Web API 身份验证 不记名令牌验证 Bearer Token Authentication

1. Startup.Auth.cs文件

添加属性

public static OAuthBearerAuthenticationOptions OAuthBearerOptions { get; private set; }

 添加静态构造函数

        /// <summary>
        /// 构造函数
        /// </summary>
        static Startup()
        {
            OAuthBearerOptions = new OAuthBearerAuthenticationOptions();
        }    

 方法ConfigureAuth中添加

            // 使用不记名身份验证
            app.UseOAuthBearerAuthentication(OAuthBearerOptions);

 

2. WebApiConfig.cs文件

方法Register中添加

            config.SuppressDefaultHostAuthentication();
            config.Filters.Add(new HostAuthenticationFilter("Bearer"));

 

3. 创建身份验证方法(Web API)

        [HttpPost]
        public async Task<String> Authenticate(string userName, string password)
        {
            if (string.IsNullOrEmpty(userAccount) || string.IsNullOrEmpty(password))
            {
                return string.Empty;
            }
// 用户查找失败 User user = await UserManager.FindAsync(userName, password); if (user == null) { return string.Empty; } // 身份验证票证包括角色或者可以换成用户名 var identity = new ClaimsIdentity(Startup.OAuthBearerOptions.AuthenticationType); identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.Id.ToString())); if (UserManager.SupportsUserRole) { IList<string> roles = await UserManager.GetRolesAsync(user.Id).ConfigureAwait(false); foreach (string roleName in roles) { identity.AddClaim(new Claim(ClaimTypes.Role, roleName, ClaimValueTypes.String)); } } AuthenticationTicket ticket = new AuthenticationTicket(identity, new AuthenticationProperties()); var currentUtc = DateTime.UtcNow; ticket.Properties.IssuedUtc = currentUtc; ticket.Properties.ExpiresUtc = currentUtc.Add(TimeSpan.FromDays(1)); // 返回值 return Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket); }

 4. 为需要身份验证的控制器或方法添加标记

[Authorize(Roles = "Admin")]
public class UsersController : ApiController
{
}

 

测试:

在请求头部中添加令牌,格式如下:

Authorization: Bearer boQtj0SCGz2GFGz...

 

posted @ 2014-05-15 00:42  疾风的流浪  阅读(10872)  评论(1编辑  收藏