404 Not Found

identity服务器的startup.cs代码如下：

        public void ConfigureServices(IServiceCollection services)
{
            Services = services;

            var connectionString = Configuration.GetConnectionString("qcloud-postgres-applicationdb");
            var migrationsAssembly = typeof(Startup).GetTypeInfo().Assembly.GetName().Name;

            services.AddDbContext<ApplicationDbContext>(options =>
                options.UseNpgsql(connectionString));

            services.AddIdentity<ApplicationUser, IdentityRole>()
                .AddEntityFrameworkStores<ApplicationDbContext>()
                .AddDefaultTokenProviders();

            services.AddMvc().SetCompatibilityVersion(Microsoft.AspNetCore.Mvc.CompatibilityVersion.Version_2_2);

            services.Configure<IISOptions>(iis =>
            {
                iis.AuthenticationDisplayName = "Windows";
                iis.AutomaticAuthentication = false;
            });

            var builder = services.AddIdentityServer(options =>
            {
                options.Events.RaiseErrorEvents = true;
                options.Events.RaiseInformationEvents = true;
                options.Events.RaiseFailureEvents = true;
                options.Events.RaiseSuccessEvents = true;
            })
                // this adds the config data from DB (clients, resources)
                .AddConfigurationStore(options =>
                {
                    options.ConfigureDbContext = b =>
                        b.UseNpgsql(Configuration.GetConnectionString("qcloud-postgres-configurationdb"),
                            sql => sql.MigrationsAssembly(migrationsAssembly));
                })
                // this adds the operational data from DB (codes, tokens, consents)
                .AddOperationalStore(options =>
                {
                    options.ConfigureDbContext = b =>
                        b.UseNpgsql(Configuration.GetConnectionString("qcloud-postgres-persistedgrantdb"),
                            sql => sql.MigrationsAssembly(migrationsAssembly));

                    // this enables automatic token cleanup. this is optional.
                    options.EnableTokenCleanup = true;
                    options.TokenCleanupInterval = 60;
                })
                .AddAspNetIdentity<ApplicationUser>();

            builder.AddDeveloperSigningCredential();
            /*
            if (Environment.IsDevelopment())
            {
                builder.AddDeveloperSigningCredential();
            }
            else
            {
                throw new Exception("need to configure key material");
            }*/

            services.AddAuthentication(
                options =>
                {
                    options.DefaultScheme = "QQ";
                })
                .AddQQ(qqOptions =>
                {
                    qqOptions.AppId = "AppId123456"; //
                    qqOptions.AppKey = "AppKey1234567890";
                });
        }

        public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
        {
            if (Environment.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                //app.UseDatabaseErrorPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
                }

            app.UseStaticFiles();
            app.UseIdentityServer();
            app.UseMvcWithDefaultRoute();
        }

MvcClient端的startup.cs代码如下：

public void ConfigureServices(IServiceCollection services)
        {
            Services = services;

            Services.AddMvc();

            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

            Services.AddAuthentication(options =>
                {
                    options.DefaultScheme = "Cookies";
                    options.DefaultChallengeScheme = "oidc";
                })
                .AddCookie("Cookies")
                .AddOpenIdConnect("oidc", options =>
                {
                    options.SignInScheme = "Cookies";

                    //options.Authority = "http://localhost:5000";
                    options.Authority = "https://identity.web123456.cn";

                    options.RequireHttpsMetadata = false;

                    options.ClientId = "yingyu88";
                    options.ClientSecret = "secret";
                    options.ResponseType = "code id_token";

                    options.SaveTokens = true;
                    options.GetClaimsFromUserInfoEndpoint = true;

                    options.Scope.Add("yingyu88api");
                    //options.Scope.Add("offline_access");

                    //options.ClaimActions.MapJsonKey("website", "website");
                });
            ｝

                    public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                //app.UseDatabaseErrorPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
            }

            app.UseAuthentication();
            app.UseStaticFiles();
            app.UseMvcWithDefaultRoute();
        }

客户端得到的log如下：

2019-03-23 11:36:07.588 +08:00 [INF] User profile not available. Using 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\ASP.NET\4.0.30319.0\AutoGenKeys\S-1-5-82-1592072215-1740167268-757123690-3585059337-856257778\DataProtection' as key repository and Windows DPAPI to encrypt keys at rest.
2019-03-23 11:36:08.070 +08:00 [INF] Request starting HTTP/1.0 GET http://www.yingyu88.cn/Home/Secure  
2019-03-23 11:36:08.187 +08:00 [INF] Route matched with {action = "Secure", controller = "Home"}. Executing action MvcClient.Controllers.HomeController.Secure (Yingyu88web)
2019-03-23 11:36:08.197 +08:00 [INF] Authorization failed.
2019-03-23 11:36:08.202 +08:00 [INF] Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
2019-03-23 11:36:08.209 +08:00 [INF] Executing ChallengeResult with authentication schemes ([]).
2019-03-23 11:36:08.713 +08:00 [INF] AuthenticationScheme: oidc was challenged.
2019-03-23 11:36:08.722 +08:00 [INF] Executed action MvcClient.Controllers.HomeController.Secure (Yingyu88web) in 531.87060000000008ms
2019-03-23 11:36:08.742 +08:00 [INF] Request finished in 673.8004ms 302 
2019-03-23 11:36:15.048 +08:00 [INF] Request starting HTTP/1.0 POST http://www.yingyu88.cn/signin-oidc application/x-www-form-urlencoded 1532
2019-03-23 11:36:15.418 +08:00 [INF] AuthenticationScheme: Cookies signed in.
2019-03-23 11:36:15.419 +08:00 [INF] Request finished in 370.649ms 302

