IdentityServer4中ApiResource、ApiScope与IdentityResource的区别及疑问

Hey there! I totally get how confusing these three concepts can be when you're new to IdentityServer4—they sound similar but serve distinct purposes. Let's break down each of your questions one by one with clear explanations.

1. What's the difference between OAuth scopes (ApiScope) and API resources (ApiResource)? #

Think of an ApiResource as a single, logical API service you're protecting—like a "PaymentService" or "UserManagementAPI". It's the top-level container that represents your entire API, holding metadata like its name, display name, and security settings.

An ApiScope is a specific permission or access level within that API. For example, your PaymentService might have scopes like payment:read (to view payment history) and payment:write (to process new payments).

Here's the key relationship: One ApiResource can include multiple ApiScopes. When a client requests access to your API, it asks for specific scopes (not just the entire ApiResource). IdentityServer uses these scopes to determine exactly what the client is allowed to do with the API.

In OAuth terms, the "scope" parameter directly maps to IdentityServer's ApiScope. The ApiResource is IdentityServer's way of grouping related scopes together and attaching additional configuration (like which claims to include in access tokens for that API) to the entire set of scopes.

2. What's the purpose of IdentityResource? #

IdentityResource is all about user identity data—not API access. These represent pieces of information about the authenticated user, like their name, email address, profile picture, or roles.

When you add an IdentityResource to a client's AllowedScopes, you're letting that client request access to those user details during authentication. For example:

• The openid scope is mandatory for OpenID Connect (OIDC) clients—it tells IdentityServer to issue an id_token (a token that proves the user is authenticated).
• The profile scope lets the client get basic user info like name, birthdate, and username.
• The email scope gives access to the user's email address.

In short: IdentityResources are what let your client retrieve user identity claims after the user logs in.

3. How do I view the requested IdentityResources in the client? #

Once the user authenticates and the client has received the tokens, you can access the IdentityResource data through the user's claims principal. The exact method depends on your client type:

For MVC/Razor Page Clients (OIDC Clients): #

After login, the framework automatically populates the User property in your controllers/pages with the user's claims. You can retrieve specific claims like this:

// In an MVC controller action or Razor Page handler
var userName = User.FindFirstValue(System.Security.Claims.ClaimTypes.Name);
var userEmail = User.FindFirstValue(System.Security.Claims.ClaimTypes.Email);
var userId = User.FindFirstValue(System.Security.Claims.ClaimTypes.NameIdentifier);

// To get all claims
foreach (var claim in User.Claims)
{
    Console.WriteLine($"{claim.Type}: {claim.Value}");
}

For API Clients (Calling Protected APIs): #

When your API receives an access token, IdentityServer's middleware validates it and populates HttpContext.User with the user's claims. You can access them the same way as in MVC:

// In an API controller action
var userRole = User.FindFirstValue(System.Security.Claims.ClaimTypes.Role);
var userFullName = User.FindFirstValue("full_name"); // If you added a custom identity claim

You can also decode the id_token (for OIDC clients) manually to view the claims, but most client frameworks handle this automatically and expose the claims via the user principal.

内容的提问来源于stack exchange，提问作者Hp740319