目录
- identityserver4源码解析_1_项目结构
- identityserver4源码解析_2_元数据接口
- identityserver4源码解析_3_认证接口
- identityserver4源码解析_4_令牌发放接口
- identityserver4源码解析_5_查询用户信息接口
- identityserver4源码解析_6_结束会话接口
- identityserver4源码解析_7_查询令牌信息接口
- identityserver4源码解析_8_撤销令牌接口
简介
security源码解析系列介绍了微软提供的各种认证架构，其中oauth2.0，openidconnect属于远程认证架构，所谓远程认证，是指token的颁发是由其他站点完成的。
identityserver4是基于openidconnect协议的认证中心框架，可以帮助我们快速搭建微服务认证中心。
初学者可能看到生涩的概念比较头疼，可以将oauth, openidconnect协议简单理解成需求文档，idsv4基于需求提供了一系列的api实现。
对于idsv还不太了解的可以看下面的资料，本系列主要学习梳理idsv4的源码，结合协议加深理解。
晓晨姐姐系列文章
官方文档
项目结构
项目地址如下
https://github.com/identityserver/identityserver4
克隆到本地，项目结构如图
核心项目是identityserver4，其余的都是与微软框架集成、以及处理持久化的项目。
项目结构如图。endpoints文件夹就是接口文件，我们先看下依赖注入、中间件的代码，然后看下每个接口。
依赖注入
public static iidentityserverbuilder addidentityserver(this iservicecollection services)
{
var builder = services.addidentityserverbuilder();
builder
.addrequiredplatformservices()
.addcookieauthentication()
.addcoreservices()
.adddefaultendpoints()
.addpluggableservices()
.addvalidators()
.addresponsegenerators()
.adddefaultsecretparsers()
.adddefaultsecretvalidators();
// provide default in-memory implementation, not suitable for most production scenarios
builder.addinmemorypersistedgrants();
return builder;
}
- addrequiredplatformservices – 注入平台服务
- ihttpcontextaccessor：httpcontext访问器
- identityserveroptions：配置类
public static iidentityserverbuilder addrequiredplatformservices(this iidentityserverbuilder builder)
{
builder.services.tryaddsingleton<ihttpcontextaccessor, httpcontextaccessor>();
builder.services.addoptions();
builder.services.addsingleton(
resolver => resolver.getrequiredservice<ioptions<identityserveroptions>>().value);
builder.services.addhttpclient();
return builder;
}
- addcookieauthentication – 注入cookie服务
- 注入名称为idsrv的cookie认证架构
- 注入iauthenticationservice的实现identityserverauthenticationservice
- 注入iauthenticationhandlerprovider的实现federatedsignoutauthenticationhandlerprovider
public static iidentityserverbuilder addcookieauthentication(this iidentityserverbuilder builder)
{
builder.services.addauthentication(identityserverconstants.defaultcookieauthenticationscheme)
.addcookie(identityserverconstants.defaultcookieauthenticationscheme)
.addcookie(identityserverconstants.externalcookieauthenticationscheme);
builder.services.addsingleton<iconfigureoptions<cookieauthenticationoptions>, configureinternalcookieoptions>();
builder.services.addsingleton<ipostconfigureoptions<cookieauthenticationoptions>, postconfigureinternalcookieoptions>();
builder.services.addtransientdecorator<iauthenticationservice, identityserverauthenticationservice>();
builder.services.addtransientdecorator<iauthenticationhandlerprovider, federatedsignoutauthenticationhandlerprovider>();
return builder;
}
- addcoreservices – 注入核心服务
/// <summary>
/// adds the core services.
