如何用Postman测试ASP.NET Core Identity角色授权API

一、核心问题说明 #

你当前的Identity配置仅启用了Cookie认证，适合Razor页面场景，但API需要使用JWT令牌认证才能被Postman/React这类无Cookie上下文的客户端调用。以下是完整的配置与测试步骤：

二、配置JWT认证 #

1. 安装依赖包 #

添加JWT认证所需的NuGet包：

Install-Package Microsoft.AspNetCore.Authentication.JwtBearer -Version 6.0.10

2. 配置Program.cs #

更新认证与授权逻辑，添加JWT支持：

var builder = WebApplication.CreateBuilder(args);

// 读取JWT配置（建议从appsettings.json读取）
var jwtSettings = builder.Configuration.GetSection("JwtSettings");

// 添加JWT认证
builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = jwtSettings["Issuer"],
        ValidAudience = jwtSettings["Audience"],
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(jwtSettings["SecretKey"]))
    };
});

// 保留原有Identity配置
builder.Services.AddIdentity<ApplicationUser, IdentityRole>()
    .AddEntityFrameworkStores<ApplicationDbContext>();

// 添加授权服务
builder.Services.AddAuthorization();

// 注册控制器
builder.Services.AddControllers();

var app = builder.Build();

// 中间件顺序：先认证，后授权
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();
app.Run();

3. 添加JWT配置到appsettings.json #

在配置文件中添加JWT相关参数：

"JwtSettings": {
  "Issuer": "YourApiIssuer",
  "Audience": "YourApiAudience",
  "SecretKey": "YourSecureSecretKeyAtLeast16CharactersLong",
  "ExpiryMinutes": 60
}

三、实现登录接口生成JWT令牌 #

添加一个Auth控制器，用于验证用户身份并生成包含角色信息的JWT：

[Route("api/[controller]")]
[ApiController]
public class AuthController : ControllerBase
{
    private readonly UserManager<ApplicationUser> _userManager;
    private readonly IConfiguration _configuration;

    public AuthController(UserManager<ApplicationUser> userManager, IConfiguration configuration)
    {
        _userManager = userManager;
        _configuration = configuration;
    }

    [HttpPost("login")]
    public async Task<IActionResult> Login(LoginModel model)
    {
        var user = await _userManager.FindByNameAsync(model.Username);
        if (user != null && await _userManager.CheckPasswordAsync(user, model.Password))
        {
            // 获取用户所属角色
            var userRoles = await _userManager.GetRolesAsync(user);
            
            // 构建JWT声明（包含用户ID、用户名、角色）
            var claims = new List<Claim>
            {
                new(ClaimTypes.NameIdentifier, user.Id),
                new(ClaimTypes.Name, user.UserName)
            };
            foreach (var role in userRoles)
            {
                claims.Add(new(ClaimTypes.Role, role));
            }

            // 生成签名密钥
            var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["JwtSettings:SecretKey"]));
            var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

            // 生成JWT令牌
            var token = new JwtSecurityToken(
                issuer: _configuration["JwtSettings:Issuer"],
                audience: _configuration["JwtSettings:Audience"],
                claims: claims,
                expires: DateTime.UtcNow.AddMinutes(Convert.ToDouble(_configuration["JwtSettings:ExpiryMinutes"])),
                signingCredentials: credentials);

            return Ok(new
            {
                Token = new JwtSecurityTokenHandler().WriteToken(token),
                Expiration = token.ValidTo
            });
        }

        return Unauthorized("无效的用户名或密码");
    }
}

// 登录请求模型
public class LoginModel
{
    public string Username { get; set; }
    public string Password { get; set; }
}

四、Postman测试步骤 #

1. 获取Admin用户的JWT令牌

   • 请求方式：POST
   • 请求地址：http://localhost:<端口号>/api/Auth/login
   • Body选择raw->JSON，传入用户信息：

     {
       "Username": "你的Admin用户名",
       "Password": "你的Admin用户密码"
     }
     

   • 发送请求后，复制返回的Token值。

2. 调用CreateRole接口

   • 请求方式：POST
   • 请求地址：http://localhost:<端口号>/api/Administration/CreateRole
   • 请求头添加Authorization：选择Bearer Token类型，粘贴刚才复制的Token；或者手动输入Bearer <你的Token值>
   • Body传入角色信息：

     {
       "RoleName": "TestRole"
     }
     

   • 验证结果：
     • 使用Admin用户的Token调用：返回200 OK，提示角色创建成功
     • 使用非Admin用户的Token/不带Token调用：返回401 Unauthorized或403 Forbidden

五、React前端集成方案 #

1. 登录获取并存储Token #

// 登录函数
async function login(username, password) {
  try {
    const response = await fetch('/api/Auth/login', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json'
      },
      body: JSON.stringify({ Username: username, Password: password })
    });
    
    if (!response.ok) throw new Error('登录失败');
    
    const { Token } = await response.json();
    // 将Token存储到localStorage
    localStorage.setItem('authToken', Token);
    return true;
  } catch (err) {
    console.error(err);
    return false;
  }
}

2. 调用授权接口时携带Token #

// 创建角色函数
async function createRole(roleName) {
  const token = localStorage.getItem('authToken');
  if (!token) {
    // 无Token时跳转到登录页
    window.location.href = '/login';
    return;
  }
  
  try {
    const response = await fetch('/api/Administration/CreateRole', {
      method: 'POST',
      headers: {
        'Content-Type': 'application/json',
        'Authorization': `Bearer ${token}`
      },
      body: JSON.stringify({ RoleName: roleName })
    });
    
    return await response.json();
  } catch (err) {
    console.error(err);
    // 处理Token过期等异常，比如清除Token并跳转登录
    if (err.response?.status === 401) {
      localStorage.removeItem('authToken');
      window.location.href = '/login';
    }
  }
}

内容的提问来源于stack exchange，提问作者Waleed Naveed