c# - GetTokenAsync 使用 auth0 在 ASP.NET Core 2.1 中返回 2 个受众

Question

我正在使用 ASP.NET Core 2.1 和 Auth0。

当我尝试检索 acces_token 来访问我自己的 API 时，我使用

string accessToken = await HttpContext.GetTokenAsync("access_token");

奇怪的是，当我将 token 粘贴到 https://jwt.io/ 上时，它显示已添加受众。问题是不允许有两个观众，因此 token 无效。添加的受众以/userinfo 结尾

有人可以解释一下为什么我的访问 token 中有两个受众吗？

我在ConfigureServices中使用以下代码

// Add authentication services
services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddCookie()
.AddOpenIdConnect("Auth0", options =>
{
    // Set the authority to your Auth0 domain
    options.Authority = $"https://{Configuration["Auth0:Domain"]}";

    // Configure the Auth0 Client ID and Client Secret
    options.ClientId = Configuration["Auth0:ClientId"];
    options.ClientSecret = Configuration["Auth0:ClientSecret"];

    // Set response type to code
    options.ResponseType = "code";

    // Configure the scope
    options.Scope.Clear();
    options.Scope.Add("openid");

    // Set the callback path, so Auth0 will call back to http://localhost:5000/signin-auth0
    // Also ensure that you have added the URL as an Allowed Callback URL in your Auth0 dashboard
    options.CallbackPath = new PathString("/signin-auth0");

    // Configure the Claims Issuer to be Auth0
    options.ClaimsIssuer = "Auth0";

    // Saves tokens to the AuthenticationProperties
    options.SaveTokens = true;

    options.Events = new OpenIdConnectEvents
    {
        // handle the logout redirection
        OnRedirectToIdentityProviderForSignOut = (context) =>
        {
            var logoutUri = $"https://{Configuration["Auth0:Domain"]}/v2/logout?client_id={Configuration["Auth0:ClientId"]}";

            var postLogoutUri = context.Properties.RedirectUri;
            if (!string.IsNullOrEmpty(postLogoutUri))
            {
                if (postLogoutUri.StartsWith("/"))
                {
                    // transform to absolute
                    var request = context.Request;
                    postLogoutUri = request.Scheme + "://" + request.Host + request.PathBase + postLogoutUri;
                }
                logoutUri += $"&returnTo={ Uri.EscapeDataString(postLogoutUri)}";
            }

            context.Response.Redirect(logoutUri);
            context.HandleResponse();

            return Task.CompletedTask;
        },
        OnRedirectToIdentityProvider = context =>
        {
            context.ProtocolMessage.SetParameter("audience", "MY_OWN_AUDIENCE_URL");

            return Task.FromResult(0);
        }    
    };
});

Answer 1

工作

我让它与 Startup 类中的ConfigureServices 中放置的下一个代码一起工作。在配置列表中，我放置了来自 Auth0 userinfo API 和我自己的 API 的受众。

// Multiple audiences
options.TokenValidationParameters = new TokenValidationParameters
{
    ValidateAudience = true,
    ValidAudiences = Configuration.GetSection("Auth0:Audiences").Get<List<string>>(),
    ValidateLifetime = true
};