IdentityServer4与ocelot实现认证与客户端统一入口

{
  "ReRoutes": [
    { // MvcClient
      "DownstreamPathTemplate": "/MvcClient/{route}",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 50891
        }
      ],
      "UpstreamPathTemplate": "/MvcClient/{route}",
      "UpstreamHeaderTransform": {
        "X-Forwarded-For": "{RemoteIpAddress}"
      }
    },
    { // signin-oidc
      "DownstreamPathTemplate": "/signin-oidc",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 50891
        }
      ],
      "UpstreamPathTemplate": "/signin-oidc",
      "UpstreamHeaderTransform": {
        "X-Forwarded-For": "{RemoteIpAddress}"
      }
    },
    { // signout-callback-oidc
      "DownstreamPathTemplate": "/signout-callback-oidc",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 50891
        }
      ],
      "UpstreamPathTemplate": "/signout-callback-oidc",
      "UpstreamHeaderTransform": {
        "X-Forwarded-For": "{RemoteIpAddress}"
      }
    },
    { // MyApi
      "DownstreamPathTemplate": "/MyApi/{route}",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 50890
        }
      ],
      "UpstreamPathTemplate": "/MyApi/{route}",
      "UpstreamHeaderTransform": {
        "X-Forwarded-For": "{RemoteIpAddress}"
      }
    },
    { // IdentityServer
      "DownstreamPathTemplate": "/{route}",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 50875
        }
      ],
      "UpstreamPathTemplate": "/IdentityServer/{route}",
      "UpstreamHeaderTransform": {
        "X-Forwarded-For": "{RemoteIpAddress}"
      }
    },
    { // IdentityServer
      "DownstreamPathTemplate": "/{route}",
      "DownstreamScheme": "http",
      "DownstreamHostAndPorts": [
        {
          "Host": "localhost",
          "Port": 50875
        }
      ],
      "UpstreamPathTemplate": "/{route}",
      "UpstreamHeaderTransform": {
        "X-Forwarded-For": "{RemoteIpAddress}"
      }
    }
  ]
}

          JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

            services.AddAuthentication(options =>
                {
                    options.DefaultScheme = "COOKIEs";
                    options.DefaultChallengeScheme = "oidc";
                    //options.DefaultSignInScheme = COOKIEAuthenticationDefaults.AuthenticationScheme;
                })
                .AddCOOKIE("COOKIEs",optiOns=> {
                    options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
                    options.SlidingExpiration = true;
                })
                .AddOpenIdConnect("oidc", optiOns=>
                {
                    options.SignInScheme = "COOKIEs";

                    options.Authority = "http://localhost:54660/IdentityServer";
                    options.RequireHttpsMetadata = false;

                    options.ClientId = "mvc";
                    options.ClientSecret = "secret";
                    options.ResponseType = "code id_token";

                    options.SaveTokens = true;
                    options.GetClaimsFromUserInfoEndpoint = true;

                    options.Scope.Add("api1");

                    options.Scope.Add("offline_access");
                });

   app.UseMvc(routes =>
            {
   
                    routes.MapRoute(
                        name: "default",
                        template: "MvcClient/{cOntroller=Home}/{action=index}/{id?}");
           
            });

        public async Task CallApiUsingClientCredentials()
        {
            var tokenClient = new TokenClient("http://localhost:54660/IdentityServer/connect/token", "mvc", "secret");
            var tokenRespOnse= await tokenClient.RequestClientCredentialsAsync("api1");

            var client = new HttpClient();
            client.SetBearerToken(tokenResponse.AccessToken);
            var cOntent= await client.GetStringAsync("http://localhost:54660/MyApi/identity");

            ViewBag.Json = JArray.Parse(content).ToString();
            return View("json");
        }

        public async Task CallApiUsingUserAccessToken()
        {
            var accessToken = await HttpContext.GetTokenAsync("access_token");
            //OpenIdConnectParameterNames
            var client = new HttpClient();
            client.SetBearerToken(accessToken);
            var cOntent= await client.GetStringAsync("http://localhost:54660/MyApi/identity");

            ViewBag.Json = JArray.Parse(content).ToString();
            return View("json");
        }

public class Startup
    {
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddDataProtection(options => options.ApplicatiOnDiscriminator= "00000").SetApplicationName("00000");

            services.AddMvc();
            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

            services.AddAuthentication(options =>
            {
                options.DefaultScheme = "COOKIEs";
                options.DefaultChallengeScheme = "oidc";
            }).AddCOOKIE("COOKIEs")
               .AddOpenIdConnect("oidc", optiOns=>
               {
                   options.SignInScheme = "COOKIEs";

                   options.Authority = "http://localhost:54660/IdentityServer";
                   options.RequireHttpsMetadata = false;

                   options.ClientId = "mvc";
                   options.ClientSecret = "secret";
                   options.ResponseType = "code id_token";

                   options.SaveTokens = true;
                   options.GetClaimsFromUserInfoEndpoint = true;

                   options.Scope.Add("api1");
                   options.Scope.Add("offline_access");
               })
                    .AddIdentityServerAuthentication("Bearer", optiOns=>
                     {
                         options.Authority = "http://localhost:54660/IdentityServer";
                         options.RequireHttpsMetadata = false;
                         options.ApiSecret = "secret123";
                         options.ApiName = "api1";
                         options.SupportedTokens= SupportedTokens.Both;
                     });

            services.AddAuthorization(option =>
            {
                //默认 只写 [Authorize]，表示使用oidc进行认证
                option.DefaultPolicy = new AuthorizationPolicyBuilder("oidc").RequireAuthenticatedUser().Build();
                //ApiController使用这个  [Authorize(Policy = "ApiPolicy")]，使用jwt认证方案
                option.AddPolicy("ApiPolicy", policy =>
                {
                    policy.AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme);
                    policy.RequireAuthenticatedUser();
                });
            });
        }

        public void Configure(IApplicationBuilder app, IHostingEnvironment env)
        {
            //var optiOns= new ForwardedHeadersOptions
            //{
            //    ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost,
            //    ForwardLimit = 1
            //};
            //options.KnownNetworks.Clear();
            //options.KnownProxies.Clear();
            //app.UseForwardedHeaders(options);
            //if (env.IsDevelopment())
            //{
            //    app.UseDeveloperExceptionPage();
            //}
            //else
            //{
            //    app.UseExceptionHandler("/Home/Error");
            //}

            app.UseAuthentication();

            app.UseStaticFiles();
            app.UseMvc(routes =>
            {
                routes.MapRoute(
                    name: "default",
                    template: "MyApi/{cOntroller=MAccount}/{action=Login}/{id?}");

            });
        }
    }