0、引言

1、关于Authentication与Authorization

2、整个认证流程是怎样的？

3、开始JWT身份认证

3.1 安装JwtBearer包

在.csproj项目中添加JWT包（这里添加有很多种方式，自行选择）

<PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="3.1.3" />

3.2 安装Swashbuckle.AspNetCore包

这里便于进行测试，引入Swagger工具。

<PackageReference Include="Swashbuckle.AspNetCore" Version="5.3.1" />

3.3 添加身份认证相关服务到容器中

services.AddAuthentication(options =>
{options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(options =>
{options.TokenValidationParameters = new TokenValidationParameters{ValidateIssuer = false,ValidateAudience = false,ValidateLifetime = false,ValidateIssuerSigningKey = true,ValidIssuer = "jonny",ValidAudience = "jonny",IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("secretsecretsecret"))};
});

说明

3.4 添加Swagger服务到容器中

services.AddSwaggerGen(options =>
{options.SwaggerDoc("openapi", new Microsoft.OpenApi.Models.OpenApiInfo{Title = "统一身份认证API",Description = "身份认证和授权详解",Version = "v1"});var scheme = new OpenApiSecurityScheme(){Scheme = JwtBearerDefaults.AuthenticationScheme,BearerFormat = "JWT",In = ParameterLocation.Header,//头名称Name = ApiKeyConstants.HeaderName,Type = SecuritySchemeType.ApiKey,Description = "Bearer Token"
};
options.AddSecurityDefinition(JwtBearerDefaults.AuthenticationScheme, scheme);
options.AddSecurityRequirement(new OpenApiSecurityRequirement(){{new OpenApiSecurityScheme{Reference = new OpenApiReference{Type = ReferenceType.SecurityScheme,Id = "Bearer"}},new string[] {}}});
});

aspnet core 3.x swagger与2.x有细微的差别，例如swagger中加入jwt和以前就有一定的差别。

swagger加入身份认证后出现了认证按钮。

3.5 将身份认证加入到管道中

//身份认证中间件(踩坑：授权中间件必须在认证中间件之前)
app.UseAuthentication();

3.x中身份认证一定要在UseRouting和UseEndpoints之间

3.6 将swagger加入到管道中

app.UseSwagger();
app.UseSwaggerUI(options =>
{options.RoutePrefix = string.Empty;//配置swagger端点options.SwaggerEndpoint("swagger/openapi/swagger.json", "openapi v1");
});

3.7 在需要授权的资源上加入Authorize

例如：

[HttpGet("role")]
[Authorize(Roles = "admin")]
public IEnumerable<Claim> GetRole()
{return HttpContext.User.FindAll(c => c.Type == ClaimTypes.Role);
}

这里默认使用角色授权机制

4 、测试

4.1 请求资源

这时会返回401，因为没有进行身份认证

4.2 调用登录获取token

4.3 将token添加到Header中

4.4 再次请求

这时返回403，是因为使用的jonny账户登录的没有admin权限。

4.5 切换admin账户登录

重复上面的4.3、4.4步骤 。再次测试。这时就能正常访问。

5、登录逻辑代码

public interface ICustomAuthenticationManager
{string Authenticate(string username, string password);IDictionary<string, string> Tokens { get; }
}
public class CustomAuthenticationManager : ICustomAuthenticationManager
{private readonly IDictionary<string, string> users = new Dictionary<string, string>{{ "admin", "admin" },{ "jonny", "jonny" },{ "xhl", "xhl" },{ "james", "james" }};public IDictionary<string, string> Tokens { get; } = new Dictionary<string, string>();public string Authenticate(string username, string password){var claimsIdentity = new ClaimsIdentity(new[]{new Claim(ClaimTypes.Name,username)});if (!users.Any(u => u.Key == username && u.Value == password)){return null;}if (username == "admin"){claimsIdentity.AddClaims(new[]{new Claim( ClaimTypes.Email, "xhl.jonny@gmail.com"),new Claim( "ManageId", "admin"),new Claim(ClaimTypes.Role,"admin")});}var handler = new JwtSecurityTokenHandler();var tokenDescriptor = new SecurityTokenDescriptor{Subject = claimsIdentity,Expires = DateTime.Now.AddMinutes(3),SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(Encoding.UTF8.GetBytes("secretsecretsecret")), SecurityAlgorithms.HmacSha256),};var securityToken = handler.CreateToken(tokenDescriptor);var token = handler.WriteToken(securityToken);Tokens.Add(token, username);return token;}
}