenLifetime,
            Claims = claims.Distinct(new ClaimComparer()).ToList(),
            ClientId = request.ValidatedRequest.Client.ClientId,
            AccessTokenType = request.ValidatedRequest.AccessTokenType
        };

        foreach (var api in request.Resources.ApiResources)
        {
            if (!string.IsNullOrWhiteSpace(api.Name))
            {
                token.Audiences.Add(api.Name);
            }
        }

        return token;
    }
}

然后CustomTokenService在身份配置之前注册

    public void ConfigureServices(IServiceCollection services)
    {
        services.TryAddTransient<ITokenService, CustomTokenService>();

        services.AddDbContext<ApplicationDbContext>(options =>
            options.UseSqlServer(
                Configuration.GetConnectionString("DefaultConnection")));

        services.AddDefaultIdentity<ApplicationUser>()
            .AddEntityFrameworkStores<ApplicationDbContext>();

        services.AddIdentityServer()
            .AddApiAuthorization<ApplicationUser, ApplicationDbContext>();

        services.AddAuthentication()
            .AddIdentityServerJwt();

    }

对于一个简单的方法，您可以尝试覆盖DefaultClaimsService.GetStandardSubjectClaims像

public class CustomClaimsService : DefaultClaimsService
{
    public CustomClaimsService(IProfileService profile
        , ILogger<DefaultClaimsService> logger) : base(profile, logger)
    {
    }
    protected override IEnumerable<Claim> GetStandardSubjectClaims(ClaimsPrincipal subject)
    {
        var claims = base.GetStandardSubjectClaims(subject);
        var newClaims = new List<Claim>(claims)
        {
            new Claim(JwtClaimTypes.Name, subject.Identity.Name)
        };
        return newClaims;
    }
}

并注册像

    public void ConfigureServices(IServiceCollection services)
    {
        services.TryAddTransient<IClaimsService, CustomClaimsService>();

        //services.TryAddTransient<ITokenService, CustomTokenService>();

        services.AddDbContext<ApplicationDbContext>(options =>
            options.UseSqlServer(
                Configuration.GetConnectionString("DefaultConnection")));

        services.AddDefaultIdentity<ApplicationUser>()
            .AddEntityFrameworkStores<ApplicationDbContext>();

        services.AddIdentityServer()
            .AddApiAuthorization<ApplicationUser, ApplicationDbContext>();

        services.AddAuthentication()
            .AddIdentityServerJwt();

    }