文章/答案/技术大牛

发布

社区首页 >问答首页 >IdentityServer4 System.ArgumentNullException:值不能为空。参数名称:尝试刷新令牌时键入

问IdentityServer4 System.ArgumentNullException:值不能为空。参数名称:尝试刷新令牌时键入
EN

Stack Overflow用户

提问于 2019-05-15 09:42:01

回答 1查看 3.5K关注 0票数 0

我已经将identityserver4 v2.4设置为用户ASP.Net标识和实体框架作为操作存储。当我按如下方式调用tokenClient.RequestRefreshTokenAsync(oldRefreshToken);时，总是会在tokenResult中得到一个invalid_grant错误

TokenClient tokenClient = new TokenClient(tokenEndpoint, clientId, clientSecret);
string oldRefreshToken = await context.GetTokenAsync(OpenIdConnectParameterNames.RefreshToken);
TokenResponse tokenResult = await tokenClient.RequestRefreshTokenAsync(oldRefreshToken);

IDS4日志在日志中显示了一个ArgumentException (注意，有许多类似的问题，参数名是value而不是Parameter name: type，就像我的例子一样)。我不认为它们是相关的，因为推荐给我的解决方案对我没有用)。异常似乎是在IDS4 ClaimsConverter中引发的。我确实检查了MySQL数据库中的asp.net用户和索赔表中的任何null值字段，并确认没有：

[14:17:12 Debug] IdentityServer4.Validation.TokenRequestValidator
Start token request validation

[14:17:12 Debug] IdentityServer4.Validation.TokenRequestValidator
Start validation of refresh token request

[14:17:12 Debug] IdentityServer4.EntityFramework.Stores.PersistedGrantStore
pY3Q91B7RFXV2ilzuJtI+ggqkOg9xiRx4HcGZMfJf+0= found in database: True

[14:17:12 Error] IdentityServer4.Stores.DefaultRefreshTokenStore
Failed to deserialize JSON from grant store.
System.ArgumentNullException: Value cannot be null.
Parameter name: type
   at System.Security.Claims.Claim..ctor(String type, String value, String valueType, String issuer, String originalIssuer, ClaimsIdentity subject, String propertyKey, String propertyValue)
   at System.Security.Claims.Claim..ctor(String type, String value, String valueType)
   at IdentityServer4.Stores.Serialization.ClaimConverter.ReadJson(JsonReader reader, Type objectType, Object existingValue, JsonSerializer serializer) in C:\local\identity\server4\IdentityServer4\src\Storage\src\Stores\Serialization\ClaimConverter.cs:line 24
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.DeserializeConvertable(JsonConverter converter, JsonReader reader, Type objectType, Object existingValue)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.PopulateList(IList list, JsonReader reader, JsonArrayContract contract, JsonProperty containerProperty, String id)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateList(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, Object existingValue, String id)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateValueInternal(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.SetPropertyValue(JsonProperty property, JsonConverter propertyConverter, JsonContainerContract containerContract, JsonProperty containerProperty, JsonReader reader, Object target)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.PopulateObject(Object newObject, JsonReader reader, JsonObjectContract contract, JsonProperty member, String id)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateObject(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateValueInternal(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.SetPropertyValue(JsonProperty property, JsonConverter propertyConverter, JsonContainerContract containerContract, JsonProperty containerProperty, JsonReader reader, Object target)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.PopulateObject(Object newObject, JsonReader reader, JsonObjectContract contract, JsonProperty member, String id)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateObject(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.CreateValueInternal(JsonReader reader, Type objectType, JsonContract contract, JsonProperty member, JsonContainerContract containerContract, JsonProperty containerMember, Object existingValue)
   at Newtonsoft.Json.Serialization.JsonSerializerInternalReader.Deserialize(JsonReader reader, Type objectType, Boolean checkAdditionalContent)
   at Newtonsoft.Json.JsonSerializer.DeserializeInternal(JsonReader reader, Type objectType)
   at Newtonsoft.Json.JsonConvert.DeserializeObject(String value, Type type, JsonSerializerSettings settings)
   at Newtonsoft.Json.JsonConvert.DeserializeObject[T](String value, JsonSerializerSettings settings)
   at IdentityServer4.Stores.DefaultGrantStore`1.GetItemAsync(String key) in C:\local\identity\server4\IdentityServer4\src\IdentityServer4\src\Stores\Default\DefaultGrantStore.cs:line 92

[14:17:12 Warning] IdentityServer4.Validation.TokenValidator
Invalid refresh token

[14:17:12 Warning] IdentityServer4.Validation.TokenRequestValidator
Refresh token validation failed. aborting.

