Web应用程序、WebAPI、外部IdP和授权是如何工作的？

1. Web应用程序的身份验证

用户在Web应用程序中进行身份验证，并获得访问令牌，用于跨Web应用程序和Web API访问授权资源。可以使用OAuth 2.0或OpenID Connect标准进行身份验证，以下是使用OpenID Connect和AspNetCore.Authentication.OpenIdConnect包进行身份验证的示例代码：

// Startup.cs public void ConfigureServices(IServiceCollection services) { services.AddAuthentication(options => { options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme; options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme; }) .AddCookie() .AddOpenIdConnect(options => { options.Authority = "https://localhost:5001"; options.ClientId = "webapp"; options.ClientSecret = "secret"; options.ResponseType = "code"; options.Scope.Add("openid"); options.Scope.Add("profile"); options.Scope.Add("email"); options.SaveTokens = true; });

services.AddControllersWithViews();

}

// HomeController.cs [Authorize] public class HomeController : Controller { public IActionResult Index() { return View(); } }

2. Web API的身份验证

在Web API中使用访问令牌进行身份验证，可以使用JWT、OAuth 2.0或OAuth 2.0中的Bearer令牌进行实现。以下是基于Bearer令牌的示例代码：

// Startup.cs public void ConfigureServices(IServiceCollection services) { services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme) .AddJwtBearer(options => { options.Authority = "https://localhost:5001"; options.Audience = "webapi"; options.RequireHttpsMetadata = false; });

services.AddControllers();

}

// WeatherController.cs [Authorize] [ApiController] [Route("[controller]")] public class WeatherForecastController : ControllerBase { private static readonly string[] Summaries = new[] { "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "