开放反思与okta认证

Question

我试图在.net核心api中反思从okta接收到的令牌，但是一直得到“令牌不是活动的”。使用下面的设置，我可以从令牌检索身份。

service.AddAuthentication(options =>
  {
   options.DefaultAuthenticateScheme = OktaDefaults.ApiAuthenticationScheme;         
   options.DefaultChallengeScheme = OktaDefaults.ApiAuthenticationScheme;
   options.DefaultSignInScheme = OktaDefaults.ApiAuthenticationScheme;
   })
   .AddOktaWebApi(new OktaWebApiOptions()
   {
   OktaDomain = configuration["Authentication:Okta:OktaDomain"],
   AuthorizationServerId = configuration["Authentication:Okta:AuthorizationServerId"],
   Audience = configuration["Authentication:Okta:Audience"]});

但是，我需要使用“内省”模式设置身份验证--这里是我的配置：

service.AddAuthentication(auth =>     
    {
     auth.DefaultAuthenticateScheme = "Introspection";
       auth.DefaultChallengeScheme = "Introspection";
       auth.DefaultSignInScheme = "Introspection";
       })
       .AddOAuth2Introspection("Introspection", options =>
       {
       options.Authority = configuration["Authentication:Okta:Authority"];
       options.ClientId = configuration["Authentication:Okta:ClientId"];     
       options.TokenRetriever = request =>
    
       {
       string token = "";                
       if (request.Headers.ContainsKey("Authorization"))
       {                
        var parts = request.Headers["Authorization"].ToString().Split(" ");
        token = parts[1];
        return token;
       }
            if (request.Query.ContainsKey("access_token"))
            {
                token = request.Query["access_token"];
            }
            if (request.Cookies.ContainsKey("access_token"))
            {
                token = request.Cookies["access_token"];
            }
            return token;
        };
    });

有人知道原因是什么吗？

Answer 1

我找到了解决办法。在IntrospectionEndpoint属性IntrospectionOptions上，您可以指定包含authenticationServerID的完整路径。另外，对于某些authServer，根本没有authServID，您可以使用权限指定域( https://domain)，其余的都由introspectionHandler完成。