/// </summary>
/// <param name="builder">the builder.</param>
/// <returns></returns>
public static iidentityserverbuilder addcoreservices(this iidentityserverbuilder builder)
{
builder.services.addtransient<secretparser>();
builder.services.addtransient<secretvalidator>();
builder.services.addtransient<scopevalidator>();
builder.services.addtransient<extensiongrantvalidator>();
builder.services.addtransient<bearertokenusagevalidator>();
builder.services.addtransient<jwtrequestvalidator>();
// todo: remove in 3.0
#pragma warning disable cs0618 // type or member is obsolete
builder.services.addtransient<backchannelhttpclient>();
#pragma warning restore cs0618 // type or member is obsolete
builder.services.addtransient<returnurlparser>();
builder.services.addtransient<identityservertools>();
builder.services.addtransient<ireturnurlparser, oidcreturnurlparser>();
builder.services.addscoped<iusersession, defaultusersession>();
builder.services.addtransient(typeof(messagecookie<>));
builder.services.addcors();
builder.services.addtransientdecorator<icorspolicyprovider, corspolicyprovider>();
return builder;
}
- adddefaultendpoints – 注入接口
- authorizecallbackendpoint：认证回调接口
- authorizeendpoint：认证接口
- checksessionendpoint：检查会话接口
- deviceauthorizationendpoint：设备认证接口
- discoveryendpoint：元数据键接口
- discoveryendpoint：元数据接口
- endsessioncallbackendpoint：结束会话回调接口
- endsessionendpoint：结束会话接口
- introspectionendpoint：查询令牌信息接口
- tokenrevocationendpoint：撤销令牌接口
- tokenendpoint：发放令牌接口
- userinfoendpoint：查询用户信息接口
注入所有默认接口，包括接口名称和地址。请求进来之后，路由类endpointrouter通过路由来寻找匹配的处理器。
public static iidentityserverbuilder adddefaultendpoints(this iidentityserverbuilder builder)
{
builder.services.addtransient<iendpointrouter, endpointrouter>();
builder.addendpoint<authorizecallbackendpoint>(endpointnames.authorize, protocolroutepaths.authorizecallback.ensureleadingslash());
builder.addendpoint<authorizeendpoint>(endpointnames.authorize, protocolroutepaths.authorize.ensureleadingslash());
builder.addendpoint<checksessionendpoint>(endpointnames.checksession, protocolroutepaths.checksession.ensureleadingslash());
builder.addendpoint<deviceauthorizationendpoint>(endpointnames.deviceauthorization, protocolroutepaths.deviceauthorization.ensureleadingslash());
builder.addendpoint<discoverykeyendpoint>(endpointnames.discovery, protocolroutepaths.discoverywebkeys.ensureleadingslash());
builder.addendpoint<discoveryendpoint>(endpointnames.discovery, protocolroutepaths.discoveryconfiguration.ensureleadingslash());
builder.addendpoint<endsessioncallbackendpoint>(endpointnames.endsession, protocolroutepaths.endsessioncallback.ensureleadingslash());
builder.addendpoint<endsessionendpoint>(endpointnames.endsession, protocolroutepaths.endsession.ensureleadingslash());
builder.addendpoint<introspectionendpoint>(endpointnames.introspection, protocolroutepaths.introspection.ensureleadingslash());
builder.addendpoint<tokenrevocationendpoint>(endpointnames.revocation, protocolroutepaths.revocation.ensureleadingslash());
builder.addendpoint<tokenendpoint>(endpointnames.token, protocolroutepaths.token.ensureleadingslash());
builder.addendpoint<userinfoendpoint>(endpointnames.userinfo, protocolroutepaths.userinfo.ensureleadingslash());
return builder;
}
- addpluggableservices – 注入可插拔服务
public static iidentityserverbuilder addpluggableservices(this iidentityserverbuilder builder)
{
builder.services.tryaddtransient<ipersistedgrantservice, defaultpersistedgrantservice>();
builder.services.tryaddtransient<ikeymaterialservice, defaultkeymaterialservice>();
builder.services.tryaddtransient<itokenservice, defaulttokenservice>();
builder.services.tryaddtransient<itokencreationservice, defaulttokencreationservice>();
builder.services.tryaddtransient<iclaimsservice, defaultclaimsservice>();
builder.services.tryaddtransient<irefreshtokenservice, defaultrefreshtokenservice>();
builder.services.tryaddtransient<ideviceflowcodeservice, defaultdeviceflowcodeservice>();
builder.services.tryaddtransient<iconsentservice, defaultconsentservice>();
builder.services.tryaddtransient<icorspolicyservice, defaultcorspolicyservice>();
builder.services.tryaddtransient<iprofileservice, defaultprofileservice>();
builder.services.tryaddtransient<iconsentmessagestore, consentmessagestore>();
builder.services.tryaddtransient<imessagestore<logoutmessage>, protecteddatamessagestore<logoutmessage>>();
builder.services.tryaddtransient<imessagestore<endsession>, protecteddatamessagestore<endsession>>();
