OpenIddict客户端凭证令牌验证异常：无法提取身份标识求助

异常信息 #

System.InvalidOperationException: 无法从此请求中提取身份标识。
这通常表明OpenIddict服务器堆栈被要求为其不管理的端点验证令牌。
要验证自定义API端点接收的令牌，必须改用OpenIddict验证处理程序（例如OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme或OpenIddictValidationOwinDefaults.AuthenticationType）。

at OpenIddict.Server.OpenIddictServerHandlers.ValidateAuthenticationDemand.HandleAsync(ProcessAuthenticationContext context)
at OpenIddict.Server.OpenIddictServerDispatcher.DispatchAsync[TContext](TContext context)
at OpenIddict.Server.OpenIddictServerDispatcher.DispatchAsync[TContext](TContext context)
at OpenIddict.Server.AspNetCore.OpenIddictServerAspNetCoreHandler.HandleAuthenticateAsync()
at Microsoft.AspNetCore.Authentication.AuthenticationHandler`1.AuthenticateAsync()
at Microsoft.AspNetCore.Authentication.AuthenticationService.AuthenticateAsync(HttpContext context, String scheme)
at Microsoft.AspNetCore.Authorization.Policy.PolicyEvaluator.AuthenticateAsync(AuthorizationPolicy policy, HttpContext context)
at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

请求头 #

Accept: */*
Host: localhost:7174
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
:method: GET
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9
Authorization: Bearer eyJhbGciOiJSUzI1NiIsImtpZCI6IlYyUERaNl9RUjRfNFo0Q1VMUkUwWFdRRU1KNFVDT0VGSjNDQldTQUQiLCJ0eXAiOiJhdCtqd3QifQ.eyJzdWIiOiJwb3N0bWFuIiwic29tZS1jbGFpbSI6InNvbWUtdmFsdWUiLCJvaV9wcnN0IjoicG9zdG1hbiIsImNsaWVudF9pZCI6InBvc3RtYW4iLCJvaV90a25faWQiOiI3NGE3ZGNlMC1kNjJkLTRmZjQtYjg1MS1kMjRjN2E1OGIwNTEiLCJzY29wZSI6ImFwaSIsImV4cCI6MTY3MjIxMjQzMywiaXNzIjoiaHR0cHM6Ly9sb2NhbGhvc3Q6NzE3NC8iLCJpYXQiOjE2NzIyMDg4MzN9.bls8ceNA9bU-xr1-9huV4LDqifX7KDn8E1bqGPGeeWh9ePeN1mYnywFC6lPVls8OtCmtm1v9iTnnfaoZ3r2v_IoKahl727B4QD8AkKpy_8ExiBBECtX9HqDid3w0c8dYS1Rka2xyh5mcKJzlqNlSucNbRqj7Hu8wisizV89K45qmWBsZTIsBqJOR5DKDjVzAEmAvjccD8Hb9kjF6lSiis2E7x41YO0dB4ugc5gEm1huEI44bps7qj9V2mQ70EcNi74KgK3Y57JsityV1Oqjv14gour2jjvccATtLhOtNisUfbw10jPlRj3AT1XiHDjjIhR5pb0z6XTJRblpmNt8wNQ
Referer: https://localhost:7174/swagger/index.html
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108", "Google Chrome";v="108"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty

解决方案 #

异常核心原因：你正用OpenIddict的服务器处理程序验证自定义API端点的令牌，但服务器处理程序仅负责OpenIddict自身的标准端点（如/token、/authorize），不处理普通API的令牌验证。按以下步骤修复：

1. 安装验证包
   确保项目已安装OpenIddict.Validation.AspNetCore NuGet包：

   Install-Package OpenIddict.Validation.AspNetCore
   

2. 配置验证服务
   在Program.cs中扩展OpenIddict配置，添加验证模块：

   builder.Services.AddOpenIddict()
       // 保留原有服务器配置
       .AddServer(options => { /* 你的服务器配置代码 */ })
       // 添加验证配置
       .AddValidation(options =>
       {
           // 令牌颁发者地址，需与令牌中的issuer字段完全一致
           options.SetIssuer("https://localhost:7174/");
           // 启用AspNetCore集成
           options.UseAspNetCore();
           // 开发环境使用本地服务器验证签名，生产环境可配置远程验证
           options.UseLocalServer();
       });
   

3. 指定API使用验证方案
   两种方式任选其一：

   • 全局设置默认认证方案：

     builder.Services.AddAuthentication(options =>
     {
         options.DefaultAuthenticateScheme = OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme;
         options.DefaultChallengeScheme = OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme;
     });
     

   • 针对单个控制器/Action指定：

     [Authorize(AuthenticationSchemes = OpenIddictValidationAspNetCoreDefaults.AuthenticationScheme)]
     [ApiController]
     [Route("api/[controller]")]
     public class YourApiController : ControllerBase
     {
         // API逻辑
     }
     

4. 检查中间件顺序
   确保认证中间件在授权中间件之前：

   app.UseAuthentication();
   app.UseAuthorization();
   

内容的提问来源于stack exchange，提问作者Muhammad Umair