/// <summary>
/// 获取基于JWT的Token
/// </summary>
/// <param name="claims">需要在登陆的时候配置</param>
/// <param name="permissionRequirement">在startup中定义的参数</param>
/// <returns></returns>
public static TokenInfoViewModel BuildJwtToken(Claim[] claims, PermissionRequirement permissionRequirement)
{
var now = DateTime.Now;
// 实例化JwtSecurityToken
var jwt = new JwtSecurityToken(
issuer: permissionRequirement.Issuer,
audience: permissionRequirement.Audience,
claims: claims,
notBefore: now,
expires: now.Add(permissionRequirement.Expiration),
signingCredentials: permissionRequirement.SigningCredentials
);
// 生成 Token
var encodedJwt = new JwtSecurityTokenHandler().WriteToken(jwt);
//打包返回前台
var responseJson = new TokenInfoViewModel
{
success = true,
token = encodedJwt,
expires_in = permissionRequirement.Expiration.TotalSeconds,
token_type = "Bearer"
};
return(responseJson);
}
public static void AddAuthorizationSetup(this IServiceCollection services)
{
if (services == null)
{
throw new ArgumentNullException(nameof(services));
}
//var serctKey = Configuration.GetValue<string>("TokenKey");
//var jwtKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(serctKey));//加密验证的key
//var jwtCreds = new SigningCredentials(jwtKey, SecurityAlgorithms.HmacSha256); //根据key' 生成的标识
var jwtKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("xiaoqixiaoqixiaoqixiaoqixiaoqixiaoqixiaoqi")); //加密验证的key
var jwtCreds = new SigningCredentials(jwtKey, SecurityAlgorithms.HmacSha256); //根据key' 生成的标识
var permissions = new List <PermissionItem>(); //用户角色和用户拥有的api 集合 ，该角色只能访问其拥有的api
var jwtRequirement = new PermissionRequirement(
"",
permissions,
ClaimTypes.Role,
"Issuer",
"Audience",
jwtCreds,
TimeSpan.FromSeconds(60 * 60 * 24 * 365)
);
services.AddSingleton(jwtRequirement);//将该资源注册，可以在验证处理器种设置其值
//注册策略授权
services.AddAuthorizationCore(o =>
{
o.AddPolicy("MyPolicy", policy => policy.Requirements.Add(jwtRequirement));
});
//验证参数设置
var tokenValidationParameters = new TokenValidationParameters
{
ValidateIssuerSigningKey = true,
IssuerSigningKey = jwtKey,
ValidateIssuer = true,
ValidIssuer = "Issuer", //发行人
ValidateAudience = true,
ValidAudience = "Audience", //订阅人
ValidateLifetime = true,
ClockSkew = TimeSpan.FromSeconds(30),
RequireExpirationTime = true,
};
// 开启Bearer认证
services.AddAuthentication(o =>
{
o.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
o.DefaultChallengeScheme = nameof(ApiResponseHandler);
o.DefaultForbidScheme = nameof(ApiResponseHandler);
})
// 添加JwtBearer服务
.AddJwtBearer(o =>
{
o.TokenValidationParameters = tokenValidationParameters;
o.Events = new JwtBearerEvents
{
OnAuthenticationFailed = context =>
{
// 如果过期，则把<是否过期>添加到，返回头信息中
if (context.Exception.GetType() == typeof(SecurityTokenExpiredException))
{
context.Response.Headers.Add("Token-Expired", "true");
}
return(Task.CompletedTask);
}
};
})
.AddScheme <AuthenticationSchemeOptions, ApiResponseHandler>(nameof(ApiResponseHandler), o => { });
// 注入权限处理器
services.AddScoped <IAuthorizationHandler, PermissionHandler>();
services.AddSingleton <IHttpContextAccessor, HttpContextAccessor>();
}