【ASP.NET Core】執行原理(3):認證

Never、C發表於2017-12-14

本系列將分析ASP.NET Core執行原理

本節將分析Authentication

原始碼參考.NET Core 2.0.0

認證

認證已經是當前Web必不可缺的元件。看看ASP.NET Core如何定義和實現認證。
在Startup類中，使用認證元件非常簡單。

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication();
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.UseAuthentication();
}

AddAuthentication

先來分析AddAuthentication：

public static IServiceCollection AddAuthenticationCore(this IServiceCollection services)
{
    services.TryAddScoped<IAuthenticationService, AuthenticationService>();
    services.TryAddScoped<IAuthenticationHandlerProvider, AuthenticationHandlerProvider>();
    services.TryAddSingleton<IAuthenticationSchemeProvider, AuthenticationSchemeProvider>();
    return services;
}

public static AuthenticationBuilder AddAuthentication(this IServiceCollection services)
{
    services.AddAuthenticationCore();
    return new AuthenticationBuilder(services);
}

IAuthenticationService

在AddAuthentication方法中註冊了IAuthenticationService、IAuthenticationHandlerProvider、IAuthenticationSchemeProvider3個服務。
首先分析下IAuthenticationService:

public interface IAuthenticationService
{
    Task<AuthenticateResult> AuthenticateAsync(HttpContext context, string scheme);

    Task ChallengeAsync(HttpContext context, string scheme, AuthenticationProperties properties);

    Task ForbidAsync(HttpContext context, string scheme, AuthenticationProperties properties);

    Task SignInAsync(HttpContext context, string scheme, ClaimsPrincipal principal, AuthenticationProperties properties);

    Task SignOutAsync(HttpContext context, string scheme, AuthenticationProperties properties);
}

AuthenticateAsync：驗證使用者身份，並返回AuthenticateResult物件。
ChallengeAsync：通知使用者需要登入。在預設實現類AuthenticationHandler中，返回401。
ForbidAsync：通知使用者許可權不足。在預設實現類AuthenticationHandler中，返回403。
SignInAsync：登入使用者。(該方法需要與AuthenticateAsync配合驗證邏輯)
SignOutAsync：退出登入。

而IAuthenticationService的預設實現類為：

public class AuthenticationService : IAuthenticationService
{
    public virtual async Task<AuthenticateResult> AuthenticateAsync(HttpContext context, string scheme)
    {
        if (scheme == null)
        {
            var defaultScheme = await Schemes.GetDefaultAuthenticateSchemeAsync();
            scheme = defaultScheme?.Name;
        }

        var handler = await Handlers.GetHandlerAsync(context, scheme);
        var result = await handler.AuthenticateAsync();
        if (result != null && result.Succeeded)
            return AuthenticateResult.Success(new AuthenticationTicket(result.Principal, result.Properties, result.Ticket.AuthenticationScheme));
        return result;
    }
}

在AuthenticateAsync程式碼中，先查詢Scheme，然後根據SchemeName查詢Handle，再呼叫handle的同名方法。
解釋一下GetDefaultAuthenticateSchemeAsync會先查DefaultAuthenticateScheme，如果為null，再查DefaultScheme。
實際上，AuthenticationService的其他方法都是這樣的模式，最終呼叫的都是handle的同名方法。

IAuthenticationHandlerProvider

因此，我們看看獲取Handle的IAuthenticationHandlerProvider:

public interface IAuthenticationHandlerProvider
{
    Task<IAuthenticationHandler> GetHandlerAsync(HttpContext context, string authenticationScheme);
}

該介面只有一個方法，根據schemeName查詢Handle:

public class AuthenticationHandlerProvider : IAuthenticationHandlerProvider
{
    public AuthenticationHandlerProvider(IAuthenticationSchemeProvider schemes)
    {
        Schemes = schemes;
    }

    public IAuthenticationSchemeProvider Schemes { get; }

    public async Task<IAuthenticationHandler> GetHandlerAsync(HttpContext context, string authenticationScheme)
    {
        if (_handlerMap.ContainsKey(authenticationScheme))
            return _handlerMap[authenticationScheme];

        var scheme = await Schemes.GetSchemeAsync(authenticationScheme);
        if (scheme == null)
            return null;
        var handler = (context.RequestServices.GetService(scheme.HandlerType) ??
            ActivatorUtilities.CreateInstance(context.RequestServices, scheme.HandlerType)) as IAuthenticationHandler;
        if (handler != null)
        {
            await handler.InitializeAsync(scheme, context);
            _handlerMap[authenticationScheme] = handler;
        }
        return handler;
    }
}