builder.services.tryaddtransient<imessagestore<errormessage>, protecteddatamessagestore<errormessage>>();
builder.services.tryaddtransient<iidentityserverinteractionservice, defaultidentityserverinteractionservice>();
builder.services.tryaddtransient<ideviceflowinteractionservice, defaultdeviceflowinteractionservice>();
builder.services.tryaddtransient<iauthorizationcodestore, defaultauthorizationcodestore>();
builder.services.tryaddtransient<irefreshtokenstore, defaultrefreshtokenstore>();
builder.services.tryaddtransient<ireferencetokenstore, defaultreferencetokenstore>();
builder.services.tryaddtransient<iuserconsentstore, defaultuserconsentstore>();
builder.services.tryaddtransient<ihandlegenerationservice, defaulthandlegenerationservice>();
builder.services.tryaddtransient<ipersistentgrantserializer, persistentgrantserializer>();
builder.services.tryaddtransient<ieventservice, defaulteventservice>();
builder.services.tryaddtransient<ieventsink, defaulteventsink>();
builder.services.tryaddtransient<iusercodeservice, defaultusercodeservice>();
builder.services.tryaddtransient<iusercodegenerator, numericusercodegenerator>();
builder.services.tryaddtransient<ibackchannellogoutservice, defaultbackchannellogoutservice>();
builder.addjwtrequesturihttpclient();
builder.addbackchannellogouthttpclient();
//builder.services.addhttpclient<backchannellogouthttpclient>();
//builder.services.addhttpclient<jwtrequesturihttpclient>();
builder.services.addtransient<iclientsecretvalidator, clientsecretvalidator>();
builder.services.addtransient<iapisecretvalidator, apisecretvalidator>();
builder.services.tryaddtransient<ideviceflowthrottlingservice, distributeddeviceflowthrottlingservice>();
builder.services.adddistributedmemorycache();
return builder;
}
- addvalidators – 注入校验类
public static iidentityserverbuilder addvalidators(this iidentityserverbuilder builder)
{
// core
builder.services.tryaddtransient<iendsessionrequestvalidator, endsessionrequestvalidator>();
builder.services.tryaddtransient<itokenrevocationrequestvalidator, tokenrevocationrequestvalidator>();
builder.services.tryaddtransient<iauthorizerequestvalidator, authorizerequestvalidator>();
builder.services.tryaddtransient<itokenrequestvalidator, tokenrequestvalidator>();
builder.services.tryaddtransient<iredirecturivalidator, strictredirecturivalidator>();
builder.services.tryaddtransient<itokenvalidator, tokenvalidator>();
builder.services.tryaddtransient<iintrospectionrequestvalidator, introspectionrequestvalidator>();
builder.services.tryaddtransient<iresourceownerpasswordvalidator, notsupportedresourceownerpasswordvalidator>();
builder.services.tryaddtransient<icustomtokenrequestvalidator, defaultcustomtokenrequestvalidator>();
builder.services.tryaddtransient<iuserinforequestvalidator, userinforequestvalidator>();
builder.services.tryaddtransient<iclientconfigurationvalidator, defaultclientconfigurationvalidator>();
builder.services.tryaddtransient<ideviceauthorizationrequestvalidator, deviceauthorizationrequestvalidator>();
builder.services.tryaddtransient<idevicecodevalidator, devicecodevalidator>();
// optional
builder.services.tryaddtransient<icustomtokenvalidator, defaultcustomtokenvalidator>();
builder.services.tryaddtransient<icustomauthorizerequestvalidator, defaultcustomauthorizerequestvalidator>();
return builder;
}
- addresponsegenerators – 注入响应生成类
public static iidentityserverbuilder addresponsegenerators(this iidentityserverbuilder builder)
{
builder.services.tryaddtransient<itokenresponsegenerator, tokenresponsegenerator>();
builder.services.tryaddtransient<iuserinforesponsegenerator, userinforesponsegenerator>();
builder.services.tryaddtransient<iintrospectionresponsegenerator, introspectionresponsegenerator>();
builder.services.tryaddtransient<iauthorizeinteractionresponsegenerator, authorizeinteractionresponsegenerator>();
builder.services.tryaddtransient<iauthorizeresponsegenerator, authorizeresponsegenerator>();
builder.services.tryaddtransient<idiscoveryresponsegenerator, discoveryresponsegenerator>();
builder.services.tryaddtransient<itokenrevocationresponsegenerator, tokenrevocationresponsegenerator>();
builder.services.tryaddtransient<ideviceauthorizationresponsegenerator, deviceauthorizationresponsegenerator>();
return builder;
}
- adddefaultsecretparsers & adddefaultsecretvalidators
/// <summary>
/// adds the default secret parsers.
