.Net Core中自定义认证实现

更新时间:2023-04-04 17:56:48 阅读：评论：0

一、起因

　最近项目中需要对项目同时支持jwt认证，以及自定义的认证校验方式认证。通过对官方文档了解，得到认证实现主要通过继承 iauthenticationhandler 或 authenticationhandler<toptions>来实现自定义认证的处理。　

　那么接下来实现一个自定义的认证访问。

二、自定义认证实现

　1、根据前面内容得知，处理认证通过iauthenticationhandler 实例处理；那么首先添加一个自定义iauthenticationhandler 类型：

/// <summary>/// 方式一：自定义认证处理器/// </summary>public class customerauthenticationhandler : iauthenticationhandler{  private iurrvice _urrvice;  public customerauthenticationhandler(iurrvice urrvice)  {    _urrvice = urrvice;  }  /// <summary>  /// 自定义认证scheme名称  /// </summary>  public const string customerschemename = "cusauth";  private authenticationscheme _scheme;  private httpcontext _context;  /// <summary>  /// 认证逻辑：认证校验主要逻辑  /// </summary>  /// <returns></returns>  public task<authenticateresult> authenticateasync()  {    authenticateresult result;    _context.request.headers.trygetvalue("authorization", out stringvalues values);    string valstr = values.tostring();    if (!string.isnullorwhitespace(valstr))    {      //认证模拟basic认证：cusauth ywrtaw46ywrtaw4=      string[] authval = system.text.encoding.utf8.getstring(convert.fromba64string(valstr.substring(customerschemename.length + 1))).split(':');      var logininfo = new dto.logindto() { urname = authval[0], password = authval[1] };      var validvale = _urr160wifivice.isvalid(logininfo);      if (!validvale)        result = authenticateresult.fail("未登陆");      el      {        var ticket = getauthticket(logininfo.urname, "admin");        result = authenticateresult.success(ticket);      }    }    el    {      result = authenticateresult.fail("未登陆");    }    return task.fromresult(result);  }  /// <summary>  /// 未登录时的处理  /// </summary>  /// <param name="properties"></param>  /// <returns></returns>  public task challengeasync(authenticationproperties properties)  {    _context.respon.statuscode = (int)httpstatuscode.unauthorized;    return task.completedtask;  }  /// <summary>  /// 权限不足时处理  /// </summary>  /// <param name="properties"></param>  /// <returns></returns>  public task forbidasync(authenticationproperties properties)  {    _context.respon.statuscode = (int)httpstatuscode.forbidden;    return task.completedtask;  }  /// <summary>  /// 初始化认证  /// </summary>  /// <param name="scheme"></param>  /// <param name="context"></param>  /// <returns></returns>  public task initializeasync(authenticationscheme scheme, httpcontext context)  {    _scheme = scheme;    _context = context;    return task.completedtask;  }  #region 认证校验逻辑  /// <summary>  /// 生成认证票据  /// </summary>  /// <param name="name"></param>  /// <param name="role"></param>  /// <returns></returns>  private authenticationticket getauthticket(string name, string role)  {    var claimsidentity = new claimsidentity(new claim[]    {  new claim(claimtypes.name, name),  new claim(claimtypes.role, role),    }, customerschemename);    var principal = new claimsprincipal(claimsidentity);    return new authenticationticket(principal, _scheme.name);  }  #endregion}/// <summary>/// 方式二：继承已实现的基类/// </summary>public class subauthenticationhandler : authenticationhandler<authenticationschemeoptions>{  public subauthenticationhandler(ioptionsmonitor<authenticationschemeoptions> options, iloggerfactory logger, urlencoder encoder, isystemclock clock)    : ba(options, logger, encoder, clock)  {  }  protected override task<authenticateresult> handleauthenticateasync()  {    throw new notimplementedexception();  }}

　2、在startup.cs中启用自定义认证：

public void configurervices(irvicecollection rvices){  //other code  rvices.addauthentication(o =>  {    x.defaultauthorientaldreamenticatescheme = customerauthenticationhandler.customerschemename;    x.defaultchallengescheme = customerauthenticationhandler.customerschemename;    o.addscheme<customerauthenticationhandler>(customerauthenticationhandler.customerschemename, customerauthenticationhandler.customerschemename);  });  //other code}public void configure(iapplicationbuilder app){  //other code  app.urouting();  //在urouting后；uendpoints前添加以下代码  app.uauthentication();  app.uauthorization();  //other code  app.uendpoints()}

