如何在IdentityServer4控制台宿主中配置SSL、Windows及匿名身份验证？

Got it, let's break down how to configure SSL, Windows Authentication, and Anonymous Authentication for your IdentityServer4 console host—since you can't use project properties like you do with IIS Express, we'll handle all this right in your Program.cs (or Startup.cs if you're on an older .NET version).

For a console-hosted IdentityServer, we'll configure SSL directly in Kestrel (the web server used by .NET console apps). First, make sure you have a valid SSL certificate—for development, you can use the default .NET dev cert by running this command in your terminal:

dotnet dev-certs https --trust

Then add the Kestrel SSL configuration to your Program.cs:

var builder = WebApplication.CreateBuilder(args);

// Add your IdentityServer services first
builder.Services.AddIdentityServer()
    .AddInMemoryClients(Config.Clients)
    .AddInMemoryIdentityResources(Config.IdentityResources)
    .AddInMemoryApiScopes(Config.ApiScopes)
    .AddTestUsers(Config.TestUsers); // Or your custom user store

// Configure Kestrel to use HTTPS
builder.WebHost.ConfigureKestrel(options =>
{
    // Listen on port 5001 with HTTPS
    options.ListenAnyIP(5001, listenOptions =>
    {
        listenOptions.UseHttps(); // Uses the trusted dev cert by default
        // If you need a custom certificate, uncomment this line:
        // listenOptions.UseHttps(@"C:\path\to\your\cert.pfx", "your-cert-password");
    });
});

var app = builder.Build();

// Redirect HTTP traffic to HTTPS (optional but recommended)
app.UseHttpsRedirection();

app.UseIdentityServer();

app.Run();

Windows Auth for Kestrel relies on the Negotiate authentication scheme. Here's how to set it up:

First, add the authentication services to your service collection:

builder.Services.AddAuthentication(Microsoft.AspNetCore.Authentication.Negotiate.NegotiateDefaults.AuthenticationScheme)
    .AddNegotiate();

Then, enable Windows Authentication in Kestrel (this applies to all endpoints):

builder.WebHost.ConfigureKestrel(options =>
{
    options.ListenAnyIP(5001, listenOptions =>
    {
        listenOptions.UseHttps();
        listenOptions.UseWindowsAuthentication(); // Enable Windows Auth for this port
    });
});

If you want to restrict Windows Auth to specific routes instead of all, use middleware to enforce authorization:

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

app.UseIdentityServer();

// Example: A route that requires Windows Authentication
app.Map("/windows-only", (HttpContext context) => 
    $"Hello, {context.User.Identity.Name}!")
    .RequireAuthorization();

For older .NET versions using Startup.cs, add this to ConfigureServices:

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(NegotiateDefaults.AuthenticationScheme)
        .AddNegotiate();
    
    services.AddIdentityServer()
        // ... your IdentityServer config ...
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // ... other middleware ...
    app.UseAuthentication();
    app.UseAuthorization();
    app.UseIdentityServer();
}

Anonymous access is enabled by default in Kestrel, but you can fine-tune it to allow or restrict access as needed:

Allow anonymous for specific routes (while requiring auth elsewhere) #

If you want most endpoints to require authentication but leave some open (like IdentityServer's discovery endpoint, which clients need to access anonymously), use AllowAnonymous():

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

// Allow anonymous access to IdentityServer's core endpoints (critical for clients)
app.MapIdentityServer().AllowAnonymous();

// Public route that anyone can access
app.Map("/public", () => "This is public content")
    .AllowAnonymous();

// Secure route that requires authentication
app.Map("/secure", () => "This is secure content")
    .RequireAuthorization();

Disable anonymous access globally (only allow specific routes) #

If you want to lock down everything by default and only open specific paths, set a fallback authorization policy:

builder.Services.AddAuthorization(options =>
{
    // Require authentication for all routes by default
    options.FallbackPolicy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
});

// Then explicitly allow anonymous for necessary routes
app.MapIdentityServer().AllowAnonymous();
app.Map("/public", () => "Public content").AllowAnonymous();

内容的提问来源于stack exchange，提问作者alhpe