Identity Server 4集成SPA后API中User.Claims为空问题求助

我之前也碰到过类似的Claims为空的问题，结合你的分布式架构场景，咱们一步步来排查和解决：

首先得确保Identity Server这边正确输出了Claims：

• 定义ApiScope时，要明确指定需要包含的用户Claims，或者开启IncludeAllClaimsForUser：

public static IEnumerable<ApiScope> GetApiScopes()
{
    return new List<ApiScope>
    {
        new ApiScope("project.api", "Project API")
        {
            UserClaims = { "name", "role", "email" }, // 列出你需要的Claims类型
            IncludeAllClaimsForUser = true // 可选，确保所有用户Claims都被包含进Token
        }
    };
}

• 配置SPA Client时，要确保AllowedScopes包含你的api scope，并且开启AlwaysIncludeUserClaimsInIdToken（适配SPA的授权码流程）：

public static IEnumerable<Client> GetClients()
{
    return new List<Client>
    {
        new Client
        {
            ClientId = "spa_client",
            ClientName = "SPA Client",
            AllowedGrantTypes = GrantTypes.Code,
            RequirePkce = true,
            RedirectUris = { "https://your-spa-domain/callback" },
            PostLogoutRedirectUris = { "https://your-spa-domain/logout" },
            AllowedScopes = { "openid", "profile", "project.api" },
            AlwaysIncludeUserClaimsInIdToken = true, // 关键：让Claims出现在IdToken中
            AllowOfflineAccess = true
        }
    };
}

Asp.net Identity和Identity Server的Claim类型可能存在差异（比如sub vs NameIdentifier），需要在API端做映射配置：

// Program.cs/Startup.cs
services.AddAuthentication("Bearer")
    .AddJwtBearer("Bearer", options =>
    {
        options.Authority = "https://your-auth-server-domain";
        options.TokenValidationParameters = new TokenValidationParameters
        {
            ValidateAudience = true,
            ValidAudience = "project.api",
            // 手动映射Claim类型
            NameClaimType = "name",
            RoleClaimType = "role"
        };
    });

同时要确保中间件顺序正确，先验证身份再授权：

app.UseAuthentication();
app.UseAuthorization();

如果自定义了ProfileService，要确保它正确读取并返回用户的Claims：

public class CustomProfileService : IProfileService
{
    private readonly UserManager<ApplicationUser> _userManager;

    public CustomProfileService(UserManager<ApplicationUser> userManager)
    {
        _userManager = userManager;
    }

    public async Task GetProfileDataAsync(ProfileDataRequestContext context)
    {
        var user = await _userManager.GetUserAsync(context.Subject);
        if (user == null) throw new ArgumentException("用户不存在");

        // 获取用户的自定义Claims
        var userClaims = await _userManager.GetClaimsAsync(user);
        // 添加Identity默认字段作为Claims
        userClaims.Add(new Claim(ClaimTypes.Name, user.UserName));
        userClaims.Add(new Claim(ClaimTypes.Email, user.Email));

        context.IssuedClaims = userClaims;
    }

    public async Task IsActiveAsync(IsActiveContext context)
    {
        var user = await _userManager.GetUserAsync(context.Subject);
        context.IsActive = user != null && user.IsActive;
    }
}

记得在Auth项目中注册这个服务：

services.AddScoped<IProfileService, CustomProfileService>();

• 确保SPA在调用API时，正确将Bearer Token添加到请求Header中：

const token = await userManager.getAccessToken();
fetch('https://your-api-domain/api/resource', {
    headers: {
        'Authorization': `Bearer ${token}`
    }
});

• 可以用jwt-decode库解码Token，检查里面是否包含了你需要的Claims——如果Token里就没有，那问题肯定在Identity Server端；如果Token里有但API端拿不到，就排查API的映射和中间件配置。

在Project.Data的DbContext中，确保正确继承了Identity的完整上下文，包含用户Claims的关联表：

public class ApplicationDbContext : IdentityDbContext<ApplicationUser, ApplicationRole, Guid, 
    IdentityUserClaim<Guid>, IdentityUserRole<Guid>, IdentityUserLogin<Guid>, 
    IdentityRoleClaim<Guid>, IdentityUserToken<Guid>>
{
    public ApplicationDbContext(DbContextOptions<ApplicationDbContext> options) : base(options)
    {
    }
}

也可以直接查询数据库的AspNetUserClaims表，确认用户确实有对应的Claims记录。

最后测试前记得清除浏览器缓存，避免旧Token影响结果~

内容的提问来源于stack exchange，提问作者Rasik