　3、在控制器上添加认证标记，测试验证

//指定认证时，采用customerauthenticationhandler.customerschemename[authorize(authenticationschemes = customerauthenticationhandler.customerschemename)][route("api/[controller]")][apicontroller]public class auditlogcontroller : controllerba{//code}

　　调用

三、多认证支持

　在实际项目中可能存在，对一个控制器支持多种认证方式如：常用的jwt认证、自定义认证等，那么如何实现呢？

　1、在startup的configurervices 方法中添加以下逻辑：

public void configurervices(irvicecollection rvices){  //other code  rvices.configure<jwttting>(configuration.getction("jwttting"));  var token = configuration.getction("jwttting").get<jwttting>();  //jwt认证  rvices.addauthentication(x =>  {    x.defaultauthenticatescheme = jwtbearerdefaults.authenticationscheme;    x.defaultchallengescheme = jwtbearerdefaults.authenticationscheme;　　　　　//添加自定义认证处理器    x.addscheme<customerauthenticationhandler>(customerauthenticationhandler.customerschemename, customerauthenticationhandler.customerschemename);  }体育教师面试).addjwtbearer(x =>  {    x.requirehttpsmetadata = fal;    x.savetoken = true;    x.tokenvalidationparameters = new tokenvalidationparameters    {      validateissuersigningkey = true,      issuersigningkey = new symmetriccuritykey(encoding.ascii.getbytes(token.cretkey)),      validissuer = token.issuer,      validaudience = token.audience,      validateissuer = fal,      validateaudience = fal    };  });  //other code}

　2、在需要支持多种认证方式的控制器上添加标记：

//指定认证时，采用customerauthenticationhandler.customerschemename[authorize(authenticationschemes = customerauthenticationhandler.customerschemename)][route("api/[controller]")][apicontroller]public class auditlogcontroller : controllerba{//code}//指定认证采用jwt[authorize(authenticationschemes = jwtbearerdefaults.authenticationscheme)]public class weatherforecastcontroller : controllerba{ //code}

　　这样就支持了两种认证方式

　3、一个控制器支持多种认证类型：继承jwt认证处理，并根据scheme那么调用自定义的认证处理器：

/// <summary>/// 方式二：同时支持多种认证方式/// </summary>public class multauthenticationhandler : jwtbearerhandler{  public const string multauthname = "multauth";  iurrvice _urrvice;  public multauthenticationhandler(ioptionsmonitor<jwtbeareroptions> options, iloggerfactory logger, urlencoder encoder, isystemclock clock, iurrvice urrvice)    : ba(options, logger, encoder, clock)  {    _urrvice = urrvice;  }  protected override task<authenticateresult> handleauthenticateasync()  {    context.request.headers.trygetvalue("authorization", out stringvalues values);    string valstr = values.tostring();    if (valstr.startswith(customerauthenticationhandler.customerschemename))    {      var result = valid();      if (result != null)        return task.fromresult(authenticateresult.success(result));      el        return task.fromresult(authenticateresult.fail("未认证"));    }    el      return ba.authenticateasync();  }  private authenticationticket valid()  {    context.request.headers.trygetvalue("authorization", out stringvalues values);    string valstr = values.tostring();    if (!string.isnullorwhitespace(valstr))    {      //认证模拟basic认证：cusauth ywrtaw46ywrtaw4=      string[] authval = system.text.encoding.utf8.getstring(convert.fromba64string(valstr.substring(customerauthenticationhandler.customerschemename.length + 1))).split(':');      var logininfo = new dto.logindto() { urname = authval[0], password = authval[1] };      if (_urrvice.isvalid(logininfo))        return getauthticket(logininfo.urname, "admin");    }    return null;  }  /// <summary>  /// 生成认证票据  /// </summary>  /// <param name="name"></param>  /// <param name="role"></param>  /// <returns></returns>  private authenticationticket getauthticket(string name, string role)  {    var claimsid实践单位评价entity = new claimsidentity(new claim[]    {      new claim(claimtypes.name, name),      new claim(claimtypes.role, role),    }, customerauthenticationhandler.customerschemename);    var principal = new claimsprincipal(claimsidentity);    return new authenticationticket(principal, customerauthenticationhandler.customerschemename);  }}