cKey
5 years ago
13 changed files with 177 additions and 193 deletions
@ -0,0 +1,116 @@ |
|||
|
|||
using IdentityModel; |
|||
using IdentityServer4.Events; |
|||
using IdentityServer4.Models; |
|||
using IdentityServer4.Services; |
|||
using IdentityServer4.Validation; |
|||
using LINGYUN.Abp.WeChat; |
|||
using LINGYUN.Abp.WeChat.OpenId; |
|||
using LINGYUN.Abp.WeChat.Security.Claims; |
|||
using Microsoft.AspNetCore.Identity; |
|||
using Microsoft.Extensions.Localization; |
|||
using Microsoft.Extensions.Logging; |
|||
using Microsoft.Extensions.Logging.Abstractions; |
|||
using System; |
|||
using System.Collections.Generic; |
|||
using System.Security.Claims; |
|||
using System.Threading.Tasks; |
|||
using Volo.Abp.Identity; |
|||
using Volo.Abp.IdentityServer.Localization; |
|||
using Volo.Abp.Security.Claims; |
|||
using IdentityResource = Volo.Abp.Identity.Localization.IdentityResource; |
|||
using IdentityUser = Volo.Abp.Identity.IdentityUser; |
|||
|
|||
namespace LINGYUN.Abp.IdentityServer.WeChat |
|||
{ |
|||
public abstract class WeChatGrantValidator : IExtensionGrantValidator |
|||
{ |
|||
public abstract string GrantType { get; } |
|||
public abstract string LoginProviderKey { get; } |
|||
public abstract string AuthenticationMethod { get; } |
|||
|
|||
public ILogger Logger { protected get; set; } |
|||
protected IEventService EventService { get; } |
|||
protected IWeChatOpenIdFinder WeChatOpenIdFinder { get; } |
|||
protected IIdentityUserRepository UserRepository { get; } |
|||
protected UserManager<IdentityUser> UserManager { get; } |
|||
protected IStringLocalizer<IdentityResource> IdentityLocalizer { get; } |
|||
protected IStringLocalizer<AbpIdentityServerResource> IdentityServerLocalizer { get; } |
|||
|
|||
public WeChatGrantValidator( |
|||
IEventService eventService, |
|||
IWeChatOpenIdFinder weChatOpenIdFinder, |
|||
UserManager<IdentityUser> userManager, |
|||
IIdentityUserRepository userRepository, |
|||
IStringLocalizer<IdentityResource> identityLocalizer, |
|||
IStringLocalizer<AbpIdentityServerResource> identityServerLocalizer) |
|||
{ |
|||
EventService = eventService; |
|||
UserManager = userManager; |
|||
UserRepository = userRepository; |
|||
WeChatOpenIdFinder = weChatOpenIdFinder; |
|||
IdentityLocalizer = identityLocalizer; |
|||
IdentityServerLocalizer = identityServerLocalizer; |
|||
|
|||
Logger = NullLogger<WeChatGrantValidator>.Instance; |
|||
} |
|||
|
|||
protected abstract Task<WeChatOpenId> FindOpenIdAsync(string code); |
|||
|
|||
public async Task ValidateAsync(ExtensionGrantValidationContext context) |
|||
{ |
|||
var raw = context.Request.Raw; |
|||
var credential = raw.Get(OidcConstants.TokenRequest.GrantType); |
|||
if (credential == null || !credential.Equals(GrantType)) |
|||
{ |
|||
Logger.LogWarning("Invalid grant type: not allowed"); |
|||
context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, IdentityServerLocalizer["InvalidGrant:GrantTypeInvalid"]); |
|||
return; |
|||
} |
|||
// TODO: 统一命名规范, 微信认证传递的 code 改为 WeChatOpenIdConsts.WeCahtCodeKey
|
|||
var wechatCode = raw.Get(AbpWeChatGlobalConsts.TokenName); |
|||
if (wechatCode.IsNullOrWhiteSpace() || wechatCode.IsNullOrWhiteSpace()) |
|||
{ |
|||
Logger.LogWarning("Invalid grant type: wechat code not found"); |
|||
context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, IdentityServerLocalizer["InvalidGrant:WeChatCodeNotFound"]); |
|||
return; |
|||
} |
|||
|
|||
var wechatOpenId = await FindOpenIdAsync(wechatCode); |
|||
var currentUser = await UserManager.FindByLoginAsync(LoginProviderKey, wechatOpenId.OpenId); |
|||
if (currentUser == null) |
|||
{ |
|||
Logger.LogWarning("Invalid grant type: wechat openid not register", wechatOpenId.OpenId); |
|||
context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, IdentityServerLocalizer["InvalidGrant:WeChatNotRegister"]); |
|||
return; |
|||
} |
|||
|
|||
if (await UserManager.IsLockedOutAsync(currentUser)) |
|||
{ |
|||
Logger.LogInformation("Authentication failed for username: {username}, reason: locked out", currentUser.UserName); |
|||
context.Result = new GrantValidationResult(TokenRequestErrors.InvalidGrant, IdentityLocalizer["Volo.Abp.Identity:UserLockedOut"]); |
|||
return; |
|||
} |
|||
|
|||
var sub = await UserManager.GetUserIdAsync(currentUser); |
|||
|
|||
var additionalClaims = new List<Claim>(); |
|||
if (currentUser.TenantId.HasValue) |
|||
{ |
|||
additionalClaims.Add(new Claim(AbpClaimTypes.TenantId, currentUser.TenantId?.ToString())); |
|||
} |
|||
additionalClaims.Add(new Claim(AbpWeChatClaimTypes.OpenId, wechatOpenId.OpenId)); |
|||
if (!wechatOpenId.UnionId.IsNullOrWhiteSpace()) |
|||
{ |
|||
additionalClaims.Add(new Claim(AbpWeChatClaimTypes.UnionId, wechatOpenId.UnionId)); |
|||
} |
|||
|
|||
await EventService.RaiseAsync(new UserLoginSuccessEvent(currentUser.UserName, wechatOpenId.OpenId, null)); |
|||
|
|||
context.Result = new GrantValidationResult(sub, AuthenticationMethod, additionalClaims.ToArray()); |
|||
|
|||
// 登录之后需要更新安全令牌
|
|||
(await UserManager.UpdateSecurityStampAsync(currentUser)).CheckErrors(); |
|||
} |
|||
} |
|||
} |
|||
Loading…
Reference in new issue