asp.net-core - 使用 Auth0 在 .net core 3 应用程序上通过 Postman 登录

Question

我有一个通过 Auth0 进行登录设置的 .net 应用程序（与用户交互工作正常），但我想使用没有用户交互的脚本登录，这是行不通的。基本上我想在晚上运行一个 LogicApp 或一些带有硬编码用户/通行证的脚本，以访问我的应用程序内的页面。

我尝试过 Azure LogicApps 和 Postman，结果相同。我尝试通过将用户/密码作为基本身份验证来访问我的应用程序内的页面。我得到一些重定向并返回登录页面。Auth0 没有提供任何日志，所以我假设身份验证没有达到 Auth0。

Obs1：我确信在大约 6 个月前就可以使用这个设置，就在最近我意识到它已经停止工作，可能是 Auth0 发生了变化，或者是由于从 .net core 2.1 迁移到 3。

Obs2：我也开始使用 Bearer 令牌测试登录，但是代码中会有太多更改，我想把它留作最后的手段。

Startup.cs 的片段

services.Configure<CookiePolicyOptions>(options =>'''
{
options.CheckConsentNeeded = context => true;
options.MinimumSameSitePolicy = SameSiteMode.None;
options.Secure = CookieSecurePolicy.Always;
});

// Add authentication services
services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddCookie()
.AddOpenIdConnect("Auth0", options =>
{
// Set the authority to your Auth0 domain
options.Authority = $"https://login.myapp.net";

// Configure the Auth0 Client ID and Client Secret
options.ClientId = "*********";
options.ClientSecret = "****************;

//Set response type to code
options.ResponseType = "code";

// Configure the scope
options.Scope.Clear();
options.Scope.Add("openid");
options.Scope.Add("profile");
options.Scope.Add("email");

//Set the correct name claim type
options.TokenValidationParameters = new TokenValidationParameters
{
NameClaimType = "name",
RoleClaimType = "https://schemas.myapp.net"
};

// Set the callback path
options.CallbackPath = new PathString("/callback");

// Configure the Claims Issuer
options.ClaimsIssuer = "Auth0";

邮递员结果（3 个重定向和一个找到的登录页面）：

GET https://myapp.net/  
302

GET https://myapp.net/Account%2FLogin
302

GET https://login.myapp.net/authorize?client_id=****************&redirect_uri=https%3A%2F%2Fapp.myapp.net%2Fcallback&response_type=code&scope=openid%20profile%20email&code_challenge=***********&code_challenge_method=S256&response_mode=form_post&nonce=*****&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=5.5.0.0
302

GET https://login.myapp.net/login?state=***********&protocol=oauth2&redirect_uri=https%3A%2F%2Fapp.myapp.net%2Fcallback&response_type=code&scope=openid%20profile%20email&code_challenge=*********&code_challenge_method=S256&response_mode=form_post&nonce=*************&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=5.5.0.0
200
197ms 
▼
Request Headers
Authorization: Basic **********
User-Agent: PostmanRuntime/7.22.0
Accept: */*
Cache-Control: no-cache
Postman-Token: **************
Accept-Encoding: gzip, deflate, br
Cookie: did=*********; auth0_compat=***********
Referer: https://login.myapp.net/authorize?client_id=***************&redirect_uri=https%3A%2F%2Fapp.myapp.net%2Fcallback&response_type=code&scope=openid%20profile%20email&code_challenge=***********&code_challenge_method=S256&response_mode=form_post&nonce=******&state=*************&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=5.5.0.0
Connection: keep-alive
Response Headers
Server: nginx
Date: Wed, 11 Mar 2020 04:18:29 GMT
Content-Type: text/html; charset=utf-8
Transfer-Encoding: chunked
Connection: keep-alive
Vary: Accept-Encoding
ot-tracer-spanid: 6ed01af3e
ot-tracer-traceid: 3d5f35a407
ot-tracer-sampled: true
X-Auth0-RequestId: 655374d6432978
X-RateLimit-Limit: 1000
X-RateLimit-Remaining: 999
X-RateLimit-Reset: 1583900310
set-cookie: _csrf=eML8VgsIOn-ONcU0u3TeTx7U; Max-Age=864000; Path=/usernamepassword/login; HttpOnly; Secure
X-Robots-Tag: noindex, nofollow
X-Robots-Tag: noindex, nofollow, nosnippet, noarchive
X-Frame-Options: deny
Content-Security-Policy: frame-ancestors 'none'
X-XSS-Protection: 1; mode=block
X-Content-Type-Options: nosniff
Referrer-Policy: same-origin
ETag: W/"a6e-Dn+oh0+jgssgYbnM4PE"
cache-control: private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0, no-transform
Content-Encoding: gzip
Strict-Transport-Security: max-age=15768000
▼
Response Body
[sign in page]

标签： asp.net-corepostmanauth0azure-logic-apps

Answer 1

请参考文档： 实现资源所有者密码授予

在门户中配置您的应用程序后，您可以使用正确的参数（如 grant_type/client_id/client_secret/username/password 和范围）直接向 Auth0 的令牌端点发送 post 请求，令牌端点将返回可用于访问受保护资源的访问令牌：

var client = new RestClient("https://YOUR_DOMAIN/oauth/token");
var request = new RestRequest(Method.POST);
request.AddHeader("content-type", "application/x-www-form-urlencoded");
request.AddParameter("application/x-www-form-urlencoded", "grant_type=password&username=user%40example.com&password=pwd&audience=YOUR_API_IDENTIFIER&scope=read%3Asample&client_id=%24%7Baccount.clientId%7D&client_secret=YOUR_CLIENT_SECRET", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

您可以使用 Fiddler 或 Postman 进行测试。