事情是.. MVC 5正在为我们照顾一切,即从社会媒体收集令牌并验证/处理它.之后,它生成一个本地令牌.

RegisterExternal方法还需要维护Cookie,解决方案不会.

我写了一个blog post,这将详细解释.在下面添加了直接的答案.我的目标是使其融合并成为默认MVC Web API的登录/注册流程的组成部分,以确保其易于理解.

在下面的解决方案之后,授权属性必须如下才能工作,否则您将获得未经授权的响应.

[Authorize]
[HostAuthentication(Microsoft.AspNet.Identity.DefaultAuthenticationTypes.ExternalBearer)]
[HostAuthentication(Microsoft.AspNet.Identity.DefaultAuthenticationTypes.ApplicationCookie)]

如果要仅允许令牌使用API​​,请使用ExternalBearer,如果要仅允许记录的Cookie使用API​​即从网站使用ApplicationCookie.如果您要允许两者的API,用户都可以.

将此操作添加到AccountController.cs

// POST api/Account/RegisterExternalToken
[OverrideAuthentication]
[AllowAnonymous]
[Route("RegisterExternalToken")]
public async Task<IHttpActionResult> RegisterExternalToken(RegisterExternalTokenBindingModel model)
{
    if (!ModelState.IsValid)
    {
        return BadRequest(ModelState);
    }

    ExternalLoginData externalLogin = await ExternalLoginData.FromToken(model.Provider,model.Token);



    if (externalLogin == null)
    {
        return InternalServerError();
    }

    if (externalLogin.LoginProvider != model.Provider)
    {
        Authentication.SignOut(DefaultAuthenticationTypes.ExternalCookie);
        return InternalServerError();
    }

    ApplicationUser user = await UserManager.FindAsync(new UserLoginInfo(externalLogin.LoginProvider,externalLogin.ProviderKey));

    bool hasRegistered = user != null;
    ClaimsIdentity identity = null;
    IdentityResult result;

    if (hasRegistered)
    {
        identity = await UserManager.CreateIdentityAsync(user,OAuthDefaults.AuthenticationType);
        IEnumerable<Claim> claims = externalLogin.GetClaims();
        identity.AddClaims(claims);
        Authentication.SignIn(identity);
    }
    else
    {
        user = new ApplicationUser() { Id = Guid.NewGuid().ToString(),UserName = model.Email,Email = model.Email };

        result = await UserManager.CreateAsync(user);
        if (!result.Succeeded)
        {
            return GetErrorResult(result);
        }

        var info = new ExternalLoginInfo()
        {
            DefaultUserName = model.Email,Login = new UserLoginInfo(model.Provider,externalLogin.ProviderKey)
        };

        result = await UserManager.AddLoginAsync(user.Id,info.Login);
        if (!result.Succeeded)
        {
            return GetErrorResult(result);
        }

        identity = await UserManager.CreateIdentityAsync(user,OAuthDefaults.AuthenticationType);
        IEnumerable<Claim> claims = externalLogin.GetClaims();
        identity.AddClaims(claims);
        Authentication.SignIn(identity);
    }

    AuthenticationTicket ticket = new AuthenticationTicket(identity,new AuthenticationProperties());
    var currentUtc = new Microsoft.Owin.Infrastructure.SystemClock().UtcNow;
    ticket.Properties.IssuedUtc = currentUtc;
    ticket.Properties.ExpiresUtc = currentUtc.Add(TimeSpan.FromDays(365));
    var accessToken = Startup.OAuthOptions.AccessTokenFormat.Protect(ticket);
    Request.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer",accessToken);



    // Create the response building a JSON object that mimics exactly the one issued by the default /Token endpoint
    JObject token = new JObject(
        new JProperty("userName",user.UserName),new JProperty("id",user.Id),new JProperty("access_token",accessToken),new JProperty("token_type","bearer"),new JProperty("expires_in",TimeSpan.FromDays(365).TotalSeconds.ToString()),new JProperty(".issued",currentUtc.ToString("ddd,dd MMM yyyy HH':'mm':'ss 'GMT'")),new JProperty(".expires",currentUtc.Add(TimeSpan.FromDays(365)).ToString("ddd,dd MMM yyyy HH:mm:ss 'GMT'"))
    );
    return Ok(token);
}