在GetHandlerAsync方法中，我們看到是先從IAuthenticationSchemeProvider中根據schemeName獲取scheme，然後透過scheme的HandleType來建立IAuthenticationHandler。
建立Handle的時候，是先從ServiceProvider中獲取，如果不存在則透過ActivatorUtilities建立。
獲取到Handle後，將呼叫一次handle的InitializeAsync方法。
當下次獲取Handle的時候，將直接從快取中獲取。

需要補充說明的是一共有3個Handle：
IAuthenticationHandler、IAuthenticationSignInHandler、IAuthenticationSignOutHandler。

public interface IAuthenticationSignInHandler : IAuthenticationSignOutHandler, IAuthenticationHandler{}
public interface IAuthenticationSignOutHandler : IAuthenticationHandler{}
public interface IAuthenticationHandler{}

之所以介面拆分，應該是考慮到大部分的系統的登入和退出是單獨一個身份系統處理。

IAuthenticationSchemeProvider

透過IAuthenticationHandlerProvider程式碼，我們發現最終還是需要IAuthenticationSchemeProvider來提供Handle型別：
這裡展示IAuthenticationSchemeProvider介面核心的2個方法。

public interface IAuthenticationSchemeProvider
{
    void AddScheme(AuthenticationScheme scheme);
    Task<AuthenticationScheme> GetSchemeAsync(string name);
}

預設實現類AuthenticationSchemeProvider：

public class AuthenticationSchemeProvider : IAuthenticationSchemeProvider
{
    private IDictionary<string, AuthenticationScheme> _map = new Dictionary<string, AuthenticationScheme>(StringComparer.Ordinal);

    public virtual void AddScheme(AuthenticationScheme scheme)
    {
        if (_map.ContainsKey(scheme.Name))
        {
            throw new InvalidOperationException("Scheme already exists: " + scheme.Name);
        }
        lock (_lock)
        {
            if (_map.ContainsKey(scheme.Name))
            {
                throw new InvalidOperationException("Scheme already exists: " + scheme.Name);
            }
            _map[scheme.Name] = scheme;
        }
    }

    public virtual Task<AuthenticationScheme> GetSchemeAsync(string name)
            => Task.FromResult(_map.ContainsKey(name) ? _map[name] : null);
}

因此，整個認證邏輯最終都回到了Scheme位置。也就說明要認證，則必須先註冊Scheme。

UseAuthentication

AddAuthentication實現了註冊Handle，UseAuthentication則是使用Handle去認證。

public static IApplicationBuilder UseAuthentication(this IApplicationBuilder app)
{
    return app.UseMiddleware<AuthenticationMiddleware>();
}

使用了AuthenticationMiddleware：

public class AuthenticationMiddleware
{
    private readonly RequestDelegate _next;
    public IAuthenticationSchemeProvider Schemes { get; set; }

    public AuthenticationMiddleware(RequestDelegate next, IAuthenticationSchemeProvider schemes)
    {
        _next = next;
        Schemes = schemes;
    }

    public async Task Invoke(HttpContext context)
    {
        var handlers = context.RequestServices.GetRequiredService<IAuthenticationHandlerProvider>();
        foreach (var scheme in await Schemes.GetRequestHandlerSchemesAsync())
        {
            var handler = await handlers.GetHandlerAsync(context, scheme.Name) as IAuthenticationRequestHandler;
            if (handler != null && await handler.HandleRequestAsync())
            {
                return;
            }
        }

        var defaultAuthenticate = await Schemes.GetDefaultAuthenticateSchemeAsync();
        if (defaultAuthenticate != null)
        {
            var result = await context.AuthenticateAsync(defaultAuthenticate.Name);
            if (result?.Principal != null)
            {
                context.User = result.Principal;
            }
        }

        await _next(context);
    }
}

在Invoke程式碼中，我們看到先查詢出所有的AuthenticationRequestHandler。如果存在，則立即呼叫其HandleRequestAsync方法，成功則直接返回。
(RequestHandler一般是處理第三方認證響應的OAuth / OIDC等遠端認證方案。)
如果不存在RequestHandler或執行失敗，將呼叫預設的AuthenticateHandle的AuthenticateAsync方法。同時會對context.User賦值。

