services.AddIdentityServer(options =>{options.UserInteraction = new IdentityServer4.Configuration.UserInteractionOptions{LoginUrl = "/Account/Login",//【必备】登录地址  LogoutUrl = "/Account/Logout",//【必备】退出地址 ConsentUrl = "/Account/Consent",//【必备】允许授权同意页面地址ErrorUrl = "/Account/Error", //【必备】错误页面地址LoginReturnUrlParameter = "ReturnUrl",//【必备】设置传递给登录页面的返回URL参数的名称。默认为returnUrl LogoutIdParameter = "logoutId", //【必备】设置传递给注销页面的注销消息ID参数的名称。缺省为logoutId ConsentReturnUrlParameter = "ReturnUrl", //【必备】设置传递给同意页面的返回URL参数的名称。默认为returnUrlErrorIdParameter = "errorId", //【必备】设置传递给错误页面的错误消息ID参数的名称。缺省为errorIdCustomRedirectReturnUrlParameter = "ReturnUrl", //【必备】设置从授权端点传递给自定义重定向的返回URL参数的名称。默认为returnUrl
                    CookieMessageThreshold = 5 //【必备】由于浏览器对Cookie的大小有限制，设置Cookies数量的限制，有效的保证了浏览器打开多个选项卡，一旦超出了Cookies限制就会清除以前的Cookies值
                };}).AddDeveloperSigningCredential().AddInMemoryIdentityResources(MemoryClients.GetIdentityResources()).AddInMemoryApiResources(MemoryClients.GetApiResources()).AddInMemoryClients(MemoryClients.GetClients());

public class LoginViewModel{/// <summary>/// 用户名/// </summary>
        [Required]public string username { get; set; }/// <summary>/// 密码/// </summary>
        [Required]public string password { get; set; }/// <summary>/// 界面上的选择框  选择是否记住登录/// </summary>public bool RememberLogin { get; set; }/// <summary>/// 回调授权验证地址 这个地址与Redirect地址不一样/// 登录成功后会转到 ReturnUrl  然后验证授权登录后 获取到客户端的信息 然后根据Client配置中的RedirectUrl转到对应的系统/// </summary>public string ReturnUrl { get; set; }}

public class Idr4LoginViewModel : LoginViewModel{public bool AllowRememberLogin { get; set; }public bool EnableLocalLogin { get; set; }public IEnumerable<ExternalProvider> ExternalProviders { get; set; }//public IEnumerable<ExternalProvider> VisibleExternalProviders => ExternalProviders.Where(x => !String.IsNullOrWhiteSpace(x.DisplayName));public bool IsExternalLoginOnly => EnableLocalLogin == false && ExternalProviders?.Count() == 1;public string ExternalLoginScheme => ExternalProviders?.SingleOrDefault()?.AuthenticationScheme;public string ClientName { get; set; }public string ClientUrl { get; set; }public string ClientLogoUrl { get; set; }}

@using SSOServer.Models;
@{ViewData["Title"] = "Index";
}
@model Idr4LoginViewModel
<h2>用户登录</h2>
<form asp-action="Login">@if (Model.EnableLocalLogin){<div><img src="@Model.ClientLogoUrl" width="100" height="100" /></div><div>@Model.ClientName</div><div>@Model.ClientUrl</div>}<div>用户名：<input type="text" asp-for="username" /></div><div>密码：<input type="text" asp-for="password" /></div><input type="hidden" asp-for="ReturnUrl" /><button type="submit">登录</button><div asp-validation-summary="All"> </div>
</form>

 [HttpGet]public async Task<IActionResult> Login(string ReturnUrl){//创建视图模型var vm = await CreateIdr4LoginViewModelAsync(ReturnUrl);//判断来之其他客户端的登录if (vm.IsExternalLoginOnly){return await ExternalLogin(vm.ExternalLoginScheme, ReturnUrl);}return View(vm);}

 private readonly IIdentityServerInteractionService _identityServerInteractionService;private readonly IHttpContextAccessor _httpContextAccessor;private readonly IAuthenticationSchemeProvider _schemeProvider;private readonly IResourceStore _resourceStore;private readonly IClientStore _clientStore;private readonly IEventService _events;private readonly UserStoreServices _testUserStore;//private readonly TestUserStore _testUserStore;public AccountController(IIdentityServerInteractionService identityServerInteractionService, UserStoreServices testUserStore, IEventService events, IHttpContextAccessor httpContextAccessor, IAuthenticationSchemeProvider schemeProvider, IClientStore clientStore, IResourceStore resourceStore){_identityServerInteractionService = identityServerInteractionService;_testUserStore = testUserStore;_events = events;_httpContextAccessor = httpContextAccessor;_schemeProvider = schemeProvider;_clientStore = clientStore;_resourceStore = resourceStore;}

