🐛fix: #IJX34Q 非Identity的token支持jwt token

2026-07-14 03:23:48 +08:00 · 2026-07-06 21:14:28 +08:00
parent 94f6f9e831
commit 912e1146d6
5 changed files with 239 additions and 16 deletions
--- a/OpenAuth.App/SSO/JwtTokenHelper.cs
+++ b/OpenAuth.App/SSO/JwtTokenHelper.cs
@@ -0,0 +1,144 @@
+using System;
+using System.IdentityModel.Tokens.Jwt;
+using System.Security.Claims;
+using System.Text;
+using Microsoft.IdentityModel.Tokens;
+
+namespace OpenAuth.App.SSO
+{
+    /// <summary>
+    /// JWT Token辅助类，用于本地认证模式下的Token生成和验证
+    /// </summary>
+    public static class JwtTokenHelper
+    {
+        /// <summary>
+        /// 生成JWT Token
+        /// </summary>
+        /// <param name="account">用户账号</param>
+        /// <param name="name">用户名称</param>
+        /// <param name="appKey">应用标识</param>
+        /// <param name="sessionId">会话ID，用作缓存Key</param>
+        /// <param name="secret">JWT签名密钥</param>
+        /// <param name="expireDays">过期天数</param>
+        /// <returns>JWT Token字符串</returns>
+        public static string GenerateToken(string account, string name, string appKey, string sessionId, string secret, int expireDays = 10)
+        {
+            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(EnsureKeyLength(secret)));
+            var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
+
+            var claims = new[]
+            {
+                new Claim(JwtRegisteredClaimNames.Sub, account),
+                new Claim(JwtRegisteredClaimNames.Jti, sessionId),
+                new Claim("name", name ?? string.Empty),
+                new Claim("app_key", appKey ?? string.Empty),
+            };
+
+            var token = new JwtSecurityToken(
+                issuer: "OpenAuth",
+                audience: "OpenAuth",
+                claims: claims,
+                expires: DateTime.UtcNow.AddDays(expireDays),
+                signingCredentials: credentials
+            );
+
+            return new JwtSecurityTokenHandler().WriteToken(token);
+        }
+
+        /// <summary>
+        /// 验证JWT Token并返回ClaimsPrincipal
+        /// </summary>
+        /// <param name="token">JWT Token字符串</param>
+        /// <param name="secret">JWT签名密钥</param>
+        /// <returns>验证成功返回ClaimsPrincipal，失败返回null</returns>
+        public static ClaimsPrincipal ValidateToken(string token, string secret)
+        {
+            if (string.IsNullOrEmpty(token))
+                return null;
+
+            var tokenHandler = new JwtSecurityTokenHandler();
+            var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(EnsureKeyLength(secret)));
+
+            try
+            {
+                var validationParameters = new TokenValidationParameters
+                {
+                    ValidateIssuerSigningKey = true,
+                    IssuerSigningKey = key,
+                    ValidateIssuer = true,
+                    ValidIssuer = "OpenAuth",
+                    ValidateAudience = true,
+                    ValidAudience = "OpenAuth",
+                    ValidateLifetime = true,
+                    ClockSkew = TimeSpan.FromMinutes(5)
+                };
+
+                var principal = tokenHandler.ValidateToken(token, validationParameters, out _);
+                return principal;
+            }
+            catch
+            {
+                return null;
+            }
+        }
+
+        /// <summary>
+        /// 从JWT Token中提取会话ID（jti）
+        /// </summary>
+        public static string GetSessionId(string token)
+        {
+            var principal = ReadTokenWithoutValidation(token);
+            return principal?.FindFirst(JwtRegisteredClaimNames.Jti)?.Value;
+        }
+
+        /// <summary>
+        /// 从JWT Token中提取用户账号（sub）
+        /// </summary>
+        public static string GetAccount(string token)
+        {
+            var principal = ReadTokenWithoutValidation(token);
+            return principal?.FindFirst(JwtRegisteredClaimNames.Sub)?.Value
+                ?? principal?.FindFirst(ClaimTypes.NameIdentifier)?.Value;
+        }
+
+        /// <summary>
+        /// 不验证签名，仅读取Token中的Claims（用于快速提取信息）
+        /// </summary>
+        private static ClaimsPrincipal ReadTokenWithoutValidation(string token)
+        {
+            if (string.IsNullOrEmpty(token))
+                return null;
+
+            try
+            {
+                var tokenHandler = new JwtSecurityTokenHandler();
+                if (!tokenHandler.CanReadToken(token))
+                    return null;
+
+                var jwtToken = tokenHandler.ReadJwtToken(token);
+                var identity = new ClaimsIdentity(jwtToken.Claims);
+                return new ClaimsPrincipal(identity);
+            }
+            catch
+            {
+                return null;
+            }
+        }
+
+        /// <summary>
+        /// 确保密钥长度至少为32字节（256位），不足时进行填充
+        /// </summary>
+        private static string EnsureKeyLength(string secret)
+        {
+            if (string.IsNullOrEmpty(secret))
+                secret = "openauth_default_jwt_secret_key_2024";
+
+            // HMAC-SHA256要求密钥至少128位(16字节)，建议256位(32字节)
+            while (secret.Length < 32)
+            {
+                secret += secret;
+            }
+            return secret.Substring(0, Math.Max(32, secret.Length));
+        }
+    }
+}
--- a/OpenAuth.App/SSO/LocalAuth.cs
+++ b/OpenAuth.App/SSO/LocalAuth.cs
@@ -36,6 +36,7 @@ namespace OpenAuth.App.SSO