Authentication.Cookies

Cookies認證是最常用的一種方式，這裡我們分析一下Cookie原始碼：

AddCookie

public static class CookieExtensions
{
    public static AuthenticationBuilder AddCookie(this AuthenticationBuilder builder)
        => builder.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme);

    public static AuthenticationBuilder AddCookie(this AuthenticationBuilder builder, string authenticationScheme)
        => builder.AddCookie(authenticationScheme, configureOptions: null);

    public static AuthenticationBuilder AddCookie(this AuthenticationBuilder builder, Action<CookieAuthenticationOptions> configureOptions)
        => builder.AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, configureOptions);

    public static AuthenticationBuilder AddCookie(this AuthenticationBuilder builder, string authenticationScheme, Action<CookieAuthenticationOptions> configureOptions)
        => builder.AddCookie(authenticationScheme, displayName: null, configureOptions: configureOptions);

    public static AuthenticationBuilder AddCookie(this AuthenticationBuilder builder, string authenticationScheme, string displayName, Action<CookieAuthenticationOptions> configureOptions)
    {
        builder.Services.TryAddEnumerable(ServiceDescriptor.Singleton<IPostConfigureOptions<CookieAuthenticationOptions>, PostConfigureCookieAuthenticationOptions>());
        return builder.AddScheme<CookieAuthenticationOptions, CookieAuthenticationHandler>(authenticationScheme, displayName, configureOptions);
    }
}

AddCookie(this AuthenticationBuilder builder, Action<CookieAuthenticationOptions> configureOptions)可能是我們最常用的
該方法將註冊CookieAuthenticationHandler用於處理認證相關。

public class CookieAuthenticationHandler : AuthenticationHandler<CookieAuthenticationOptions>,IAuthenticationSignInHandler
{
    public async virtual Task SignInAsync(ClaimsPrincipal user, AuthenticationProperties properties)
    {
        var signInContext = new CookieSigningInContext(
                Context,
                Scheme,
                Options,
                user,
                properties,
                cookieOptions);
        var ticket = new AuthenticationTicket(signInContext.Principal, signInContext.Properties, signInContext.Scheme.Name);
        var cookieValue = Options.TicketDataFormat.Protect(ticket, GetTlsTokenBinding());
        Options.CookieManager.AppendResponseCookie(
                Context,
                Options.Cookie.Name,
                cookieValue,
                signInContext.CookieOptions);
    }
    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        var cookie = Options.CookieManager.GetRequestCookie(Context, Options.Cookie.Name);
        var ticket = Options.TicketDataFormat.Unprotect(cookie, GetTlsTokenBinding());
        return AuthenticateResult.Success(ticket);
    }
}

這裡我們用Cookie示例：

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(options => options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme).AddCookie(options => options.Cookie.Path = "/");
}
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.Map("/login", app2 => app2.Run(async context =>
    {
        var claimIdentity = new ClaimsIdentity(CookieAuthenticationDefaults.AuthenticationScheme);
        claimIdentity.AddClaim(new Claim(ClaimTypes.Name, Guid.NewGuid().ToString("N")));
        await context.SignInAsync(new ClaimsPrincipal(claimIdentity));
    }));

    app.UseAuthentication();

    app.Run(context => context.Response.WriteAsync(context.User?.Identity?.IsAuthenticated ?? false ? context.User.Identity.Name : "No Login!"));
}

當訪問login的時候，將返回Cookie。再訪問除了login以外的頁面時則返回一個guid。

模擬身份認證

public class DemoHandle : IAuthenticationSignInHandler
{
    private HttpContext _context;
    private AuthenticationScheme _authenticationScheme;
    private string _cookieName = "user";

    public Task InitializeAsync(AuthenticationScheme scheme, HttpContext context)
    {
        _context = context;
        _authenticationScheme = scheme;
        return Task.CompletedTask;
    }

    public Task<AuthenticateResult> AuthenticateAsync()
    {
        var cookie = _context.Request.Cookies[_cookieName];
        if (string.IsNullOrEmpty(cookie))
        {
            return Task.FromResult(AuthenticateResult.NoResult());
        }
        var identity = new ClaimsIdentity(_authenticationScheme.Name);
        identity.AddClaim(new Claim(ClaimTypes.Name, cookie));
        var ticket = new AuthenticationTicket(new ClaimsPrincipal(identity), _authenticationScheme.Name);
        return Task.FromResult(AuthenticateResult.Success(ticket));
    }

    public Task SignInAsync(ClaimsPrincipal user, AuthenticationProperties properties)
    {
        _context.Response.Cookies.Append(_cookieName, user.Identity.Name);
        return Task.CompletedTask;
    }
}