从以上Log可以看出Signin是成功的，但是callback回到signin-oidc之后请求就结束了，诡异的是应用并没有报错。

如有哪位大神熟悉IdentityServer的请多多赐教！
如果需要我这边更多的代码和log信息可以加QQ：352862120联系我私聊。多谢！

2019-03-29更新：

经过试验发现，IdentityServer4的示例代码在调试状态下没有问题，能够在localhost:5000和localhost:5002之间跳转并传递相应的Cookies。但是部署到服务器后（我用的是windows 2016和iis）就不行了（代码完全一致）。最初直接想到的是跨域问题，但是加上AddCors也并没有解决。

public void ConfigureServices(IServiceCollection services)
        {
            //配置跨域处理，允许所有来源：
            services.AddCors(options =>
                options.AddPolicy("corspolicy",
                    p => p.AllowAnyOrigin())
                    );
        ｝

                        public void Configure(IApplicationBuilder app)
        {
            if (Environment.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                app.UseDatabaseErrorPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
            }

            app.UseStaticFiles();
            app.UseIdentityServer();
**            app.UseCors("corspolicy");
**            app.UseMvcWithDefaultRoute();
        }

以上代码加到了IdentityServer和MvcClient，但是并没有效果。

追踪部署环境和调试环境下的log可以发现，公网部署时IdentityServer运行到signin-oidc就停止了，没有任何报错。
这是公网部署时的log：

2019-03-25 13:46:19.030 +08:00 [INF] Request starting HTTP/1.0 GET http://www.yingyu88.cn/Home/Secure  
2019-03-25 13:46:19.031 +08:00 [INF] Route matched with {action = "Secure", controller = "Home"}. Executing action MvcClient.Controllers.HomeController.Secure (MvcClient)
2019-03-25 13:46:19.039 +08:00 [INF] Authorization failed.
2019-03-25 13:46:19.041 +08:00 [INF] Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
2019-03-25 13:46:19.045 +08:00 [INF] Executing ChallengeResult with authentication schemes ([]).
2019-03-25 13:46:19.403 +08:00 [INF] AuthenticationScheme: oidc was challenged.
2019-03-25 13:46:19.408 +08:00 [INF] Executed action MvcClient.Controllers.HomeController.Secure (MvcClient) in 376.51370000000003ms
2019-03-25 13:46:19.413 +08:00 [INF] Request finished in 382.7936ms 302 
2019-03-25 13:46:40.244 +08:00 [INF] Request starting HTTP/1.0 POST http://www.yingyu88.cn/signin-oidc application/x-www-form-urlencoded 1531
2019-03-25 13:46:40.651 +08:00 [INF] AuthenticationScheme: Cookies signed in.
2019-03-25 13:46:40.651 +08:00 [INF] Request finished in 406.993ms 302

