keycloak~uma遠端資源授權對接asp.net core

語言: CN / TW / HK

官方的keycloak的介面卡並沒有提供.net版本的,所以我們需要自己去實現一下,目前打算把資源伺服器對接KC之後,讓資源伺服器的API介面通過KC的UMA授權方式來管理起來,所以需要對這個功能進行開發,springboot版本官方已經實現,.net core版本我們自己實現了一下,對UMA授權不清楚的同學可以先看我這篇文章《 keycloak~授權功能的使用 》。

  • 新增標準的依賴包
<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="3.1.13" />
  • 如果你只用kc做認證,授權自己去實現,你可以直接引用OIDC包,然後對OIDC產生的token進行解析,拿到kc頒發的角色即可
<PackageReference Include="Microsoft.AspNetCore.Authentication.OpenIdConnect" Version="3.1.13" />
  • OIDC方式,本例子中的實現,當用戶沒有登入時,會重定向到KC登入頁進行認證
/// <summary>
        /// OIDC認證
        /// </summary>
        /// <param name="services"></param>
        /// <param name="configuration"></param>
        /// <param name="scopes"></param>
        /// <returns></returns>
        public static AuthenticationBuilder addKcOidc(this IServiceCollection services, IConfiguration configuration, ICollection<string> scopes)
        {
            return services.AddAuthentication(options =>
            {
                options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
            })
              .AddCookie()//開啟cookie的支援
              .AddOpenIdConnect(options =>
            {
                options.Authority = configuration["Oidc:Authority"];
                options.ClientId = configuration["Oidc:ClientId"];
                options.ClientSecret = configuration["Oidc:ClientSecret"];
                options.SaveTokens = true;
                options.ResponseType = OpenIdConnectResponseType.CodeIdTokenToken;
                options.RequireHttpsMetadata = false;
                options.GetClaimsFromUserInfoEndpoint = true;
                options.SaveTokens = true;
                options.Scope.Clear();
                foreach (var scope in scopes)
                {
                    options.Scope.Add(scope);
                }

                options.Events = new OpenIdConnectEvents
                {

                    OnTokenValidated = context =>
                    {
                        //獲取到了id_token
                        var identity = context.Principal.Identity as ClaimsIdentity;

                        var token = context.ProtocolMessage.AccessToken;
                        if (token != null)
                        {
                            var payload = token.Split(".")[1];
                            string payloadJson = Encoding.UTF8.GetString(Base64UrlDecode(payload));
                            JObject json = JObject.Parse(payloadJson);

                            if (json.ContainsKey("realm_access"))
                            {
                                var access = json["realm_access"].Values();
                                foreach (var role in access.Values())
                                {
                                    identity.AddClaim(new Claim(ClaimTypes.Role, role.ToString()));
                                }

                            }
                            // 客戶端角色

                            if (json.ContainsKey("resource_access"))
                            {
                                var access = json["resource_access"].Values();
                                foreach (var role in access["roles"].Values())
                                {
                                    identity.AddClaim(new Claim(ClaimTypes.Role, role.ToString()));
                                }
                            }
                        }

                        return Task.CompletedTask;
                    },
                    OnTokenResponseReceived = context =>
                    {
                        return Task.CompletedTask;
                    },
                };


            });
        }
  • UMA遠端授權,本例子中,當用戶訪問介面時,沒有帶著token,將返回401,如果token沒有許可權將返回403
/// <summary>
        /// uma遠端資源
        /// </summary>
        /// <param name="services"></param>
        /// <param name="configuration"></param>
        /// <param name="scopes"></param>
        /// <returns></returns>
        public static AuthenticationBuilder addKcUma(this IServiceCollection services, IConfiguration configuration)
        {
            return services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =>
            {
                options.Authority = configuration["Oidc:Authority"];
                options.Audience = configuration["Oidc:ClientId"];
                options.IncludeErrorDetails = true;
                options.RequireHttpsMetadata = false;
                options.SaveToken = true;
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateAudience = false,
                    ValidateIssuer = true,
                    ValidIssuer = configuration["Oidc:Authority"],
                    ValidateLifetime = false
                };

                options.Events = new JwtBearerEvents
                {


                    OnTokenValidated = context =>
                    {
                        //獲取到了id_token
                        var identity = context.Principal.Identity as ClaimsIdentity;

                        if (context.Request.Headers.ContainsKey(AuthName))
                        {
                            var token = context.Request.Headers[AuthName].ToString();
                            if (token != null)
                            {
                                var provider = services.BuildServiceProvider();//get an instance of IServiceProvider
                                var clientFactory = provider.GetService<IHttpClientFactory>();
                                string uma = getUmaToken(clientFactory, options.Authority, options.Audience, token).Result;
                                // 客戶端所擁有的資源
                                List<UmaResource> umaResources = getUmaPermissions(uma);
                                // 本伺服器的所有資源
                                List<string> allResources = getServerUmaPermissions(clientFactory, options.Authority, options.Audience, configuration["Oidc:ClientSecret"]).Result;
                                // 過濾本伺服器的資源
                                umaResources = umaResources.Where(i => allResources.Contains(i.rsid)).ToList();
                                // 當前url
                                string currentUrl = context.Request.Path;
                                foreach (UmaResource item in umaResources)
                                {
                                    // 校驗當前url是否在客戶端授權的url中
                                    List<string> urls = getUmaUrls(clientFactory, options.Authority, item.rsid, token).Result;
                                    foreach (string url in urls)
                                    {
                                        if (url.EndsWith("*"))
                                        {
                                            if (currentUrl.Contains(url.TrimEnd('*')))
                                                return Task.CompletedTask;
                                        }
                                        else
                                        {
                                            if (url.Equals(currentUrl))
                                                return Task.CompletedTask;
                                        }
                                    }

                                }
                            }
                        }
                        var payload = JsonConvert.SerializeObject(new { Code = "403", Message = "很抱歉,您無權訪問該介面" });
                        context.Response.ContentType = "application/json";
                        context.Response.StatusCode = StatusCodes.Status403Forbidden;
                        context.Response.WriteAsync(payload);
                        return Task.FromResult(0);
                    }


                };

            });


        }
  • 在startup中去註冊我們的認證方式
public void ConfigureServices(IServiceCollection services)
{
           
            services.AddControllers();
            services.addKcUma(Configuration);
            services.AddAuthorization();
            services.AddHttpClient();
}
  • 未認證的資源將出現403的結果