对于想了解asp.net-core–options的用途.AutomaticAuthenticatewithUseJwtBearerAuthentication的读者，本文将提供新的信息，我们将详细介

对于想了解asp.net-core – options的用途.AutomaticAuthenticate with UseJwtBearerAuthentication的读者，本文将提供新的信息，我们将详细介绍asp.net core优点，并且为您提供关于.net – IAuthenticationFilter.OnAuthenticationChallenge()的目的是什么、Asp.net core Authentication and Authorization、ASP.NET Core JWTAuthentication 和 Authorize 角色声明、asp.net webapi UseOAuthBearerAuthentication vs UseJwtBearerAuthentication的有价值信息。

• asp.net-core – options的用途.AutomaticAuthenticate with UseJwtBearerAuthentication（asp.net core优点）
• .net – IAuthenticationFilter.OnAuthenticationChallenge()的目的是什么
• Asp.net core Authentication and Authorization
• ASP.NET Core JWTAuthentication 和 Authorize 角色声明
• asp.net webapi UseOAuthBearerAuthentication vs UseJwtBearerAuthentication

asp.net-core – options的用途.AutomaticAuthenticate with UseJwtBearerAuthentication（asp.net core优点）

Unable to cast object of type 'Newtonsoft.Json.Linq.JArray' to type 'System.IConvertible'.

app.UseJwtBearerAuthentication(options =>
    {
        options.AutomaticAuthenticate = true; 
    }

at System.Convert.ToInt32(Object value,IFormatProvider provider)
   at System.IdentityModel.Tokens.Jwt.JwtPayload.GetIntClaim(String claimType)
   at System.IdentityModel.Tokens.Jwt.JwtPayload.get_Nbf()
   at System.IdentityModel.Tokens.Jwt.JwtSecurityTokenHandler.Validatetoken(String token,TokenValidationParameters validationParameters,SecurityToken& validatedToken)
   at Microsoft.AspNet.Authentication.JwtBearer.JwtBearerHandler.<HandleAuthenticateAsync>d__1.MoveNext()
--- End of stack trace from prevIoUs location where exception was thrown ---
   at System.Runtime.ExceptionServices.ExceptiondispatchInfo.Throw()
   at Microsoft.AspNet.Authentication.JwtBearer.JwtBearerHandler.<HandleAuthenticateAsync>d__1.MoveNext()
--- End of stack trace from prevIoUs location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
   at Microsoft.AspNet.Authentication.AuthenticationHandler`1.<InitializeAsync>d__48.MoveNext()
--- End of stack trace from prevIoUs location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
   at Microsoft.AspNet.Authentication.AuthenticationMiddleware`1.<Invoke>d__18.MoveNext()
--- End of stack trace from prevIoUs location where exception was thrown ---
   at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
   at System.Runtime.CompilerServices.TaskAwaiter.GetResult()
   at Api.Startup.<<Configure>b__9_0>d.MoveNext() in ...\Startup.cs:line 156

[Authorize(AuthenticationSchemes = "YourBearerSchemeName")]

options.AddPolicy("RequireBearer",policy =>
{
    policy.AuthenticationSchemes.Add("YourBearerSchemeName");
    policy.RequireAuthenticatedUser();

});

.net – IAuthenticationFilter.OnAuthenticationChallenge()的目的是什么

Asp.net core Authentication and Authorization

之前有写过关于这些的文章, 本来想认证写一个系类的，但是感觉非常大. 太多工了.

先记入一些零零散散的. 看看以后要不要整理起来。

refer resources : 

https://www.cnblogs.com/stulzq 晓晨博客 

https://www.cnblogs.com/sheng-jie/p/9430920.html 圣杰博客 identity server 4 知多少

https://www.cnblogs.com/sheng-jie/p/6564520.html 圣杰博客 oauth 2.0 知多少

Access token type, self-contained (self-encoded type) vs reference (identifier type)

access token 有 2 种, 一种是作为一个 reference key, 每当 resource server 拿到 access token 后并不能知道授权的具体信息. 

而是需要用 token 去访问 autho server 获取授权信息. 这个做法的缺点就是每次都要去访问 autho server 性能可能有点伤, 好处就是可以立刻 revoke token

另一种叫 self-contained 当 resource server 拿到 access token 后它自己就可以解锁. 这里用的是不对称加密. 私钥加密，公钥解锁. 

好处就是不用每次去 autho server 咯, 性能快一点, 坏处就是你无法立刻去 revoke token. 而是需要等它自己过期. 所以 access token 就要设置时间段, 而 refresh token 就需要一直去续命. 

oauth 没有规定用哪一种, 建议大家自己去做 balance 权衡.

相关的资源 : 

https://www.oauth.com/oauth2-servers/listing-authorizations/revoking-access/

https://www.oauth.com/oauth2-servers/access-tokens/self-encoded-access-tokens/

https://darutk.medium.com/oauth-access-token-implementation-30c2e8b90ff0

https://docs.wso2.com/m/mobile.action#page/76748735

https://docs.wso2.com/display/IS540/Self-contained+Access+Tokens

ASP.NET Core JWTAuthentication 和 Authorize 角色声明

我也不确定“权限”是怎么回事，但假设您获得了角色......

您可以简单地以这种方式重构它，并将声明列表添加到您传递给 ClaimsIdentity 的集合中：

        private async Task<string> GenerateJwtToken(UserDto user)
        {
            // generate token that is valid for 7 days
            var tokenHandler = new JwtSecurityTokenHandler();
            var key = Encoding.ASCII.GetBytes(_appSettings.Secret);
            var claims = new List<Claim>(await FetchClaims(user.UserAccountId)) {
                new Claim("userAccountId",user.UserAccountId.ToString())
            };
            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = new ClaimsIdentity(claims),Expires = DateTime.UtcNow.AddHours(_appSettings.JwtExpiryHours),SigningCredentials =
                    new SigningCredentials(new SymmetricSecurityKey(key),SecurityAlgorithms.HmacSha256Signature)
            };

            var token = tokenHandler.CreateToken(tokenDescriptor);
            return tokenHandler.WriteToken(token);
        }

        private async Task<IEnumerable<Claim>> FetchClaims(int userId)
        {
            var userPermissions = await GetUserPermissionsByUserId(userId);

            return userPermissions
                .Select(x => new Claim(ClaimTypes.Role,x.PermissionName));
        }

（如果需要，您也可以使用 JwtSecurityToken 代替 SecurityTokenDescriptor；它直接接受 IEnumerable<Claim>。）

诚然，我已经有一段时间没有使用角色了，所以如果它不起作用，请告诉我。但是从快速的谷歌搜索来看，向令牌添加多个 Role 声明似乎是合法的。 [编辑：我测试了添加多个角色声明并针对它们进行授权，它对我有用。]

asp.net webapi UseOAuthBearerAuthentication vs UseJwtBearerAuthentication

关于asp.net-core – options的用途.AutomaticAuthenticate with UseJwtBearerAuthentication和asp.net core优点的问题我们已经讲解完毕，感谢您的阅读，如果还想了解更多关于.net – IAuthenticationFilter.OnAuthenticationChallenge()的目的是什么、Asp.net core Authentication and Authorization、ASP.NET Core JWTAuthentication 和 Authorize 角色声明、asp.net webapi UseOAuthBearerAuthentication vs UseJwtBearerAuthentication等相关内容，可以在本站寻找。