Identity Server 4保护的Web API未返回WWW-Authenticate头问题求助

我正在使用Identity Server 4保护Web API，当外部应用通过**客户端凭证（Client Credentials）**方式访问API但未传入access token时，API会返回Unauthorized响应，但这个响应没有包含OAuth规范要求的WWW-Authenticate头。请问这是Identity Server配置遗漏，还是实现本身的问题？

以下是相关代码片段：

Identity Server客户端注册代码 #

new Client() {
    ClientId = "datalookup.clientcredentials",
    ClientName = "Data Lookup Client with Client Credentials",
    AlwaysIncludeUserClaimsInIdToken = true,
    AlwaysSendClientClaims = true,
    AllowOfflineAccess = false,
    ClientSecrets = { new Secret("XXX".Sha256()) },
    AllowedGrantTypes = GrantTypes.ClientCredentials,
    AllowedScopes = { Scopes.DataLookup.Monitoring, Scopes.DataLookup.VatNumber },
    ClientClaimsPrefix = "client-",
    Claims = { new Claim("subs", "1000") }
}

Identity Server ApiResource注册代码 #

new ApiResource() {
    Name = "datalookup",
    DisplayName = "Data Lookup Web API",
    ApiSecrets = { new Secret("XXX".Sha256()) },
    UserClaims = { JwtClaimTypes.Name, JwtClaimTypes.Email, JwtClaimTypes.Profile, "user-subs" },
    Scopes = {
        new Scope() {
            Name = Scopes.DataLookup.Monitoring,
            DisplayName = "Access to the monitoring endpoints",
        },
        new Scope() {
            Name = Scopes.DataLookup.VatNumber,
            DisplayName = "Access to the VAT Number lookup endpoints",
            Required = true
        }
    }
}

Web API认证配置代码 #

public void ConfigureServices(IServiceCollection services) {
    (...) 
    services.AddMvc();
    services
        .AddAuthorization(
            (options) => {
                options.AddPolicy(
                    Policies.Monitoring,
                    (policy) => {
                        policy.RequireScope(Policies.Scopes.Monitoring);
                    });
                options.AddPolicy(
                    Policies.VatNumber,
                    (policy) => {
                        policy.RequireScope(Policies.Scopes.VatNumber);
                        policy.RequireClientSubscription();
                    });
            });
    services.AddAuthorizationHandlers();
    services
        .AddAuthentication("Bearer")
        .AddIdentityServerAuthentication(
            (options) => {
                options.Authority = "http://localhost:5000";
                options.RequireHttpsMetadata = false;
                options.ApiName = "datalookup";
            });
    (...) 
}

客户端访问代码 #

using (HttpClient client = new HttpClient()) {
    // client.SetBearerToken(accessToken);
    using (HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, Constants.WebApiEndpoint)) {
        using (HttpResponseMessage response = await client.SendAsync(request).ConfigureAwait(false)) {
            if (!response.IsSuccessStatusCode) {
                ConsoleHelper.WriteErrorLine(response);
                return;
            }
            string content = await response.Content.ReadAsStringAsync().ConfigureAwait(false);
            ConsoleHelper.WriteInformationLine(content);
        }
    }
}

我注释掉了client.SetBearerToken(accessToken)，期望响应中包含WWW-Authenticate头，目的是在客户端库中实现类似Azure KeyVault客户端库的Http Bearer挑战处理功能。

这不是Identity Server的实现问题，而是AddIdentityServerAuthentication中间件默认不会自动添加WWW-Authenticate挑战头，需要你手动配置认证选项来启用这个行为。

你可以通过两种方式来解决：

方式一：直接配置挑战属性 #

在AddIdentityServerAuthentication的配置中，设置Challenge和BearerChallenge属性，让中间件自动生成符合OAuth规范的挑战头：

services
    .AddAuthentication("Bearer")
    .AddIdentityServerAuthentication(
        (options) => {
            options.Authority = "http://localhost:5000";
            options.RequireHttpsMetadata = false;
            options.ApiName = "datalookup";
            // 启用Bearer挑战
            options.Challenge = "Bearer";
            // 自定义挑战内容，符合OAuth规范
            options.BearerChallenge = "Bearer realm=\"datalookup\",error=\"invalid_token\"";
        });

方式二：通过事件自定义挑战响应 #

如果需要更灵活的控制（比如根据不同的未授权场景返回不同的挑战信息），可以重写OnChallenge事件，手动添加响应头：

services
    .AddAuthentication("Bearer")
    .AddIdentityServerAuthentication(
        (options) => {
            options.Authority = "http://localhost:5000";
            options.RequireHttpsMetadata = false;
            options.ApiName = "datalookup";
            
            options.Events = new JwtBearerEvents
            {
                OnChallenge = context =>
                {
                    // 跳过默认的挑战处理逻辑
                    context.HandleResponse();
                    // 设置401状态码
                    context.Response.StatusCode = 401;
                    // 添加符合规范的WWW-Authenticate头
                    context.Response.Headers.Append("WWW-Authenticate", "Bearer realm=\"datalookup\"");
                    
                    return Task.CompletedTask;
                }
            };
        });

配置完成后，当客户端未携带token或token无效时，API就会返回包含WWW-Authenticate头的401响应，你的客户端库就能按照预期处理Bearer挑战了。

内容的提问来源于stack exchange，提问作者Hugo Quintela Ribeiro