        /// <summary>
        /// 如果是Identity，则返回信息为用户账号
+        /// 如果是本地认证，则返回JWT Token字符串
        /// </summary>
        /// <returns></returns>
        private string GetToken()
@@ -54,6 +55,15 @@ namespace OpenAuth.App.SSO
            return cookie ?? String.Empty;
        }

+        /// <summary>
+        /// 从JWT Token中提取会话ID（jti），用于缓存查找
+        /// </summary>
+        private string GetSessionIdFromToken(string token)
+        {
+            if (string.IsNullOrEmpty(token)) return null;
+            return JwtTokenHelper.GetSessionId(token);
+        }
+
        public bool CheckLogin(string token = "", string otherInfo = "")
        {
            if (_appConfiguration.Value.IsIdentityAuth)
@@ -73,7 +83,21 @@ namespace OpenAuth.App.SSO

            try
            {
-                var result = _cacheContext.Get<UserAuthSession>(token) != null;
+                // 验证JWT Token签名和有效期
+                var principal = JwtTokenHelper.ValidateToken(token, _appConfiguration.Value.JwtSecret);
+                if (principal == null)
+                {
+                    return false;
+                }
+
+                // 检查会话是否在缓存中（确保未被登出失效）
+                var sessionId = GetSessionIdFromToken(token);
+                if (string.IsNullOrEmpty(sessionId))
+                {
+                    return false;
+                }
+
+                var result = _cacheContext.Get<UserAuthSession>(sessionId) != null;
                return result;
            }
            catch (Exception ex)
@@ -95,17 +119,29 @@ namespace OpenAuth.App.SSO
                return _app.GetAuthStrategyContext(GetToken());
            }
            AuthStrategyContext context = null;
-            var user = _cacheContext.Get<UserAuthSession>(GetToken());
-            if (user != null)
+            var token = GetToken();
+            
+            // 从JWT Token中直接提取用户账号
+            var account = JwtTokenHelper.GetAccount(token);
+            if (!string.IsNullOrEmpty(account))
            {
-                context = _app.GetAuthStrategyContext(user.Account);
+                // 验证会话是否有效（未被登出）
+                var sessionId = GetSessionIdFromToken(token);
+                if (!string.IsNullOrEmpty(sessionId))
+                {
+                    var session = _cacheContext.Get<UserAuthSession>(sessionId);
+                    if (session != null)
+                    {
+                        context = _app.GetAuthStrategyContext(account);
+                    }
+                }
            }
            return context;
        }