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(options =>
    {
        options.DefaultScheme = "cookie";
        options.AddScheme<DemoHandle>("cookie", null);
    });
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
    app.Map("/login", app2 => app2.Run(async context =>
    {
        var claimIdentity = new ClaimsIdentity();
        claimIdentity.AddClaim(new Claim(ClaimTypes.Name, Guid.NewGuid().ToString("N")));
        await context.SignInAsync(new ClaimsPrincipal(claimIdentity));
        context.Response.Redirect("/");
    }));

    app.UseAuthentication();

    app.Run(context => context.Response.WriteAsync(context.User?.Identity?.IsAuthenticated ?? false ? context.User.Identity.Name : "No Login!"));
}

預設訪問根目錄的時候，顯示“No Login”
當使用者訪問login路徑的時候，會跳轉到根目錄，並顯示登入成功。
這裡稍微補充一下Identity.IsAuthenticated => !string.IsNullOrEmpty(_authenticationType);

本文連結：http://www.cnblogs.com/neverc/p/8037477.html

ASP.NET Core - JWT認證實現
2021-01-17
ASP.NETJWT
ASP.NET Core[原始碼分析篇] - 認證
2019-07-03
ASP.NET原始碼
ASP.NET Core 基於JWT的認證(一)
2019-02-24
ASP.NETJWT
ASP.NET Core 基於JWT的認證(二)
2019-03-18
ASP.NETJWT
【ASP.NET Core學習】使用JWT認證授權
2020-08-13
ASP.NETJWT
ASP.NET Core之身份認證和授權JWT
2024-11-29
ASP.NETJWT
快速理解ASP.NET Core的認證與授權
2022-01-12
ASP.NET
ASP.NET Core 6.0 新增 JWT 認證和授權
2022-04-16
ASP.NETJWT
理解ASP.NET Core - 基於Cookie的身份認證(Authentication)
2022-01-17
ASP.NETCookie
理解ASP.NET Core - 基於JwtBearer的身份認證(Authentication)
2022-02-14
ASP.NETJWT
.net core中使用jwt進行認證
2020-09-06
JWT
CB認證執行標準
2019-12-09
【ASP.NET Core】MVC過濾器：執行流程
2023-11-26
ASP.NETMVC過濾器
ASP.NET Core 3.x啟動時執行非同步任務（一）
2020-09-16
ASP.NET非同步
ASP.NET Core 3.x啟動時執行非同步任務（二）
2020-09-23
ASP.NET非同步
ASP.NET Core Authentication系列（二）實現認證、登入和登出
2020-11-02
ASP.NET
asp.net core + Ocelot 實現負載均衡、熔斷、認證、限流
2024-06-04
ASP.NET負載
Shiro(認證的執行流程Authentication)
2018-08-14
asp.net core 3.1多種身份驗證方案，cookie和jwt混合認證授權
2020-08-04
ASP.NETCookieJWT
ASP.NET Core端點路由作用原理
2020-07-12
ASP.NET路由
ASP.NET Core 3.x Razor檢視執行時重新整理實時編譯
2020-09-08
ASP.NET編譯
Kerberos認證原理詳解
2020-09-30
ROS
Django（65）jwt認證原理
2021-06-20
DjangoJWT
.NET Core 執行緒池(ThreadPool)底層原理淺談
2024-12-05
執行緒thread
WHQL認證2019年3月認證流程
2019-03-20
ASP.NET Core MVC+Layui使用EF Core連線MySQL執行簡單的CRUD操作
2020-06-01
ASP.NETMVCUIMySql
研究嵌入式裝置訪問Asp.Net Core Web Api的簡單認證方式
2024-06-09
ASP.NETWebAPI
Docker & ASP.NET Core (3)：釋出映象
2018-11-24
DockerASP.NET
ASP.NET Core 2.1 : 十一. 如何在後臺執行一個任務
2018-06-27
ASP.NET
.Net Core中自定義認證實現
2022-01-23
《Asp.Net Core3 + Vue3入坑教程》 - 4.EF Core & Postgresql
2021-03-02
ASP.NETVueSQL
ASP.NET Core託管執行Quartz.NET作業排程詳解
2020-10-23
ASP.NETquartz
ASP.NET Core 3.x API版本控制
2020-06-02
ASP.NETAPI
ASP.NET Core Blazor 3：使用 Blazor Server (2)
2024-06-26
ASP.NETBlazorServer
3.執行原理探究（1.Pom.xml）
2020-09-28
XML
ASP.NET Core中的中介軟體及其工作原理
2021-01-05
ASP.NET
【asp.net core】自定義模型繫結及其驗證
2023-05-09
ASP.NET模型
ASP.NET Core - 實現自定義WebApi模型驗證
2019-08-01
ASP.NETWebAPI模型
【asp.net core 系列】13 Identity 身份驗證入門
2020-06-23
ASP.NETIDE