将此帮助方法添加到AccountController.cs中的助手区域中的ExternalLoginData类

public static async Task < ExternalLoginData > FromToken(string provider,string accessToken)
{

    string verifyTokenEndPoint = "",verifyAppEndpoint = "";

    if (provider == "Facebook")
    {
        verifyTokenEndPoint = string.Format("https://graph.facebook.com/me?access_token={0}",accessToken);
        verifyAppEndpoint = string.Format("https://graph.facebook.com/app?access_token={0}",accessToken);
    }
    else if (provider == "Google")
    {
        // not implemented yet
        return null;
        //verifyTokenEndPoint = string.Format("https://www.googleapis.com/oauth2/v1/tokeninfo?access_token={0}",accessToken);
    }
    else
    {
        return null;
    }

    HttpClient client = new HttpClient();
    Uri uri = new Uri(verifyTokenEndPoint);
    HttpResponseMessage response = await client.GetAsync(uri);
    ClaimsIdentity identity = null;
    if (response.IsSuccessStatusCode)
    {
        string content = await response.Content.ReadAsStringAsync();
        dynamic iObj = (Newtonsoft.Json.Linq.JObject) Newtonsoft.Json.JsonConvert.DeserializeObject(content);

        uri = new Uri(verifyAppEndpoint);
        response = await client.GetAsync(uri);
        content = await response.Content.ReadAsStringAsync();
        dynamic appObj = (Newtonsoft.Json.Linq.JObject) Newtonsoft.Json.JsonConvert.DeserializeObject(content);

        identity = new ClaimsIdentity(OAuthDefaults.AuthenticationType);

        if (provider == "Facebook")
        {
            if (appObj["id"] != Startup.facebookAuthOptions.AppId)
            {
                return null;
            }

            identity.AddClaim(new Claim(ClaimTypes.NameIdentifier,iObj["id"].ToString(),ClaimValueTypes.String,"Facebook","Facebook"));

        }
        else if (provider == "Google")
        {
            //not implemented yet
        }

    }

    if (identity == null)
    {
        return null;
    }

    Claim providerKeyClaim = identity.FindFirst(ClaimTypes.NameIdentifier);

    if (providerKeyClaim == null || String.IsNullOrEmpty(providerKeyClaim.Issuer) || String.IsNullOrEmpty(providerKeyClaim.Value))
    {
        return null;
    }

    if (providerKeyClaim.Issuer == ClaimsIdentity.DefaultIssuer)
    {
        return null;
    }
    return new ExternalLoginData
    {
        LoginProvider = providerKeyClaim.Issuer,ProviderKey = providerKeyClaim.Value,UserName = identity.FindFirstValue(ClaimTypes.Name)
    };
}
}

最后由该操作使用的RegisterExternalTokenBindingModel.

public class RegisterExternalTokenBindingModel
{
    [required]
    [Display(Name = "Email")]
    public string Email { get; set; }
    [required]
    [Display(Name = "Token")]
    public string Token { get; set; }
    [required]
    [Display(Name = "Provider")]
    public string Provider { get; set; }
}

是的,我们在注册时传递电子邮件以及令牌细节,这不会导致您在使用Twitter时更改代码,因为Twitter不提供用户电子邮件.我们验证令牌来自我们的应用程序.一旦电子邮件注册,被黑客或别人的令牌不能用于更改电子邮件或获取该电子邮件的本地令牌,因为它将始终为实际的用户授予社交令牌的本地令牌,无论发送的电子邮件如何.

RegisterExternalToken端点用于以两种方式获取令牌,即注册用户并发送本地令牌,或者如果用户已注册,则发送令牌.