微服务架构中的 ASP.NET Identity

问题描述

我正在尝试通过将主要组件分解为单独的 Web 服务器来使用微服务架构来实现 Web 应用程序.我正在使用 ASP.NET Identity(仅限电子邮件/用户名登录，没有 Facebook 等)和主"应用程序服务器实现身份验证服务器.

I'm attempting to implement a web app using a microservice architecture by breaking up major components into separate web servers. I'm implementing an authentication server using ASP.NET Identity (email/username logins only, no Facebook, etc) and a "main" application server.

我当前的挑战是弄清楚应用服务器如何识别用户是否通过身份验证服务器登录.由于身份验证服务器生成用户验证用户身份的令牌，我想它们存储在某个地方并且可以由应用程序服务器查询，但我不知道如何去做.理想情况下，我的应用程序服务器 WebAPI 端点将能够使用 [Authorize] 注释.

My current challenge is figuring out how the application server will recognize if a user has logged via the authentication server. Since the authentication server generates tokens which it users to verify users's identities, I imagine that they are stored somewhere and can be queried by the application server, but I'm not sure how to go about doing this. Ideally, my application servers WebAPI endpoints will be able to use the [Authorize] annotation.

问:一台服务器如何使用 ASP.NET Identity 通过单独的身份验证服务器控制访问?

推荐答案

我已经通过执行以下操作(使用 cookie 身份验证)做了类似的事情:

I've done something similar by doing the following (using cookie authentication):

1 - 将 cookie 域设置为所有网站的 TLD

我的 Startup.Auth.cs 看起来像这样:

My Startup.Auth.cs looks like this:

app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            Provider = new CookieAuthenticationProvider
            {
                OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                    validateInterval: TimeSpan.FromMinutes(30),
                    regenerateIdentity: (manager, user) => {
                        var identity = manager.CreateIdentity(user, DefaultAuthenticationTypes.ApplicationCookie);

                        //some additional claims and stuff specific to my needs
                        return Task.FromResult(identity);
                    })
            },
            CookieDomain = ".example.com"
        });

2 - 更新所有网站的 web.config 以使用相同的

我的看起来像这样:

<machineKey
    decryption="Auto"
    decryptionKey="my_key"
    validation="HMACSHA512"
    validationKey="my_other_key" />

现在我可以对 account.example.com 执行登录操作，并将用户重定向到 site1.example.com，他们将被视为已通过身份验证.

Now I can perform login operations on, say, account.example.com, and redirect the user to site1.example.com and they will be seen as authenticated.

这篇关于微服务架构中的 ASP.NET Identity的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！