c# – 使用OpenIdDictServer丰富的Twitter数字/ Google Auth

This works very well,but I am wondering what is the cleanest way to support what I am trying to achieve.

我个人会使用自定义授权类型：

[HttpPost("~/connect/token")]
[Produces("application/json")]
public IActionResult Exchange(OpenIdConnectRequest request)
{
    if (request.GrantType == "urn:ietf:params:oauth:grant-type:google_identity_token")
    {
        // Reject the request if the "assertion" parameter is missing.
        if (string.IsNullOrEmpty(request.Assertion))
        {
            return BadRequest(new OpenIdConnectResponse
            {
                Error = OpenIdConnectConstants.Errors.InvalidRequest,ErrorDescription = "The mandatory 'assertion' parameter was missing."
            });
        }

        // Create a new ClaimsIdentity containing the claims that
        // will be used to create an id_token and/or an access token.
        var identity = new ClaimsIdentity(OpenIdConnectServerDefaults.AuthenticationScheme);

        // Manually validate the identity token issued by Google,// including the issuer,the signature and the audience.
        // Then,copy the claims you need to the "identity" instance.

        // Create a new authentication ticket holding the user identity.
        var ticket = new AuthenticationTicket(
            new ClaimsPrincipal(identity),new AuthenticationProperties(),OpenIdConnectServerDefaults.AuthenticationScheme);

        ticket.SetScopes(
            OpenIdConnectConstants.Scopes.OpenId,OpenIdConnectConstants.Scopes.OfflineAccess);

        return SignIn(ticket.Principal,ticket.Properties,ticket.AuthenticationScheme);
    }

    return BadRequest(new OpenIdConnectResponse
    {
        Error = OpenIdConnectConstants.Errors.UnsupportedGrantType,ErrorDescription = "The specified grant type is not supported."
    });
}

请注意,您还必须在OpenIddict选项中启用它：

// Register the OpenIddict services.
services.AddOpenIddict()
    // Register the Entity Framework stores.
    .AddEntityFrameworkCoreStores<ApplicationDbContext>()

    // Register the ASP.NET Core MVC binder used by OpenIddict.
    // Note: if you don't call this method,you won't be able to
    // bind OpenIdConnectRequest or OpenIdConnectResponse parameters.
    .AddMvcBinders()

    // Enable the token endpoint.
    .EnableTokenEndpoint("/connect/token")

    // Enable the refresh token flow and a custom grant type.
    .AllowRefreshTokenFlow()
    .AllowCustomFlow("urn:ietf:params:oauth:grant-type:google_identity_token")

    // During development,you can disable the HTTPS requirement.
    .DisableHttpsRequirement();

发送令牌请求时,请确保使用正确的grant_type并将您的id_token作为断言参数发送,它应该可以正常工作.

以下是使用Facebook访问令牌的示例：

在实现令牌验证例程时要特别小心,因为此步骤特别容易出错.验证所有内容非常重要,包括观众(否则,your server would be vulnerable to confused deputy attacks).