c# - 如何从ASP.Net OpenID Connect OWIN组件设置声明？

我在使用新的ASP.Net OpenID Connect框架时遇到疑问，同时在身份验证管道中添加新的Claims，如下面的代码所示。我不确定幕后到底发生了多少“魔术”。我认为我的大部分问题都集中在对OWIN身份验证中间件(相对于OpenID Connect)了解不多。

Q1。我应该手动从HttpContext.Current.User设置Thread.CurrentPrincipal和OwinContext.Authentication.User吗？

Q2。我希望能够像以前使用System.IdentityModel.Claims.Claim一样将对象类型添加到声明中。新的System.Security.Claims.Claim类仅接受字符串值？

Q3。我是否需要为SessionSecurityToken中的ClaimsPrincipal使用新的System.Security.Claims.CurrentPrincipal包装器将其序列化为cookie-我正在使用app.UseCookieAuthentication(new CookieAuthenticationOptions());，但现在确定在维护我在SecurityTokenValidated事件期间添加的任何其他声明方面到底有什么用？

    public void ConfigureAuth(IAppBuilder app)
    {
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
        app.UseCookieAuthentication(new CookieAuthenticationOptions());
        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = clientId,
                Authority = authority,
                PostLogoutRedirectUri = postLogoutRedirectUri,

                Notifications = new OpenIdConnectAuthenticationNotifications()
                {
                    SecurityTokenValidated = (context) =>
                    {
                        // retriever caller data from the incoming principal
                        var UPN = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.Name).Value;
                        var db = new SOSBIADPEntities();

                        var user = db.DomainUser.FirstOrDefault(b => (b.EntityName == UPN));

                        if (user == null)
                        {
                            // the caller was not a registered user - throw to block the authentication flow
                            throw new SecurityTokenValidationException();
                        }

                        var applicationUserIdentity = new ClaimsIdentity();
                        applicationUserIdentity.AddClaim(new Claim(ClaimTypes.Name, UPN, ""));
                        applicationUserIdentity.AddClaim(new Claim(ClaimTypes.Sid, user.ID.ToString(CultureInfo.InvariantCulture)));


                        var applications =
                            db.ApplicationUser
                            .Where(x => x.ApplicationChild != null && x.DomainUser.ID == user.ID)
                            .Select(x => x.ApplicationChild).OrderBy(x => x.SortOrder);

                        applications.ForEach(x =>
                            applicationUserIdentity.AddClaim(new Claim(ClaimTypes.System, x.ID.ToString(CultureInfo.InvariantCulture))));

                        context.OwinContext.Authentication.User.AddIdentity(applicationUserIdentity);

                        var hasOutlook = context.OwinContext.Authentication.User.HasClaim(ClaimTypes.System, "1");

                        hasOutlook = hasOutlook;

                        HttpContext.Current.User = context.OwinContext.Authentication.User;
                        Thread.CurrentPrincipal = context.OwinContext.Authentication.User;

                        var usr = HttpContext.Current.User;

                        var c =  System.Security.Claims.ClaimsPrincipal.Current.Claims.Count();


                        return Task.FromResult(0);
                    },
                }
            }
        );
    }

最佳答案

您要添加新的ClaimsIdentity的原因是否具体？

实现目标的最简单方法是，一旦获得 token ，就通过ClaimsIdentity检索通过验证传入 token 而生成的ClaimsIdentity claimsId = context.AuthenticationTicket.Identity;，只需对其添加声明即可。其余中间件将负责将其与其他所有内容一起在 session cookie中进行序列化，并将结果放入当前的ClaimsPrincipal以及您似乎试图手动进行的所有其他操作。
高温超导
V.

关于c# - 如何从ASP.Net OpenID Connect OWIN组件设置声明？，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/27196931/