基于IdentityServer4实现双登录及令牌验证的技术疑问

DevOps 小满

2026-6-19

问题说明

我的Web API支持两种登录方式：

应用内登录
对接某私有企业的专属SSO

我已使用IdentityServer4实现认证服务，但遇到以下三个挑战：

不清楚如何为IdentityServer集成该企业专属SSO
需要能够使用IdentityServer端点验证令牌（令牌可由自身应用或该企业SSO颁发）
存在两个/.well-known/openid-configuration地址，接收用户信息时无法判断应向自身IdentityServer还是该SSO服务器请求

Program.cs 代码片段

services.AddIdentityServer(opt =>
            {
                opt.EmitStaticAudienceClaim = true;
            }).AddInMemoryClients(IdentityServerConfigs.Clients)
                .AddInMemoryIdentityResources(IdentityServerConfigs.IdentityResources)
                .AddInMemoryApiScopes(IdentityServerConfigs.ApiScopes)
                .AddInMemoryApiResources(IdentityServerConfigs.ApiResources)
                .AddAspNetIdentity<User>()
                .AddProfileService<CustomProfileService>()
                .AddExtensionGrantValidator<CustomSecurityStampValidator>()
                .AddSigningCredential(crt);

IdentityServerConfigs.cs 代码片段

public static IEnumerable<Client> Clients =>
        [
            new Client()
            {
                AllowedGrantTypes = CustomGrantTypes.SecurityStamp_Credentials,
                ClientId = "****",
                ClientSecrets = [new Secret("****".Sha256())],
                //refresh Token
                AllowOfflineAccess = true,
                AccessTokenLifetime=3600, //1h
                RefreshTokenUsage=TokenUsage.ReUse,
                RefreshTokenExpiration=TokenExpiration.Sliding,
                
                AllowedScopes = [
                    "roles",
                    IdentityServerConstants.StandardScopes.OpenId,
                    IdentityServerConstants.StandardScopes.Profile,
                    ],
            }
        ];