的accessToken是空的身份服务器客户端

Question

我有以下的OpenID选项：

app.UseCookieAuthentication(new CookieAuthenticationOptions 
      { 
       AuthenticationType = "Cookies", 
      }); 



      app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions 
      { 
       AuthenticationType = "oidc", 
       SignInAsAuthenticationType = "Cookies", 
       Authority = "http://localhost:5000",    
       ClientId = "mvcClient", 
       ClientSecret = "secret", 
       RedirectUri = "http://localhost:5002/signin-oidc", 
       PostLogoutRedirectUri = "http://localhost:5002", 
       ResponseType = "code id_token",        
       Scope = "openid profile", 

       Notifications = new OpenIdConnectAuthenticationNotifications 
       { 
        SecurityTokenValidated = async n => 
        { 
         var claims_to_exclude = new[] 
         { 
          "aud", "iss", "nbf", "exp", "nonce", "iat", "at_hash" 
         }; 

         var claims_to_keep = 
          n.AuthenticationTicket.Identity.Claims 
          .Where(x => false == claims_to_exclude.Contains(x.Type)).ToList(); 
         claims_to_keep.Add(new Claim("id_token", n.ProtocolMessage.IdToken)); 




         if (n.ProtocolMessage.AccessToken != null) 
         { 
          claims_to_keep.Add(new Claim("access_token", n.ProtocolMessage.AccessToken)); 

    }  
    }  
} 
} 

我看到n.ProtocolMessage.AccessToken总是空。

我身份的服务器配置的客户端是这样的：

new Client() 
       { 
        ClientId = "mvcClient", 
        ClientName = "MVC Client",      
        AllowedGrantTypes = GrantTypes.HybridAndClientCredentials, 

        ClientSecrets = new List<Secret>() 
        { 
         new Secret("secret".Sha256()) 
        }, 

        // RequireConsent = false, 

        // where to redirect to after login 
        RedirectUris = { "http://localhost:5002/signin-oidc" }, 
        // where to redirect to after logout 
        PostLogoutRedirectUris = { "http://localhost:5002" }, 

        AllowedScopes = 
        { 
         StandardScopes.OpenId.Name, 
         StandardScopes.Profile.Name, 
         StandardScopes.OfflineAccess.Name, 
         StandardScopes.Roles.Name, 
         "API" 
        } 
       }, 

我想知道为什么n.ProtocolMessage.AccessToken为空，我怎样才能得到它的价值

UPDATE

如果我改变客户端类型的混合是这样的：

AllowedGrantTypes = GrantTypes.Hybrid，

和的responseType =“代码id_token令牌：

我得到INVALID_REQUEST错误的服务器

如果我试图让这样的访问令牌（在通知）：

var client = new TokenClient("http://localhost:5000/connect/token", "mvcClient", "secret"); 
          var response = client.RequestClientCredentialsAsync("testscope").Result; 
          var accesstoken = response.AccessToken; 
          claims_to_keep.Add(new Claim("access_token", accesstoken)); 

结果令牌只有一个范围（即测试范围），而不是为该客户端定义的所有其他范围。

Answer 1

它是空的，因为你没有要求访问令牌。

ResponseType = "code id_token"手段给客户一个“Authoriziation代码”和“ID令牌”的回调。要获得访问令牌，无论是

1. 包括token在ResponseType作为ResponseType = "code id_token token" &更新客户端流量的混合流（代码+令牌），因为这就是我们现在做的事情。

或

1. 使用使用“授权码”上ProtocolMessage可用/token终端获取一个访问令牌。