基于ASP.NET Core实现JWT与回调URL的身份验证API集成问询

一、项目准备 #

• 在Visual Studio中创建ASP.NET Core Web API项目
• 安装必要的NuGet包：
  • System.Net.Http.Json：用于和外部系统交互JSON数据
  • System.IdentityModel.Tokens.Jwt：用于解析回调中的JWT令牌

二、定义数据模型 #

1. 授权请求相关模型 #

// 发送给外部系统的请求体
public class AuthRequest
{
    public string id { get; set; }
    public string action { get; set; } = "SpRequest";
    public string service { get; set; } = "Login";
}

// 外部系统返回的授权响应
public class AuthResponse
{
    public string transId { get; set; }
    public string random { get; set; }
}

2. 回调相关模型 #

// 外部系统回调的请求体
public class CallbackRequest
{
    public string response { get; set; } // JWT格式的用户信息
    public string status { get; set; } // COMPLETED/REJECTED
    public string transId { get; set; }
    public string serviceName { get; set; }
}

// JWT中解析出的用户信息结构
public class UserInfo
{
    public int id { get; set; }
    public int idVersion { get; set; }
    public string arFirst { get; set; }
    public string arFather { get; set; }
    public string arGrand { get; set; }
    public string arFamily { get; set; }
    public string enFirst { get; set; }
    public string enFather { get; set; }
    public string enGrand { get; set; }
    public string enFamily { get; set; }
    public string arTwoNames { get; set; }
    public string enTwoNames { get; set; }
    public string arFullName { get; set; }
    public string enFullName { get; set; }
    public string gender { get; set; }
    public string idIssuedDateG { get; set; }
    public long idIssuedDate { get; set; }
    public string idExpiryDateG { get; set; }
    public long idExpiryDate { get; set; }
    public int nationality { get; set; }
    public string language { get; set; }
    public string arNationality { get; set; }
    public string enNationality { get; set; }
    public string dobG { get; set; }
    public long dob { get; set; }
    public string arCardIssuePlace { get; set; }
    public string enCardIssuePlace { get; set; }
}

三、实现授权请求API #

创建AuthController处理授权请求：

[ApiController]
[Route("api/[controller]")]
public class AuthController : ControllerBase
{
    private readonly HttpClient _httpClient;
    private readonly IConfiguration _config;

    public AuthController(HttpClient httpClient, IConfiguration config)
    {
        _httpClient = httpClient;
        _config = config;
    }

    [HttpPost("request-auth")]
    public async Task<IActionResult> RequestAuthorization([FromBody] string idNumber)
    {
        var authRequest = new AuthRequest { id = idNumber };
        var externalApiUrl = _config["ExternalAuth:ApiUrl"];

        var response = await _httpClient.PostAsJsonAsync(externalApiUrl, authRequest);
        if (!response.IsSuccessStatusCode)
        {
            return StatusCode((int)response.StatusCode, "外部授权请求失败");
        }

        var authResponse = await response.Content.ReadFromJsonAsync<AuthResponse>();
        return Ok(authResponse);
    }
}

在appsettings.json中配置外部API地址：

{
  "ExternalAuth": {
    "ApiUrl": "https://外部系统授权接口地址"
  }
}

四、实现回调API #

在AuthController中添加回调接口：

[HttpPost("iam-callback")]
public IActionResult AuthCallback([FromBody] CallbackRequest callbackRequest)
{
    switch (callbackRequest.status.ToUpper())
    {
        case "COMPLETED":
            // 解析JWT获取用户信息
            var jwtHandler = new JwtSecurityTokenHandler();
            if (!jwtHandler.CanReadToken(callbackRequest.response))
            {
                return BadRequest("无效的JWT令牌");
            }

            var jwtToken = jwtHandler.ReadJwtToken(callbackRequest.response);
            var userInfo = jwtToken.Payload["userInfo"].ToObject<UserInfo>();

            // 此处可添加业务逻辑：如存入数据库、生成本地登录凭证等
            return Ok(new { Status = "Success", User = userInfo });
        
        case "REJECTED":
            // 处理用户拒绝授权的逻辑
            return Ok(new { Status = "Rejected", Message = "用户拒绝授权" });
        
        default:
            return BadRequest("未知的授权状态");
    }
}

五、配置公网可访问的回调URL #

• 本地开发阶段：使用Ngrok等工具将本地端口映射为公网地址，示例：ngrok http 5000，回调URL为https://xxx.ngrok.io/api/auth/iam-callback
• 生产环境：直接部署到公网服务器，使用服务器的域名或公网IP配置回调地址

六、额外注意事项 #

• 提前在外部系统配置回调URL白名单，确保请求能正常到达
• 若外部系统对JWT做签名验证，需在解析时添加验证逻辑：

var validationParams = new TokenValidationParameters
{
    ValidateIssuer = true,
    ValidIssuer = _config["Jwt:Issuer"],
    ValidateAudience = true,
    ValidAudience = _config["Jwt:Audience"],
    ValidateIssuerSigningKey = true,
    IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_config["Jwt:SecretKey"]))
};
jwtHandler.ValidateToken(callbackRequest.response, validationParams, out _);

• 建议添加日志记录，便于排查授权请求和回调的异常问题

内容的提问来源于stack exchange，提问作者Hadi