基于ASP.NET Core 2.0与IdentityServer4的保险API授权配置问询

Hey there! Let's break down how to tackle your IdentityServer4 + ASP.NET Core 2.0 API setup for your multi-line insurance products. I’ve worked through similar integration scenarios, so here’s a structured guide and solutions to common pitfalls you might run into:

First, make sure your IdentityServer setup correctly defines your API resources and client permissions tailored to your insurance product lines:

Define API Resources #

Each product line (Motor, Travel, Home) should be registered as a distinct ApiResource with granular scopes to enforce access control:

public static IEnumerable<ApiResource> GetApiResources()
{
    return new List<ApiResource>
    {
        new ApiResource("MotorAPI", "Motor Insurance API")
        {
            Scopes = { "MotorAPI.full_access", "MotorAPI.read_only" }
        },
        new ApiResource("TravelAPI", "Travel Insurance API")
        {
            Scopes = { "TravelAPI.full_access", "TravelAPI.read_only" }
        },
        // Add Home Insurance API resource following the same pattern
    };
}

Configure ResourceOwnerPassword Client #

Set up a client for your external partner that uses the Resource Owner Password grant type, with scopes limited to the APIs they need access to:

public static IEnumerable<Client> GetClients()
{
    return new List<Client>
    {
        new Client
        {
            ClientId = "insurance_external_partner",
            AllowedGrantTypes = GrantTypes.ResourceOwnerPassword,
            ClientSecrets = { new Secret("partner_secure_secret".Sha256()) },
            AllowedScopes = { "MotorAPI.full_access", "TravelAPI.full_access" },
            // Adjust scopes based on the partner's actual access needs (e.g., remove full_access if they only need read access)
        }
    };
}

Next, configure each of your product line APIs to validate tokens issued by IdentityServer:

API Startup Configuration #

In each API project’s Startup.cs, add authentication middleware pointing to your IdentityServer instance:

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_0);

    services.AddAuthentication("Bearer")
        .AddIdentityServerAuthentication(options =>
        {
            options.Authority = "https://your-identityserver-domain:port";
            options.RequireHttpsMetadata = true; // Disable only in local development
            options.ApiName = "MotorAPI"; // Use "TravelAPI" for your Travel insurance API project
        });
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    // Add other middleware (exception handling, static files) first
    app.UseAuthentication(); // Ensure this is added before UseMvc
    app.UseMvc();
}

Enforce Authorization on Endpoints #

Apply [Authorize] attributes to your controllers/actions, specifying the required scopes to restrict access:

[Authorize(Policy = "MotorAPI.full_access")]
[Route("Motor/api/v1/")]
public class MotorInsuranceController : Controller
{
    [HttpPost("CalculatePremium")]
    public IActionResult CalculatePremium([FromBody] PremiumCalculationRequest request)
    {
        // Your premium calculation logic here
    }

    [HttpPost("ProposalSync")]
    public IActionResult SyncProposal([FromBody] ProposalSyncRequest request)
    {
        // Proposal synchronization logic here
    }
}

To define the scope policy, add this to your API’s ConfigureServices:

services.AddAuthorization(options =>
{
    options.AddPolicy("MotorAPI.full_access", policy =>
        policy.RequireClaim("scope", "MotorAPI.full_access"));
});

Here are solutions to frequent problems in this setup:

• Token validation fails with "invalid audience"

  Root cause: The ApiName configured in your API doesn’t match the Name of the ApiResource defined in IdentityServer.
  Fix: Double-check that options.ApiName in the API’s authentication config exactly matches the ApiResource.Name (e.g., "MotorAPI" must match in both places).

• Partner can’t access specific endpoints

  Root cause: Either the client’s AllowedScopes doesn’t include the required scope, or the controller’s [Authorize] policy references a non-existent scope.
  Fix: Verify the client’s AllowedScopes in IdentityServer includes the scope required by the endpoint, and that the policy name matches the scope string exactly.

• Custom user authentication not working

  If you’re using a custom user store for password validation, ensure you’ve implemented IResourceOwnerPasswordValidator:

  public class PartnerUserValidator : IResourceOwnerPasswordValidator
  {
      private readonly IPartnerUserService _userService;
  
      public PartnerUserValidator(IPartnerUserService userService)
      {
          _userService = userService;
      }
  
      public async Task ValidateAsync(ResourceOwnerPasswordValidationContext context)
      {
          var user = await _userService.ValidatePartnerCredentials(context.UserName, context.Password);
          if (user != null)
          {
              context.Result = new GrantValidationResult(
                  user.Id.ToString(),
                  OidcConstants.AuthenticationMethods.Password,
                  DateTime.UtcNow,
                  user.Claims);
          }
          else
          {
              context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, "Invalid partner credentials");
          }
      }
  }
  

  Register it in IdentityServer’s Startup.cs:

  services.AddTransient<IResourceOwnerPasswordValidator, PartnerUserValidator>();
  

• Least Privilege Principle: Only grant the partner the minimum scopes they need (e.g., MotorAPI.read_only instead of full_access if they don’t need to write data).
• Refresh Tokens: If the partner needs long-term access, enable offline access in the client config to allow refresh token usage:

  AllowOfflineAccess = true,
  RefreshTokenExpiration = TokenExpiration.Sliding,
  RefreshTokenUsage = TokenUsage.OneTimeOnly // More secure than ReUse
  

• Logging & Monitoring: Enable detailed logging in IdentityServer and your APIs to track token requests, authorization failures, and other critical events. This helps quickly diagnose issues with the partner’s integration.
• Enforce HTTPS: Ensure both IdentityServer and all your APIs are running over HTTPS to prevent token interception and man-in-the-middle attacks.

内容的提问来源于stack exchange，提问作者Rupesh G