mirror of
https://gitee.com/dcren/openiddict-documentation.git
synced 2025-07-15 23:13:34 +08:00
236 lines
12 KiB
HTML
236 lines
12 KiB
HTML
<!DOCTYPE html>
|
||
<!--[if IE]><![endif]-->
|
||
<html>
|
||
|
||
|
||
<head>
|
||
<meta charset="utf-8">
|
||
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
|
||
<title>Authorization storage </title>
|
||
<meta name="viewport" content="width=device-width">
|
||
<meta name="title" content="Authorization storage ">
|
||
<meta name="generator" content="docfx 2.56.7.0">
|
||
|
||
<link rel="shortcut icon" href="../images/favicon.ico">
|
||
<link href="https://fonts.googleapis.com/css2?family=Roboto:wght@300;400;500;700&display=swap" rel="stylesheet">
|
||
<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/highlight.js/10.1.1/styles/night-owl.min.css">
|
||
<link rel="stylesheet" href="../styles/colors.css">
|
||
<link rel="stylesheet" href="../styles/discord.css">
|
||
<link rel="stylesheet" href="../styles/main.css">
|
||
<meta property="docfx:navrel" content="../toc.html">
|
||
<meta property="docfx:tocrel" content="toc.html">
|
||
|
||
|
||
|
||
</head>
|
||
|
||
<body>
|
||
<div class="top-navbar">
|
||
|
||
<a href="javascript:void(0);" class="burger-icon" onclick="toggleMenu()">
|
||
<svg name="Hamburger" style="vertical-align: middle;" width="24" height="24" viewbox="0 0 24 24"><path fill="currentColor" fill-rule="evenodd" clip-rule="evenodd" d="M20 6H4V9H20V6ZM4 10.999H20V13.999H4V10.999ZM4 15.999H20V18.999H4V15.999Z"></path></svg>
|
||
</a>
|
||
|
||
|
||
<a class="brand" href="../index.html">
|
||
<img src="../images/logo.png" alt="OpenIddict" class="logomark">
|
||
<span class="brand-title">OpenIddict</span>
|
||
</a>
|
||
</div>
|
||
|
||
<div class="body-content">
|
||
|
||
<div id="blackout" class="blackout" onclick="toggleMenu()"></div>
|
||
|
||
<nav id="sidebar" role="navigation">
|
||
|
||
<div class="sidebar">
|
||
|
||
|
||
|
||
|
||
<div>
|
||
|
||
<a class="brand" href="../index.html">
|
||
<img src="../images/logo.png" alt="OpenIddict" class="logomark">
|
||
<span class="brand-title">OpenIddict</span>
|
||
</a>
|
||
<div id="navbar">
|
||
|
||
</div>
|
||
|
||
</div>
|
||
|
||
|
||
<div class="sidebar-item-separator"></div>
|
||
|
||
|
||
<div id="sidetoggle">
|
||
<div id="sidetoc"></div>
|
||
</div>
|
||
|
||
</div>
|
||
|
||
<div class="footer">
|
||
|
||
<span>Generated by <strong>DocFX</strong></span>
|
||
</div>
|
||
</nav>
|
||
|
||
<main class="main-panel">
|
||
|
||
<div role="main" class="hide-when-search">
|
||
|
||
|
||
<div class="subnav navbar navbar-default">
|
||
<div class="container hide-when-search" id="breadcrumb">
|
||
<ul class="breadcrumb">
|
||
<li></li>
|
||
</ul>
|
||
</div>
|
||
</div>
|
||
|
||
<article class="content wrap" id="_content" data-uid="">
|
||
<h1 id="authorization-storage">Authorization storage</h1>
|
||
|
||
<p>To keep track of logical chains of tokens and user consents, OpenIddict supports storing authorizations
|
||
(also known as "grants" in some OpenID Connect implementations) in the database.</p>
|
||
<h2 id="types-of-authorizations">Types of authorizations</h2>
|
||
<p>Authorizations can be of two types: permanent and ad-hoc.</p>
|
||
<h3 id="permanent-authorizations">Permanent authorizations</h3>
|
||
<p><strong>Permanent authorizations are developer-defined authorizations</strong> created using the <code>IOpenIddictAuthorizationManager.CreateAsync()</code> API
|
||
and explicitly attached to a <code>ClaimsPrincipal</code> using the OpenIddict-specific <code>principal.SetAuthorizationId()</code> extension method.</p>
|
||
<p>Such authorizations are typically used to remember user consents and avoid displaying a consent view for each authorization request.