/// </summary>
/// <param name="builder">the builder.</param>
/// <returns></returns>
public static iidentityserverbuilder adddefaultsecretparsers(this iidentityserverbuilder builder)
{
builder.services.addtransient<isecretparser, basicauthenticationsecretparser>();
builder.services.addtransient<isecretparser, postbodysecretparser>();
return builder;
}
/// <summary>
/// adds the default secret validators.
/// </summary>
/// <param name="builder">the builder.</param>
/// <returns></returns>
public static iidentityserverbuilder adddefaultsecretvalidators(this iidentityserverbuilder builder)
{
builder.services.addtransient<isecretvalidator, hashedsharedsecretvalidator>();
return builder;
}
identityserveroptions – 配置类
/// <summary>
/// the identityserveroptions class is the top level container for all configuration settings of identityserver.
/// </summary>
public class identityserveroptions
{
/// <summary>
/// gets or sets the unique name of this server instance, e.g. https://myissuer.com.
/// if not set, the issuer name is inferred from the request
/// </summary>
/// <value>
/// unique name of this server instance, e.g. https://myissuer.com
/// </value>
public string issueruri { get; set; }
/// <summary>
/// gets or sets the origin of this server instance, e.g. https://myorigin.com.
/// if not set, the origin name is inferred from the request
/// note: do not set a url or include a path.
/// </summary>
/// <value>
/// origin of this server instance, e.g. https://myorigin.com
/// </value>
public string publicorigin { get; set; }
/// <summary>
/// gets or sets the value for the jwt typ header for access tokens.
/// </summary>
/// <value>
/// the jwt typ value.
/// </value>
public string accesstokenjwttype { get; set; } = "at+jwt";
/// <summary>
/// emits an aud claim with the format issuer/resources. that's needed for some older access token validation plumbing. defaults to false.
/// </summary>
public bool emitlegacyresourceaudienceclaim { get; set; } = false;
/// <summary>
/// gets or sets the endpoint configuration.
/// </summary>
/// <value>
/// the endpoints configuration.
/// </value>
public endpointsoptions endpoints { get; set; } = new endpointsoptions();
/// <summary>
/// gets or sets the discovery endpoint configuration.
/// </summary>
/// <value>
/// the discovery endpoint configuration.
/// </value>
public discoveryoptions discovery { get; set; } = new discoveryoptions();
/// <summary>
/// gets or sets the authentication options.
/// </summary>
/// <value>
/// the authentication options.
/// </value>
public authenticationoptions authentication { get; set; } = new authenticationoptions();
/// <summary>
/// gets or sets the events options.
/// </summary>
/// <value>
/// the events options.
/// </value>
public eventsoptions events { get; set; } = new eventsoptions();
/// <summary>
/// gets or sets the max input length restrictions.
/// </summary>
/// <value>
/// the length restrictions.
/// </value>
public inputlengthrestrictions inputlengthrestrictions { get; set; } = new inputlengthrestrictions();
/// <summary>
/// gets or sets the options for the user interaction.
/// </summary>
/// <value>
/// the user interaction options.
/// </value>
public userinteractionoptions userinteraction { get; set; } = new userinteractionoptions();
/// <summary>
/// gets or sets the caching options.
/// </summary>
/// <value>
/// the caching options.
/// </value>
public cachingoptions caching { get; set; } = new cachingoptions();
/// <summary>
/// gets or sets the cors options.
/// </summary>
/// <value>
/// the cors options.
/// </value>
public corsoptions cors { get; set; } = new corsoptions();
/// <summary>
/// gets or sets the content security policy options.
/// </summary>
public cspoptions csp { get; set; } = new cspoptions();
/// <summary>
/// gets or sets the validation options.
/// </summary>
public validationoptions validation { get; set; } = new validationoptions();
/// <summary>
/// gets or sets the device flow options.
/// </summary>
public deviceflowoptions deviceflow { get; set; } = new deviceflowoptions();
/// <summary>
/// gets or sets the mutual tls options.
