DotNetOpenAuth實踐之WebApi資源服務器

系列目錄：

DotNetOpenAuth實踐系列（源碼在這里）

 

 

上篇我們講到WCF服務作為資源服務器接口提供數據服務，那么這篇我們介紹WebApi作為資源服務器，下面開始：

 

一、環境搭建

1、新建WebAPI項目

 

 

2、利用Nuget添加DotNetOpenAuth

注意：

Nuget里面的 NotNetOpenAuth 5.0.0 alpha3有bug，要到github(DotNetOpenAuth)里面下源碼自己編譯，用編譯的dll替換掉Nuget引用的dll

3、把上次制作的證書文件拷貝的項目中

二、關鍵代碼編寫

1、公共代碼

ResourceServerConfiguration

using System.Security.Cryptography.X509Certificates;

namespace WebApiResourcesServer.Code
{
    public class ResourceServerConfiguration
    {
        public X509Certificate2 EncryptionCertificate { get; set; }
        public X509Certificate2 SigningCertificate { get; set; }
    }
}

Common.cs

namespace WebApiResourcesServer.Code
{
    public class Common
    {
        public static ResourceServerConfiguration Configuration = new ResourceServerConfiguration();
    }
}

Global.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Cryptography.X509Certificates;
using System.Web;
using System.Web.Http;
using System.Web.Mvc;
using System.Web.Optimization;
using System.Web.Routing;
using WebApiResourcesServer.Code;

namespace WebApiResourcesServer
{
    public class WebApiApplication : System.Web.HttpApplication
    {
        protected void Application_Start()
        {
            Common.Configuration = new ResourceServerConfiguration
            {
                EncryptionCertificate = new X509Certificate2(Server.MapPath("~/Certs/idefav.pfx"), "a"),
                SigningCertificate = new X509Certificate2(Server.MapPath("~/Certs/idefav.cer"))
            };
            AreaRegistration.RegisterAllAreas();
            GlobalConfiguration.Configure(WebApiConfig.Register);
            FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
            RouteConfig.RegisterRoutes(RouteTable.Routes);
            BundleConfig.RegisterBundles(BundleTable.Bundles);
        }
    }
}

注意：

這里有個地方要注意，就是認證服務器上面用公鑰加密，在資源服務器要用私鑰解密，所以ResourceServeConfiguration里面傳進去的證書是和認證服務器里面的是對調的

2、重寫DelegatingHandler

using DotNetOpenAuth.OAuth2;
using System;
using System.Net.Http;
using System.Security.Cryptography;
using System.Security.Principal;
using System.Threading;
using System.Threading.Tasks;
using System.Web;

namespace WebApiResourcesServer.Code
{
    public class OAuth2Handler : DelegatingHandler
    {
        private static async Task<IPrincipal> VerifyOAuth2(HttpRequestMessage httpDetails, params string[] requiredScopes)
        {
            // for this sample where the auth server and resource server are the same site,
            // we use the same public/private key.
            var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer((RSACryptoServiceProvider)Common.Configuration.SigningCertificate.PublicKey.Key, (RSACryptoServiceProvider)Common.Configuration.EncryptionCertificate.PrivateKey));
            return await resourceServer.GetPrincipalAsync(httpDetails, requiredScopes: requiredScopes);
        }

        protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
        {
            if (request.Headers.Authorization != null && request.Headers.Authorization.Scheme == "Bearer")
            {
                
                var principal =VerifyOAuth2(request);

                if (principal.Result != null)
                {
                    HttpContext.Current.User = principal.Result;
                    Thread.CurrentPrincipal = principal.Result;
                }
               
                
            }

            return base.SendAsync(request, cancellationToken);
        }

    }
}

3、App_Start/WebApiConfig.cs里面添加OAuthHandler

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web.Http;
using WebApiResourcesServer.Code;

namespace WebApiResourcesServer
{
    public static class WebApiConfig
    {
        public static void Register(HttpConfiguration config)
        {
            // Web API 配置和服務
            config.MessageHandlers.Add(new OAuth2Handler());
            // Web API 路由
            config.MapHttpAttributeRoutes();

            config.Routes.MapHttpRoute(
                name: "DefaultApi",
                routeTemplate: "api/{controller}/{id}",
                defaults: new { id = RouteParameter.Optional }
            );
        }
    }
}

4、設置要驗證的接口

三、測試

打開解決方案屬性，設置啟動項目，啟動認證服務器和WebApi資源服務器

 

利用Post工具訪問認證服務器獲取access_token

本次獲取的Token的有效期為5分鍾，超過5分鍾要重新獲取

用access_token范圍WebAPI接口

 

我們手動改一下Token

 

下篇我們看一下Webform的ashx做的接口如何做資源服務器實現Authorization