|
||
For that, a "consent type" can be defined per-application, as in the following example:</p>
|
||
<pre><code class="lang-csharp">// Retrieve the application details from the database.
|
||
var application = await _applicationManager.FindByClientIdAsync(request.ClientId) ??
|
||
throw new InvalidOperationException("The application cannot be found.");
|
||
|
||
// Retrieve the permanent authorizations associated with the user and the application.
|
||
var authorizations = await _authorizationManager.FindAsync(
|
||
subject: await _userManager.GetUserIdAsync(user),
|
||
client : await _applicationManager.GetIdAsync(application),
|
||
status : Statuses.Valid,
|
||
type : AuthorizationTypes.Permanent,
|
||
scopes : request.GetScopes()).ToListAsync();
|
||
|
||
switch (await _applicationManager.GetConsentTypeAsync(application))
|
||
{
|
||
// If the consent is external (e.g when authorizations are granted by a sysadmin),
|
||
// immediately return an error if no authorization can be found in the database.
|
||
case ConsentTypes.External when !authorizations.Any():
|
||
return Forbid(
|
||
authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
|
||
properties: new AuthenticationProperties(new Dictionary<string, string>
|
||
{
|
||
[OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.ConsentRequired,
|
||
[OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] =
|
||
"The logged in user is not allowed to access this client application."
|
||
}));
|
||
|
||
// If the consent is implicit or if an authorization was found,
|
||
// return an authorization response without displaying the consent form.
|
||
case ConsentTypes.Implicit:
|
||
case ConsentTypes.External when authorizations.Any():
|
||
case ConsentTypes.Explicit when authorizations.Any() && !request.HasPrompt(Prompts.Consent):
|
||
var principal = await _signInManager.CreateUserPrincipalAsync(user);
|
||
|
||
// Note: in this sample, the granted scopes match the requested scope
|
||
// but you may want to allow the user to uncheck specific scopes.
|
||
// For that, simply restrict the list of scopes before calling SetScopes.
|
||
principal.SetScopes(request.GetScopes());
|
||
principal.SetResources(await _scopeManager.ListResourcesAsync(principal.GetScopes()).ToListAsync());
|
||
|
||
// Automatically create a permanent authorization to avoid requiring explicit consent
|
||
// for future authorization or token requests containing the same scopes.
|
||
var authorization = authorizations.LastOrDefault();
|
||
if (authorization is null)
|
||
{
|
||
authorization = await _authorizationManager.CreateAsync(
|
||
principal: principal,
|
||
subject : await _userManager.GetUserIdAsync(user),
|
||
client : await _applicationManager.GetIdAsync(application),
|
||
type : AuthorizationTypes.Permanent,
|
||
scopes : principal.GetScopes());
|
||
}
|
||
|
||
principal.SetAuthorizationId(await _authorizationManager.GetIdAsync(authorization));
|
||
|
||
foreach (var claim in principal.Claims)
|
||
{
|
||
claim.SetDestinations(GetDestinations(claim, principal));
|
||
}
|
||
|
||
return SignIn(principal, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);
|
||
|
||
// At this point, no authorization was found in the database and an error must be returned
|
||
// if the client application specified prompt=none in the authorization request.
|
||
case ConsentTypes.Explicit when request.HasPrompt(Prompts.None):
|
||
case ConsentTypes.Systematic when request.HasPrompt(Prompts.None):
|
||
return Forbid(
|
||
authenticationSchemes: OpenIddictServerAspNetCoreDefaults.AuthenticationScheme,
|
||
properties: new AuthenticationProperties(new Dictionary<string, string>
|
||
{
|
||
[OpenIddictServerAspNetCoreConstants.Properties.Error] = Errors.ConsentRequired,
|
||
[OpenIddictServerAspNetCoreConstants.Properties.ErrorDescription] =
|
||
"Interactive user consent is required."
|
||
}));
|
||
|
||
// In every other case, render the consent form.
