我有一个使用JWT令牌授权用户的.Net Core 2.0应用程序。一切正常,但我想拥有某种API密钥机制以允许其他应用程序集成,但是我似乎无法使它与当前身份验证一起使用。
码:
启动文件
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory,
IMemoryCache cache, IServiceProvider serviceProvider)
{
app.UseAuthentication();
ApiKeyMiddlewear(app, serviceProvider);
app.UseMvc(routes =>
{
routes.MapRoute(
name: "default",
template: "{controller=Home}/{action=Index}/{id?}");
routes.MapSpaFallbackRoute(
name: "spa-fallback",
defaults: new { controller = "Home", action = "Index" });
});
}
}
private static void ApiKeyMiddlewear(IApplicationBuilder app, IServiceProvider serviceProvider)
{
app.Use(async (context, next) =>
{
if (context.Request.Path.StartsWithSegments(new PathString("/api")))
{
// Let's check if this is an API Call
if (context.Request.Headers["ApiKey"].Any())
{
// validate the supplied API key
// Validate it
var headerKey = context.Request.Headers["ApiKey"].FirstOrDefault();
var settingsProvider = serviceProvider.GetService<ISettingsService<OmbiSettings>>();
var ombiSettings = settingsProvider.GetSettings();
var valid = ombiSettings.ApiKey.Equals(headerKey, StringComparison.CurrentCultureIgnoreCase);
if (!valid)
{
context.Response.StatusCode = (int) HttpStatusCode.Unauthorized;
await context.Response.WriteAsync("Invalid API Key");
}
else
{
var identity = new GenericIdentity("API");
identity.AddClaim(new System.Security.Claims.Claim("Origin", "Api"));
identity.AddClaim(new System.Security.Claims.Claim("role", "Admin"));
var principal = new GenericPrincipal(identity, new[] {"ApiUser"});
context.User = principal;
await next();
}
}
else
{
await next();
}
}
else
{
await next();
}
});
}
}
因此,在上面的代码中,您可以看到我正在拦截提供名为ApiKey的标头的HTTP请求,然后将其验证为已存储的内容。这部分都可以使用,但是当使用Authorize
属性调用API方法时,该方法不起作用,并且我得到以下错误日志:
2017-09-19 08:15:17.280 +01:00 [Information] Request starting HTTP/1.1 POST http://localhost:52038/api/v1/Identity/ application/json 372
2017-09-19 08:15:21.967 +01:00 [Information] Authorization failed for user: "API".
2017-09-19 08:15:21.976 +01:00 [Information] Authorization failed for the request at filter '"Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter"'.
2017-09-19 08:15:21.981 +01:00 [Information] Executing ForbidResult with authentication schemes ([]).
2017-09-19 08:15:21.991 +01:00 [Information] AuthenticationScheme: "Bearer" was forbidden.
2017-09-19 08:15:21.996 +01:00 [Information] Executed action "Ombi.Controllers.IdentityController.CreateUser (Ombi)" in 38.8268ms
2017-09-19 08:15:22.004 +01:00 [Information] Request finished in 4723.032ms 403
现在,我猜测这与仅提供ApiKey
标头而不是Authorization
提供具有正确JWT令牌的标头的请求有关。
如何仅提供ApiKey标头,而当没有ApiKey标头时又回退到需要JWT令牌?
应用Claim("role", "Admin")
到GenericPrincipal
不会影响什么,因为GenericPrincipal
什么都没有做与角色索赔。因此,如果要将admin角色应用于GenericPrincipal
,则需要将其添加到构造函数参数中:
var principal = new GenericPrincipal(identity, new[] {"Admin","ApiUser"});
context.User = principal;
本文收集自互联网,转载请注明来源。
如有侵权,请联系 [email protected] 删除。
我来说两句