如何通过“密码"从身份服务器4获取id_token以及access_token. grant_type? [英] How to get id_token along with access_token from identityserver4 via "password" grant_type?

问题描述

我正在尝试使用identityserver4构建一个身份提供程序应用程序；当前，我正在使用资源所有者密码凭据"流，它从令牌端点返回access_token和refresh_token.

I am trying to build an identity provider application using identityserver4; Currently, I am using "Resource Owner Password Credentials" flow and it returns access_token and refresh_token from token endpoint.

用于从客户端调用TokenEndpoint的代码段

var tokenClient = new TokenClient(<TokenEndpoint>, <ClientId>, <ClientSecret>);           
var tokenResponse = await tokenClient.RequestResourceOwnerPasswordAsync(<UserName>, <password>, <Scopes>);

我的问题是，如何通过使用相同的资源所有者密码凭据"流程来获取"id_token"以及"access_token"和"refresh_token"?

My Question is, How to get "id_token" along with "access_token" and "refresh_token" by using the same "Resource Owner Password Credentials" flow?

推荐答案

如何通过使用相同的资源所有者密码凭证"流来获取"id_token"以及"access_token"和"refresh_token"?

How to get "id_token" along with "access_token" and "refresh_token" by using the same "Resource Owner Password Credentials" flow?

你不知道.

在IdentityServer4中，资源所有者密码凭据"流仅提供访问令牌.如果您还需要一个id令牌，请使用授权码"流，隐式码"流或混合"流.

In IdentityServer4, the Resource Owner Password Credentials flow provides only access tokens. If you also want an id token, then use the Authorization Code flow, the Implicit Code flow, or the Hybrid flow.

                                       access_token   id_token   refresh_token

Resource Owner Password Credentials        yes           -           yes

Authorization Code                         yes          yes          yes 

Implicit Flow                              yes          yes           - 

由于您需要所有三种令牌类型，并且由于您似乎正在使用服务器端代码，因此授权代码"流程最合适. 某些混合流也将为您服务.

Since you're wanting all three token types, and since you appear to be using server-side code, the Authorization Code flow fits best. Some kinds of Hybrid Flow will also work for you.

从文档中:

OAuth 2.0资源所有者密码授予允许客户端将用户名和密码发送到令牌服务，并取回代表该用户的访问令牌.

来自GitHub问题:

OpenID Connect不指定资源所有者流，仅指定授权服务器上的交互式登录(如代码或隐式流).因此[换句话说，]没有身份令牌-仅访问令牌.

OpenID Connect does not specify the resource owner flow - only interactive logons at the authorization server (like code or implicit flow). So [in other words,] no identity token - only access tokens.

这篇关于如何通过“密码"从身份服务器4获取id_token以及access_token. grant_type?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！