使用ASP.NET Web API 2和Owin的基于令牌的身份验证会抛出401未经授权

问题描述

我已使用 Taiseer Joudeh .我创建了一个端点/令牌来进行身份验证.它有效，并且我收到这样的结果.

I have create a OAuth Authentication using the guide from Taiseer Joudeh. I have created an endpoint /token to make the authentication. It works and I receive a result like this.

{
  "access_token": "dhBvPjsHUoIs6k8NDsXfROpTq63qlww_7Bifl0LOzIxhZnngld0QCU-x4q4Qa7xWhhIQeQbbK6gYu_hLIYfUbsFMsdXwqlOqAYabJHNNsnJPMMHNADb-KCQznPQy7-waaqKMCVH1HPqx4L30sXlX0L8MbjtrtkX9-jxHaWdPapqYA9lU4Ai2-Z5-zXxoriFDL-SvxrUnBTDQMnRxOH_oEyclUngzW-is543TtJ0bysQ",
  "token_type": "bearer",
  "expires_in": 86399
}

但是，如果我在下一次调用具有AuthorizeAttribute的enpoint的标头中使用访问令牌，则我总是会收到未经授权的错误.同样，如果我查看当前线程的CurrentPrincipal中的内容，则它始终是GenericPrincipal.

But if I use the access token in my header of the next call of a enpoint that has the AuthorizeAttribute I alwayse recive a Unauthorized error. Also if I take a look in what is in the CurrentPrincipal of the current Thread it's always a GenericPrincipal.

我的Startup类看起来像这样(看起来与指南中的类似)

My Startup class looks like this (looks similar to that in the guide)

public class Startup
    {
        public void Configuration(IAppBuilder app)
        {

            HttpConfiguration config = new HttpConfiguration();
            IContainer container = AutoFacConfig.Register(config, app);

            ConfigureOAuth(app, container);

            WebApiConfig.Register(config);
            AutoMapperConfig.Register();

            app.UseWebApi(config);
        }
        public void ConfigureOAuth(IAppBuilder app, IContainer container)
        {
            OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
            {
                AllowInsecureHttp = true,
                TokenEndpointPath = new PathString("/token"),
                AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                Provider = container.Resolve<IOAuthAuthorizationServerProvider>()
            };

            // Token Generation
            app.UseOAuthAuthorizationServer(OAuthServerOptions);
            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

        }

    }

OauthServiceprovider是这样的:

And the OauthServiceprovider is like this:

public class SimpleAuthorizationServerProvider : OAuthAuthorizationServerProvider
    {
        private readonly IUserBl userBl;


        public SimpleAuthorizationServerProvider(IUserBl userBl)
        {
            this.userBl = userBl;
        }

        public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
        {
            context.Validated();
        }

        public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
        {

            context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });

            UserDto user = Mapper.Map<UserDto>(userBl.Login(context.UserName, context.Password));

            if (user == null)
            {
                context.SetError("invalid_grant", "The user name or password is incorrect.");
                return;
            }

            var identity = new ClaimsIdentity(context.Options.AuthenticationType);
            identity.AddClaim(new Claim("sub", context.UserName));
            identity.AddClaim(new Claim("role", "user"));

            context.Validated(identity);

        }
    }

唯一的区别是我使用的是owin的版本3，而不是指南中的2.是否有一些破坏性代码破坏了我的代码?

The only difference is that I'm using the version 3 of owin and not 2 like the guide. Are there some breaking changes that broken my code?

我正在使用Autofac来解析IOAuthAuthorizationServerProvider接口:

I'am using Autofac to resolve the Interface IOAuthAuthorizationServerProvider:

builder.RegisterType<SimpleAuthorizationServerProvider>()
                .As<IOAuthAuthorizationServerProvider>()
                .PropertiesAutowired()
                .SingleInstance();

推荐答案

此答案解决了我的问题 https://stackoverflow.com/a/36769653/5441093

This answer solves my problemhttps://stackoverflow.com/a/36769653/5441093

更改GrantResourceOwnerCredentials方法可解决我的userbl类:

Change in the GrantResourceOwnerCredentials method this to resolve my userbl class:

var autofacLifetimeScope = OwinContextExtensions.GetAutofacLifetimeScope(context.OwinContext);
var userBl = autofacLifetimeScope.Resolve<IUserBl>();

代替使用autofac的注入感谢@taiseer joudeh提供有关查看Autofac的提示

instead of using the injection of autofacThanks to @taiseer joudeh for the hint to look at Autofac

这篇关于使用ASP.NET Web API 2和Owin的基于令牌的身份验证会抛出401未经授权的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！