我在IDS4中的客户端配置如下

new Client
{
    ClientId = "AspNetClient",
    ClientName = "ASP.Net Client",

    RedirectUris           = { "http://localhost:5003/signin-oidc" },
    PostLogoutRedirectUris = { "http://localhost:5003/signout-callback-oidc" },

    AllowedGrantTypes = GrantTypes.Hybrid,
    RequireClientSecret = true,
    ClientSecrets =
    {
        new Secret("AspNetClientSecret".Sha256())
    },                    

    RequireConsent = false,
    AlwaysSendClientClaims = true,
    AlwaysIncludeUserClaimsInIdToken = true,
    AllowedScopes =
    {
        IdentityServerConstants.StandardScopes.OpenId,
        IdentityServerConstants.StandardScopes.Profile,
        IdentityServerConstants.StandardScopes.Email,
        IdentityServerConstants.StandardScopes.OfflineAccess,
        "AccessTokenAuthorizedApi"
    },

    AllowOfflineAccess = true,                    
    AccessTokenLifetime = (int) TimeSpan.FromSeconds(10).TotalSeconds,
    RefreshTokenUsage = TokenUsage.ReUse,
    RefreshTokenExpiration = TokenExpiration.Absolute,
    AbsoluteRefreshTokenLifetime = (int) TimeSpan.FromDays(30).TotalSeconds,
    UpdateAccessTokenClaimsOnRefresh = true
}

我做错了什么？

更新2019-05-15:

因此，我进行了更多的挖掘，并使用日志中找到的键(即pY3Q91B7RFXV2ilzuJtI+ggqkOg9xiRx4HcGZMfJf+0= )检索了pY3Q91B7RFXV2ilzuJtI+ggqkOg9xiRx4HcGZMfJf+0=表中的实际记录。我可以从Data字段中看到JSON文本中的4个空声明，这肯定是造成问题的原因。但是为什么IDS4要添加这样的空声明呢？

{
   "CreationTime":"2019-05-15T08:47:03Z",
   "Lifetime":2592000,
   "AccessToken":{
      "Audiences":[
         "http://localhost:5000/resources",
         "AccessTokenAuthorizedApi"
      ],
      "Issuer":"http://localhost:5000",
      "CreationTime":"2019-05-15T08:47:03Z",
      "Lifetime":10,
      "Type":"access_token",
      "ClientId":"AspNetClient",
      "AccessTokenType":0,
      "Claims":[
         {
            "Type":"client_id",
            "Value":"AspNetClient",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"scope",
            "Value":"openid",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"scope",
            "Value":"profile",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"scope",
            "Value":"email",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"scope",
            "Value":"AccessTokenAuthorizedApi",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"scope",
            "Value":"offline_access",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"sub",
            "Value":"0170490c-24c9-4be4-ae2a-5d4b1c55346e",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"auth_time",
            "Value":"1557910023",
            "ValueType":"http://www.w3.org/2001/XMLSchema#integer"
         },
         {
            "Type":"idp",
            "Value":"local",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"amr",
            "Value":"pwd",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"AspNet.Identity.SecurityStamp",
            "Value":"IF6RRMICBOOITA56FEJLPTFBXCIUKW3Z",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"role",
            "Value":"Driver",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"role",
            "Value":"Helper",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"preferred_username",
            "Value":"hybrid1",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {
            "Type":"name",
            "Value":"hybrid1",
            "ValueType":"http://www.w3.org/2001/XMLSchema#string"
         },
         {

         },
         {

         },
         {

         },
         {

         }
      ],
      "Version":4
   },
   "Version":4
}

asp.net-identity

identityserver4

claims-based-identity

refresh-token

identitymodel

回答 1

Stack Overflow用户

回答已采纳

发布于 2019-05-15 11:08:10

好的，看起来IDS4并没有像我预期的那样序列化派生的claims对象。我使用了一个自定义TenantClaim类，它继承了声明，并在IProfileService项目中的自定义IdentityServer实现中添加了4个这样的对象，如下所示：

public async Task GetProfileDataAsync(ProfileDataRequestContext context)
{
    // Other Code

    var tenantRoleClaim = new TenantRoleClaim(tenantRole.TenantId, tenantRole.Role);
    claims.Add(tenantRoleClaim);

    context.IssuedClaims = claims;
}

一旦我将它更改为使用普通的旧索赔类型对象，代码就可以工作了。

public async Task GetProfileDataAsync(ProfileDataRequestContext context)
{
    // Other Code

    var tenantRoleClaim = new TenantRoleClaim(tenantRole.TenantId, tenantRole.Role);
    claims.Add(new Claim(tenantRoleClaim.Type, tenantRoleClaim.Value));

    context.IssuedClaims = claims;
}

票数 0

页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持

原文链接：

https://stackoverflow.com/questions/56146232

复制

相似问题

问IdentityServer4 System.ArgumentNullException:值不能为空。参数名称:尝试刷新令牌时键入
EN

回答 1

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问IdentityServer4 System.ArgumentNullException:值不能为空。参数名称:尝试刷新令牌时键入EN

回答 1

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问IdentityServer4 System.ArgumentNullException:值不能为空。参数名称:尝试刷新令牌时键入
EN