新建ASP .NET Core Web Api ，名稱Linjie.JWT.IDS4

2、右鍵專案 NuGet程式包管理工具 新增IdentityServer4，注意版本 不要選4.x.x以上的，選擇4.x.x以下的，本文選擇的是3.1.3，原因是4.x.x版本相對3.x.x版本的改動比較大

3、新增類 IDS4Client，該類用於獲取資料程式碼如下：

using IdentityServer4.Models;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Security.Claims;
 
using System.Threading.Tasks;

namespace Linjie.JWT.IDS4
{
    public class IDS4Client
    {
        public static IEnumerable<Client> GetClient()
        {
            return new[] {
                new Client()
                {
                    //ClientCredentials  客戶端驗證的話，只需要ClientId，ClientSecrets即可
 

                    ClientId = "id123456",
                    ClientSecrets = new []{ new Secret("secret123456".Sha256()) },//注意密碼必須要加密，本文使用Sha256加密
                    AllowedGrantTypes =GrantTypes.ClientCredentials,//授權方式是有5種，本文使用最簡單的客戶端授權方式 ClientCredentials
                    AllowedScopes = new [] { "
 
webapi" },//訪問應用域
                    Claims = new List<Claim> { //身份資訊
                    new Claim(IdentityModel.JwtClaimTypes.Role,"李四"),
                    new Claim(ClaimTypes.Email,"[email protected]"),
                    new Claim(IdentityModel.JwtClaimTypes.NickName,"kkkk")},
                }};
        }

        public static IEnumerable<ApiResource> GetResources()
        {
            return new[] { new ApiResource("webapi") };
        }
    }
}

4、修改類 Startup，程式碼如下：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;

namespace Linjie.JWT.IDS4
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddControllers();
            services.AddIdentityServer()//認證授權伺服器
                .AddDeveloperSigningCredential()//認證授權證書，這類使用臨時的開發版證書，執行時會自動生成一個證書tempkey
                .AddInMemoryClients(IDS4Client.GetClient())//設定認證的授權型別
                .AddInMemoryApiResources(IDS4Client.GetResources());//設定認證的授權可以訪問的資源
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseIdentityServer();//啟用認證授權伺服器

            app.UseHttpsRedirection();           

            app.UseRouting();

            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }
}

5、執行專案，獲取token

這裡有幾點注意項

1、使用ids4 獲取token時，約定：地址+/connect/token，請求地址為https://lip:port/connect/token，本文使用http://localhost:5000/connect/token

2、請求方法POST,請求引數client_Id，client_secret，grant_type

如下：

使用postman 請求地址，獲取token，如下圖

可以使用 https://jwt.io/ 來解析，如下圖

6、IdentityServer4產生的token的使用

a、新建專案ASP .NET Core Web Api ，名稱Linjie.WebApi，NuGet程式管理包新增IdentityServer4.AccessTokenValidation，

b、新增TestController類，程式碼如下

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Logging;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace Linjie.WebApi.Controllers
{
    [ApiController]
    [Route("webapi/[controller]")]
    public class TestController : ControllerBase
    {
        private static readonly string[] Summaries = new[]
        {
            "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
        };

        private readonly ILogger<TestController> _logger;

        public TestController(ILogger<TestController> logger)
        {
            _logger = logger;
        }

        [HttpGet]
        public IEnumerable<WeatherForecast> Get()
        {
            var rng = new Random();
            return Enumerable.Range(1, 5).Select(index => new WeatherForecast
            {
                Date = DateTime.Now.AddDays(index),
                TemperatureC = rng.Next(-20, 55),
                Summary = Summaries[rng.Next(Summaries.Length)]
            })
            .ToArray();
        }

        [HttpGet("{id}")]
        public string Get(int id)
        {
            var rng = $"收到資料：{id}";
            return rng;
        }

        [Authorize]//新增授權驗證，訪問該介面需要token驗證
        [HttpGet("late/{id}")]
        public string GetLate(int id)
        {
            var rng = $"需要授權驗證，收到資料：{id}";
            return rng;
        }
    }
}

c、startup類程式碼如下

using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Extensions.Logging;
using IdentityServer4.AccessTokenValidation;

namespace Linjie.WebApi
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddControllers();
            services.AddAuthentication("Bearer")//設定認證授權的主題方案，不能寫成bearer，必須時 Bearer
                .AddIdentityServerAuthentication(option =>
                {
                    option.Authority = "http://localhost:6000";//ids4 認證授權伺服器地址
                    option.ApiName = "webapi";//api資源
                    option.RequireHttpsMetadata = false;
                });
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }

            app.UseHttpsRedirection();

            app.UseRouting();

            app.UseAuthentication();//啟用認證
            app.UseAuthorization();//啟用許可權驗證

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllers();
            });
        }
    }
}

d、修改Linjie.JWT.IDS4中的，launchSettings.json的applicationUrl，改成"applicationUrl": "https://localhost:6001;http://localhost:6000",然後 同時啟動Linjie.JWT.IDS4和Linjie.WebApi專案，訪問http://localhost:5000/webapi/test/late/1

訪問http://localhost:6000/connect/token 獲取token，在postman中新增token，型別為Bearer Token，

再訪問http://localhost:5000/webapi/test/late/1 如下：