/// <summary>/// 构造下Idr4登陆界面显示视图模型/// </summary>/// <param name="ReturnUrl"></param>/// <returns></returns>private async Task<Idr4LoginViewModel> CreateIdr4LoginViewModelAsync(string ReturnUrl){Idr4LoginViewModel vm = new Idr4LoginViewModel();var context = await _identityServerInteractionService.GetAuthorizationContextAsync(ReturnUrl);if (context != null){if (context?.IdP != null){// 扩展外部扩展登录模型处理vm.EnableLocalLogin = false;vm.ReturnUrl = ReturnUrl;vm.username = context?.LoginHint;vm.ExternalProviders = new ExternalProvider[] { new ExternalProvider { AuthenticationScheme = context.IdP } };}}//外部登陆 获取所有授权信息 并查找当前可用的授权信息var schemes = await _schemeProvider.GetAllSchemesAsync();var providers = schemes.Where(x => x.DisplayName != null).Select(x => new ExternalProvider{DisplayName = x.DisplayName,AuthenticationScheme = x.Name}).ToList();var allowLocal = true;if (context?.ClientId != null){var client = await _clientStore.FindEnabledClientByIdAsync(context.ClientId);if (client != null){allowLocal = client.EnableLocalLogin;vm.ClientName = client.ClientName;vm.ClientUrl = client.ClientUri;vm.ClientLogoUrl = client.LogoUri;if (client.IdentityProviderRestrictions != null && client.IdentityProviderRestrictions.Any()){providers = providers.Where(provider => client.IdentityProviderRestrictions.Contains(provider.AuthenticationScheme)).ToList();}}}vm.AllowRememberLogin = AccountOptions.AllowRememberLogin;vm.EnableLocalLogin = allowLocal && AccountOptions.AllowLocalLogin;vm.ReturnUrl = ReturnUrl;vm.username = context?.LoginHint;vm.ExternalProviders = providers.ToArray();return vm;}

 [HttpPost][ValidateAntiForgeryToken]public async Task<IActionResult> Login(Idr4LoginViewModel model){#region  Idr4验证处理 这里主要对ReturnUrl处理var context = await _identityServerInteractionService.GetAuthorizationContextAsync(model.ReturnUrl);if (context == null){//不存在客户端信息Redirect("~/");}#endregion#region 基础验证if (string.IsNullOrEmpty(model.username)){ModelState.AddModelError("", "请输入用户名");}if (string.IsNullOrEmpty(model.password)){ModelState.AddModelError("", "请输入密码");}#endregionif (ModelState.IsValid){if (_testUserStore.ValidatorUser(model.username, model.password)){//查询用户信息var user = await _testUserStore.GetByUserNameAsync(); //得到信息await _events.RaiseAsync(new UserLoginSuccessEvent(user.username, user.guid.ToString(), user.username));//记住登录AuthenticationProperties authenticationProperties = null;if (AccountOptions.AllowRememberLogin && model.RememberLogin){authenticationProperties = new AuthenticationProperties{IsPersistent = true,ExpiresUtc = DateTimeOffset.UtcNow.Add(AccountOptions.RememberMeLoginDuration)};}//SignInawait HttpContext.SignInAsync(user.guid.ToString(), user.username, authenticationProperties);if (_identityServerInteractionService.IsValidReturnUrl(model.ReturnUrl) || Url.IsLocalUrl(model.ReturnUrl)){return Redirect(model.ReturnUrl);}return Redirect("~/");}else{await _events.RaiseAsync(new UserLoginFailureEvent(model.username, "登录失败"));ModelState.AddModelError("", AccountOptions.InvalidCredentialsErrorMessage);}}//防止验证失败后返回视图后 界面模型参数不存在 所以这里需要构建一次模型var vm = await CreateIdr4LoginViewModelAsync(model.ReturnUrl);return View(vm);}

public class MemoryClients{public static List<IdentityResource> GetIdentityResources(){return new List<IdentityResource>{new IdentityResource{Name="openid",Enabled=true,Emphasize=true,Required=true,DisplayName="用户授权认证信息",Description="获取你的授权认证"},new IdentityResource{Name="profile",Enabled=true,Emphasize=false,Required=true,DisplayName="用户个人信息",Description="获取你的个人基本资料信息，如：姓名、性别、年龄等"}};}public static List<ApiResource> GetApiResources(){return new List<ApiResource>{//普通的通过构造函数限制 指定scope以及displayname 就行了//  new ApiResource("liyouming","打印云服务接口")//做一些更加严格的限制要求new  ApiResource(){Enabled=true,Name="liyouming",DisplayName="打印云服务接口",Description="选择允许即同意获取你的个人打印服务权限",Scopes={new Scope(){Emphasize=false,Required=false,Name="liyouming",DisplayName="打印云服务接口",Description="选择允许即同意获取你的个人打印服务权限"}}}};}public static List<Client> GetClients(){return new List<Client> {new Client(){ClientId="liyouming",ClientName="ChinaNetCore",ClientUri="http://www.chinanetcore.com",LogoUri="http://img05.tooopen.com/images/20160109/tooopen_sy_153858412946.jpg",ClientSecrets={new Secret("liyouming".Sha256()) },AllowedGrantTypes= GrantTypes.Hybrid,AccessTokenType= AccessTokenType.Jwt,RequireConsent=true,RedirectUris={ "http://localhost:5001/signin-oidc" },PostLogoutRedirectUris={"http://localhost:5001/signout-callback-oidc" },AllowedScopes={"openid","profile","liyouming",},BackChannelLogoutUri="http://localhost:5001/Default/LogoutByElse",BackChannelLogoutSessionRequired=true}};}}

    services.AddAuthentication(option =>{option.DefaultScheme = "Cookies";option.DefaultChallengeScheme = "oidc";}).AddCookie("Cookies").AddOpenIdConnect("oidc", options =>{options.SignInScheme = "Cookies";options.Authority = "http://localhost:5000";options.RequireHttpsMetadata = false;options.ResponseType = OpenIdConnectResponseType.CodeIdToken;options.ClientId = "liyouming";options.ClientSecret = "liyouming";options.SignedOutRedirectUri = "http://localhost:5001/signout-callback-oidc";options.SaveTokens = false;options.Events = new Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectEvents {OnRedirectToIdentityProviderForSignOut= OnRedirectToIdentityProviderForSignOut};});