IdentityServer4 (5) 混合模式(Hybrid)

    new Client{         ClientId="mvc client Hybrid", //客户端Id         ClientName="测试客户端 Hybrid", //客户端名称 随便写          ClientSecrets={ new Secret("mvc secret Hybrid".Sha256()) },          AllowedGrantTypes=GrantTypes.Hybrid,//验证模式           // 如果客户端 response_type 包含 token 这里必须启用         //AllowAccessTokensViaBrowser=true,          RedirectUris = { "http://localhost:5003/signin-oidc" },           //注销重定向的url         PostLogoutRedirectUris = { "http://localhost:5003/signout-callback-oidc" },          AllowOfflineAccess=true,         AlwaysIncludeUserClaimsInIdToken=true,                    //客户端访问权限         AllowedScopes =         {             "api1",             IdentityServerConstants.StandardScopes.OpenId,             IdentityServerConstants.StandardScopes.Email,             IdentityServerConstants.StandardScopes.Address,             IdentityServerConstants.StandardScopes.Phone,             IdentityServerConstants.StandardScopes.Profile,             "roles",         }

//关闭了 JWT 身份信息类型映射 //这样就允许 well-known 身份信息（比如，“sub” 和 “idp”）无干扰地流过。 //这个身份信息类型映射的“清理”必须在调用 AddAuthentication()之前完成 //区别可参考下面截图， //简单理解  //jwt 的 key 映射出来是 http://xxxxxxxxxxxxxxx //well-known 映射出来是 sub idp 这样简洁的字符 JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear(); //添加认证信息 services.AddAuthentication(options => {     options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;     options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme; }) .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options => {     options.AccessDeniedPath = "/Authorization/NoPermission"; }) .AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>  {      //IdentityServer4 服务器地址      options.Authority = "http://localhost:5002";      options.ClientId = "mvc client Hybrid";      options.ClientSecret = "mvc secret Hybrid";      options.RequireHttpsMetadata = false;      options.SaveTokens = true;      options.ResponseType = OidcConstants.ResponseTypes.CodeIdToken;       //如果请求token 就必须再定义客户端的时候设置运行通过浏览器来返回AccessToken      //options.ResponseType = OidcConstants.ResponseTypes.CodeToken;      //options.ResponseType = OidcConstants.ResponseTypes.CodeIdTokenToken;       options.Scope.Clear();      options.Scope.Add("api1");      options.Scope.Add(OidcConstants.StandardScopes.OpenId);      options.Scope.Add(OidcConstants.StandardScopes.Email);      options.Scope.Add(OidcConstants.StandardScopes.Phone);      options.Scope.Add(OidcConstants.StandardScopes.Address);      options.Scope.Add(OidcConstants.StandardScopes.Profile);      options.Scope.Add(OidcConstants.StandardScopes.OfflineAccess);      options.Scope.Add("roles");        //去掉默认过滤的 claim，这样 User.Claims 里就会出现这个 claim      options.ClaimActions.Remove("nbf");       //增加过滤的 claim，这样 User.Claims 里就会删除这个 claim      options.ClaimActions.DeleteClaim("sid");       options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters      {          //映射 User.Name          NameClaimType = JwtClaimTypes.Name,          RoleClaimType = JwtClaimTypes.Role      };  });

   app.UseStaticFiles();    //写在 UseMvc() 前面    app.UseAuthentication();    app.UseMvcWithDefaultRoute();