这是调试环境下的log：

2019-03-25 12:32:15.062 +08:00 [INF] Request starting HTTP/1.1 GET http://localhost:5002/Home/Secure  
2019-03-25 12:32:15.064 +08:00 [INF] Route matched with {action = "Secure", controller = "Home"}. Executing action MvcClient.Controllers.HomeController.Secure (MvcClient)
2019-03-25 12:32:15.070 +08:00 [INF] Authorization failed.
2019-03-25 12:32:15.072 +08:00 [INF] Authorization failed for the request at filter 'Microsoft.AspNetCore.Mvc.Authorization.AuthorizeFilter'.
2019-03-25 12:32:15.073 +08:00 [INF] Executing ChallengeResult with authentication schemes ([]).
2019-03-25 12:32:15.077 +08:00 [INF] AuthenticationScheme: oidc was challenged.
2019-03-25 12:32:15.077 +08:00 [INF] Executed action MvcClient.Controllers.HomeController.Secure (MvcClient) in 13.078700000000001ms
2019-03-25 12:32:15.077 +08:00 [INF] Request finished in 14.6766ms 302 
2019-03-25 12:32:39.168 +08:00 [INF] Request starting HTTP/1.1 POST http://localhost:5002/signin-oidc application/x-www-form-urlencoded 1522
2019-03-25 12:32:39.543 +08:00 [INF] AuthenticationScheme: Cookies signed in.
2019-03-25 12:32:39.543 +08:00 [INF] Request finished in 375.4138ms 302 
//以下是调试环境下继续执行跳转回/home/secure的动作。部署后这些动作就没有被执行。
2019-03-25 12:32:39.550 +08:00 [INF] Request starting HTTP/1.1 GET http://localhost:5002/Home/Secure  
2019-03-25 12:32:39.551 +08:00 [INF] Route matched with {action = "Secure", controller = "Home"}. Executing action MvcClient.Controllers.HomeController.Secure (MvcClient)
2019-03-25 12:32:39.551 +08:00 [INF] Authorization was successful.
2019-03-25 12:32:39.551 +08:00 [INF] Executing action method MvcClient.Controllers.HomeController.Secure (MvcClient) - Validation state: "Valid"
2019-03-25 12:32:39.552 +08:00 [INF] Executed action method MvcClient.Controllers.HomeController.Secure (MvcClient), returned result Microsoft.AspNetCore.Mvc.ViewResult in 0.2637ms.
2019-03-25 12:32:39.556 +08:00 [INF] Executing ViewResult, running view Secure.
2019-03-25 12:32:39.562 +08:00 [INF] Executed ViewResult - view Secure executed in 10.0428ms.
2019-03-25 12:32:39.563 +08:00 [INF] Executed action MvcClient.Controllers.HomeController.Secure (MvcClient) in 11.7323ms
2019-03-25 12:32:39.565 +08:00 [INF] Request finished in 14.3843ms 200 text/html; charset=utf-8

观察对比两种环境下的cookie，发现部署后从IdentityServer跳转到MvcClient/signin-oidc后少了两个cookie：
.AspNetCore.Identity.Application
idsrv.session

从IdentityServer4官方的示例代码来看，其示例代码可能还无法直接应用于部署环境，在startup.cs中有一段代码：

            if (Environment.IsDevelopment())
            {
                builder.AddDeveloperSigningCredential();
            }
            else
            {
                throw new Exception("need to configure key material");
            }

由此可见sigin-oidc的404问题有可能是解密凭据引起的。但是我对ASP.net core源码了解太少，提供上述信息希望能够得到大神的指点。

2019-03-29更新：AddDeveloperSigningCredential会生成RSA加密证书，使得程序能够正常运行，虽然其安全性会比较差。详见IdentityServer4部署到服务器，配置证书问题。因此AddDeveloperSigningCredential并非导致本次问题的原因。

2019-03-26更新：
如果把IdentityServer4.Samples\Quickstarts\4_ImplicitFlowAuthenticationWithExternal示例部署到同样的环境，发现能够运行通过。但是如果改为Hybrid模式就会出现signin-oidc 404 Not Found的问题。
identityserver.config.cs代码:

                                // OpenID Connect hybrid flow client (MVC)
                new Client
                {
                    ClientId = "mvc",
                    ClientName = "MVC Client",
    // 能正常部署运行:
                    AllowedGrantTypes = GrantTypes.Implicit,
    // 会出现404问题:
                    AllowedGrantTypes = GrantTypes.Hybrid,

                    ClientSecrets = { new Secret("secret".Sha256()) },

                    RedirectUris           = { "http://www.someweb.cn/signin-oidc" },
                    PostLogoutRedirectUris = { "http://www.someweb.cn/signout-callback-oidc" },

                    AllowedScopes =
                    {
                        IdentityServerConstants.StandardScopes.OpenId,
                        IdentityServerConstants.StandardScopes.Profile,
                        "api1"
                    },
                    AllowOfflineAccess = true
                }

MvcClient.startup.cs:

{
                    options.DefaultScheme = "Cookies";
                    options.DefaultChallengeScheme = "oidc";
                })
                .AddCookie("Cookies")
                .AddOpenIdConnect("oidc", options =>
                {
                    options.SignInScheme = "Cookies";
                    options.Authority = "https://identity.someweb.cn";
                    options.RequireHttpsMetadata = false;
                    options.ClientId = "mvc";
                    options.ClientSecret = "secret";
                    options.SaveTokens = true;
                    options.GetClaimsFromUserInfoEndpoint = true;
                    options.Scope.Add("offline_access");
                    options.ClaimActions.MapJsonKey("website", "website");
    // 能够正常部署运行:
                    options.ResponseType = "id_token";
    // 会发生signin-oidc 404错误：
                    options.Scope.Add("api1");
                    options.ResponseType = "code id_token";
    // 会发生"invalid_scope" 错误:
                    options.Scope.Add("api1");
                    options.ResponseType = "id_token";
                });

现在虽然已经知道Hybrid模式下公网部署才会出现错误，但究竟是我对client的配置错误还是IS4的bug所引起的问题并不清楚。
我试过AddCors，但并没有解决以上问题。

ASP.NET MVC 客户端验证的问题

zhouxundyj

1个回复