        /// <summary>
        /// 获取当前登录的用户名
-        /// <para>通过URL中的Token参数或Cookie中的Token</para>
+        /// <para>通过JWT Token中的claims直接提取用户账号</para>
        /// </summary>
        /// <param name="otherInfo">The account.</param>
        /// <returns>System.String.</returns>
@@ -116,10 +152,21 @@ namespace OpenAuth.App.SSO
                return _httpContextAccessor.HttpContext.User.Identity.Name;
            }

-            var user = _cacheContext.Get<UserAuthSession>(GetToken());
-            if (user != null)
+            var token = GetToken();
+            // 从JWT Token中提取用户账号
+            var account = JwtTokenHelper.GetAccount(token);
+            if (!string.IsNullOrEmpty(account))
            {
-                return user.Account;
+                // 验证会话是否有效
+                var sessionId = GetSessionIdFromToken(token);
+                if (!string.IsNullOrEmpty(sessionId))
+                {
+                    var session = _cacheContext.Get<UserAuthSession>(sessionId);
+                    if (session != null)
+                    {
+                        return account;
+                    }
+                }
            }

            return "";
@@ -173,7 +220,12 @@ namespace OpenAuth.App.SSO

            try
            {
-                _cacheContext.Remove(token);
+                // 从JWT Token中提取会话ID，删除缓存
+                var sessionId = GetSessionIdFromToken(token);
+                if (!string.IsNullOrEmpty(sessionId))
+                {
+                    _cacheContext.Remove(sessionId);
+                }
                return true;
            }
            catch
--- a/OpenAuth.App/SSO/LoginParse.cs
+++ b/OpenAuth.App/SSO/LoginParse.cs
@@ -13,6 +13,7 @@ using SqlSugar;
 using Infrastructure.Extensions.AutofacManager;
 using Infrastructure.Utilities;
 using Microsoft.AspNetCore.Http;
+using Microsoft.Extensions.Options;


 namespace OpenAuth.App.SSO
@@ -24,11 +25,13 @@ namespace OpenAuth.App.SSO
         protected ISqlSugarClient SugarClient;
        private ICacheContext _cacheContext;
        private AppManager _appInfoService;
+        private IOptions<AppSetting> _appConfiguration;

-        public LoginParse( AppManager infoService, ICacheContext cacheContext, ISqlSugarClient client)
+        public LoginParse( AppManager infoService, ICacheContext cacheContext, ISqlSugarClient client, IOptions<AppSetting> appConfiguration)
        {
            _appInfoService = infoService;
            _cacheContext = cacheContext;
+            _appConfiguration = appConfiguration;
             string tenantId = Define.DEFAULT_TENANT_ID;
            var httpContextAccessor = AutofacContainerModule.GetService<IHttpContextAccessor>();
            if (httpContextAccessor != null)
@@ -87,21 +90,33 @@ namespace OpenAuth.App.SSO
                    throw new Exception("账号状态异常，可能已停用");
                }

+                // 生成唯一的会话ID作为缓存Key
+                var sessionId = Guid.NewGuid().ToString("N");
+                var expireDays = _appConfiguration.Value.JwtExpireDays;
+
                var currentSession = new UserAuthSession
                {
                    Account = model.Account,
                    Name = sysUserInfo.Name,
-                    Token = Guid.NewGuid().ToString().GetHashCode().ToString("x"),
+                    Token = sessionId,
                    AppKey = model.AppKey,
                    CreateTime = TimeHelper.Now
-               //    , IpAddress = HttpContext.Current.Request.UserHostAddress
                };

-                //创建Session
-                _cacheContext.Set(currentSession.Token, currentSession, TimeHelper.Now.AddDays(10));
+                //创建Session缓存，用于登出时失效判定
+                _cacheContext.Set(sessionId, currentSession, TimeHelper.Now.AddDays(expireDays));
+
+                // 生成JWT Token
+                var jwtToken = JwtTokenHelper.GenerateToken(
+                    model.Account,
+                    sysUserInfo.Name,
+                    model.AppKey,
+                    sessionId,
+                    _appConfiguration.Value.JwtSecret,
+                    expireDays);

                result.Code = 200;
-                result.Token = currentSession.Token;
+                result.Token = jwtToken;
            }
            catch (Exception ex)
            {