/// </summary>
public mutualtlsoptions mutualtls { get; set; } = new mutualtlsoptions();
}
useridentityserver – 中间件逻辑
- 执行校验
- baseurlmiddleware中间件：设置baseurl
- 配置cors跨域：corspolicyprovider根据client信息生成动态策略
- identityservermiddlewareoptions默认调用了useauthentication，所以如果使用identityserver不用重复注册authentication中间件
- 使用mutualtlstokenendpointmiddleware中间件：要求客户端、服务端都使用https，默认不开启
- 使用identityservermiddleware中间件：iendpointrouter根据请求寻找匹配的iendpointhandler，如果找到的话则由endpointhandler处理请求。
public static iapplicationbuilder useidentityserver(this iapplicationbuilder app, identityservermiddlewareoptions options = null)
{
app.validate();
app.usemiddleware<baseurlmiddleware>();
app.configurecors();
// it seems ok if we have useauthentication more than once in the pipeline --
// this will just re-run the various callback handlers and the default authn
// handler, which just re-assigns the user on the context. claims transformation
// will run twice, since that's not cached (whereas the authn handler result is)
// related: https://github.com/aspnet/security/issues/1399
if (options == null) options = new identityservermiddlewareoptions();
options.authenticationmiddleware(app);
app.usemiddleware<mutualtlstokenendpointmiddleware>();
app.usemiddleware<identityservermiddleware>();
return app;
}
核心中间件identityservermiddleware的代码，逻辑比较清晰
- iendpointrouter路由类旬斋匹配接口
- 匹配接口处理请求返回结果iendpointresult
- iendpointresult执行结果，写入上下文，返回报文
public async task invoke(httpcontext context, iendpointrouter router, iusersession session, ieventservice events)
{
// this will check the authentication session and from it emit the check session
// cookie needed from js-based signout clients.
await session.ensuresessionidcookieasync();
try
{
var endpoint = router.find(context);
if (endpoint != null)
{
_logger.loginformation("invoking identityserver endpoint: {endpointtype} for {url}", endpoint.gettype().fullname, context.request.path.tostring());
var result = await endpoint.processasync(context);
if (result != null)
{
_logger.logtrace("invoking result: {type}", result.gettype().fullname);
await result.executeasync(context);
}
return;
}
}
catch (exception ex)
{
await events.raiseasync(new unhandledexceptionevent(ex));
_logger.logcritical(ex, "unhandled exception: {exception}", ex.message);
throw;
}
await _next(context);
}
看一下路由类的处理逻辑
之前adddefaultendpoints注入了所有默认接口，路由类可以通过依赖注入拿到所有接口信息，将请求地址与接口地址对比得到匹配的接口，然后从容器拿到对应的接口处理器。
public endpointrouter(ienumerable<endpoint> endpoints, identityserveroptions options, ilogger<endpointrouter> logger)
{
_endpoints = endpoints;
_options = options;
_logger = logger;
}
public iendpointhandler find(httpcontext context)
{
if (context == null) throw new argumentnullexception(nameof(context));
foreach(var endpoint in _endpoints)
{
var path = endpoint.path;
if (context.request.path.equals(path, stringcomparison.ordinalignorecase))
{
var endpointname = endpoint.name;
_logger.logdebug("request path {path} matched to endpoint type {endpoint}", context.request.path, endpointname);
return getendpointhandler(endpoint, context);
}
}
_logger.logtrace("no endpoint entry found for request path: {path}", context.request.path);
return null;
}
private iendpointhandler getendpointhandler(endpoint endpoint, httpcontext context)
{
if (_options.endpoints.isendpointenabled(endpoint))
{
var handler = context.requestservices.getservice(endpoint.handler) as iendpointhandler;
if (handler != null)
{
_logger.logdebug("endpoint enabled: {endpoint}, successfully created handler: {endpointhandler}", endpoint.name, endpoint.handler.fullname);
return handler;
}
else
{
_logger.logdebug("endpoint enabled: {endpoint}, failed to create handler: {endpointhandler}", endpoint.name, endpoint.handler.fullname);
}
}
else
{
_logger.logwarning("endpoint disabled: {endpoint}", endpoint.name);
}
return null;
}
总结
主干流程大致如图
idsv的代码量还是比较大的，有很多的类，但是代码还是要写的挺规范清晰，梳理下来脉络还是很明了的。
黄山市民网：https://www.huangshanshimin.com/