|
||
default: return View(new AuthorizeViewModel
|
||
{
|
||
ApplicationName = await _applicationManager.GetLocalizedDisplayNameAsync(application),
|
||
Scope = request.Scope
|
||
});
|
||
}
|
||
</code></pre><h3 id="ad-hoc-authorizations">Ad-hoc authorizations</h3>
|
||
<p><strong>Ad-hoc authorizations are automatically created by OpenIddict when a chain of tokens needs to be tracked for security reasons</strong>,
|
||
but no explicit permanent authorization was attached by the developer to the <code>ClaimsPrincipal</code> used for the sign-in operation.</p>
|
||
<p>Such authorizations are typically created in the authorization code flow to link all the tokens associated with the original authorization code,
|
||
so that they can be automatically revoked if the authorization code was redeemed multiple times (which may indicate a token leakage).
|
||
In the same vein, ad-hoc authorizations are also created when a refresh token is returned during a resource owner password credentials grant request.</p>
|
||
<div class="NOTE"><h5>Note</h5><p>When using the <a href="https://www.nuget.org/packages/OpenIddict.Quartz/">OpenIddict.Quartz</a> integration, ad-hoc authorizations are automatically
|
||
removed from the database after a short period of time (14 days by default). Unlike ad-hoc authorizations, permanent authorizations
|
||
are never removed from the database.</p>
|
||
</div>
|
||
<h2 id="enabling-authorization-entry-validation-at-the-api-level">Enabling authorization entry validation at the API level</h2>
|
||
<p><strong>For performance reasons, OpenIddict 3.0 doesn't check, by default, the status of an authorization entry when receiving an API request</strong>: access tokens are considered
|
||
valid even if the attached authorization was revoked. For scenarios that require immediate authorization revocation, the OpenIddict validation handler can be configured
|
||
to enforce authorization entry validation for each API request:</p>
|
||
<div class="NOTE"><h5>Note</h5><p>Enabling authorization entry validation requires that the OpenIddict validation handler have a direct access to the server database where authorizations are stored, which makes it
|
||
better suited for APIs located in the same application as the authorization server. For external applications, consider using introspection instead of local validation.</p>
|
||
<p>In both cases, additional latency – caused by the additional DB request and the HTTP call for introspection – is expected.</p>
|
||
</div>
|
||
<pre><code class="lang-csharp">services.AddOpenIddict()
|
||
.AddValidation(options =>
|
||
{
|
||
options.EnableAuthorizationEntryValidation();
|
||
});
|
||
</code></pre><h2 id="disabling-authorization-storage">Disabling authorization storage</h2>
|
||
<p>While STRONGLY discouraged, authorization storage can be disabled in the server options:</p>
|
||
<pre><code class="lang-csharp">services.AddOpenIddict()
|
||
.AddServer(options =>
|
||
{
|
||
options.DisableAuthorizationStorage();
|
||
});
|
||
</code></pre></article>
|
||
|
||
</div>
|
||
</main>
|
||
</div>
|
||
|
||
|
||
<script src="https://code.jquery.com/jquery-3.5.1.min.js" integrity="sha256-9/aliU8dGd2tb6OSsuzixeV4y/faTqgFtohetphbbj0=" crossorigin="anonymous"></script>
|
||
<script src="https://cdn.jsdelivr.net/npm/popper.js@1.16.0/dist/umd/popper.min.js" integrity="sha384-Q6E9RHvbIyZFJoft+2mJbHaEWldlvI9IOYy5n3zV9zzTtmI3UksdQRVvoxMfooAo" crossorigin="anonymous"></script>
|
||
<script src="https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/js/bootstrap.min.js" integrity="sha384-OgVRvuATP1z7JjHLkuOU7Xw704+h835Lr+6QL9UvYjZE3Ipu6Tp75j7Bh/kR0JKI" crossorigin="anonymous"></script>
|
||
<script src="//cdnjs.cloudflare.com/ajax/libs/highlight.js/10.1.1/highlight.min.js"></script>
|
||
<script type="text/javascript" src="../styles/jquery.twbsPagination.js"></script>
|
||
<script type="text/javascript" src="../styles/url.min.js"></script>
|
||
<script src="https://cdn.jsdelivr.net/npm/anchor-js/anchor.min.js"></script>
|
||
<script type="text/javascript" src="../styles/docfx.js"></script>
|
||
<script type="text/javascript" src="../styles/main.js"></script>
|
||
|
||
</body>
|
||
|
||
</html>
|