Web API 身分識別驗證 不記名令牌驗證 Bearer Token Authentication

標籤：

1. Startup.Auth.cs檔案

添加屬性

public static OAuthBearerAuthenticationOptions OAuthBearerOptions { get; private set; }

 添加靜態建構函式

        /// <summary>        /// 建構函式        /// </summary>        static Startup()        {            OAuthBearerOptions = new OAuthBearerAuthenticationOptions();        }    

 方法ConfigureAuth中添加

            // 使用不記名身分識別驗證            app.UseOAuthBearerAuthentication(OAuthBearerOptions);

 

2. WebApiConfig.cs檔案

方法Register中添加

            config.SuppressDefaultHostAuthentication();            config.Filters.Add(new HostAuthenticationFilter("Bearer"));

 

3. 建立驗證方法（Web API）

        [HttpPost]        public async Task<String> Authenticate(string userName, string password)        {            if (string.IsNullOrEmpty(userAccount) || string.IsNullOrEmpty(password))            {                return string.Empty;            }
            // 使用者尋找失敗            User user = await UserManager.FindAsync(userName, password);                        if (user == null)            {                return string.Empty;            }            // 身分識別驗證票證包括角色或者可以換成使用者名稱            var identity = new ClaimsIdentity(Startup.OAuthBearerOptions.AuthenticationType);            identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()));            if (UserManager.SupportsUserRole)            {                IList<string> roles = await UserManager.GetRolesAsync(user.Id).ConfigureAwait(false);                foreach (string roleName in roles)                {                    identity.AddClaim(new Claim(ClaimTypes.Role, roleName, ClaimValueTypes.String));                }            }            AuthenticationTicket ticket = new AuthenticationTicket(identity, new AuthenticationProperties());            var currentUtc = DateTime.UtcNow;            ticket.Properties.IssuedUtc = currentUtc;            ticket.Properties.ExpiresUtc = currentUtc.Add(TimeSpan.FromDays(1));            // 傳回值            return Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket);        }

 4. 為需要身分識別驗證的控制器或方法委任標記

[Authorize(Roles = "Admin")]public class UsersController : ApiController{}

 

測試：

在要求標頭部中添加令牌，格式如下：

Authorization: Bearer boQtj0SCGz2GFGz...

Web API 身分識別驗證 不記名令牌驗證 Bearer Token Authentication