ServiceStack基本鉴权失败

本文关键字：失败 ServiceStack | 更新日期: 2023-09-27 18:08:40

我试图利用ServiceStack的基本身份验证，但即使通过正确的凭据后，我得到错误:

[Authenticate: 6/16/2014 4:00:22 AM]: [REQUEST: {UserName:john,Password:test}] 
ServiceStack.HttpError: Invalid BasicAuth credentials at 
ServiceStack.Auth.BasicAuthProvider.Authenticate(IServiceBase authService, IAuthSession 
session, Authenticate request) at 
ServiceStack.Auth.AuthenticateService.Authenticate(Authenticate request, String provider, 
IAuthSession session, IAuthProvider oAuthConfig) at 
ServiceStack.Auth.AuthenticateService.Post(Authenticate request) at 
ServiceStack.Auth.AuthenticateService.Get(Authenticate request) at lambda_method(Closure , 
Object , Object ) at ServiceStack.Host.ServiceRunner`1.Execute(IRequest request, Object 
instance, TRequest requestDto)

我的AppHost.cs类Configure函数的代码行如下:

// Register AuthFeature with custom user session and Basic auth provider
Plugins.Add(new AuthFeature(
() => new AuthUserSession(),
new AuthProvider[] { new BasicAuthProvider() }
));
Plugins.Add(new RegistrationFeature());
// register storage for user sessions 
container.Register<ICacheClient>(new MemoryCacheClient());
container.Register<ISessionFactory>(c => new SessionFactory(c.Resolve<ICacheClient>()));
var userRep = new InMemoryAuthRepository();
container.Register<IUserAuthRepository>(userRep);
//Add a user for testing purposes
string hash;
string salt;
new SaltedHash().GetHashAndSaltString("test", out hash, out salt);
userRep.CreateUserAuth(new UserAuth
{
    Id = 1,
    DisplayName = "DisplayName",
    Email = "as@if.com",
    UserName = "john",
    FirstName = "FirstName",
    LastName = "LastName",
    PasswordHash = hash,
    Salt = salt,
}, "test");

身份验证的URL是:

http://<domain>:63743/auth?Username=john&Password=test

请告诉我这种行为的根本原因是什么?

ServiceStack基本鉴权失败

它看起来不像你使用基本认证正确，BasicAuthProvider在ServiceStack意味着HTTP基本认证:(即它不意味着简单认证)

在我们的ServiceClients中启用了BasicAuth支持，AuthTests.cs中有一些这样的例子:

你发送HTTP基本认证的方式是使用Authorization HTTP头，例如:

Authorization: basic {bas64encoded user:pass}

下面是使用WebRequest发送HTTP基本认证的示例:

var base64Token = Convert.ToBase64String(
    Encoding.UTF8.GetBytes(AllowedUser + ":" + AllowedPass));
var req = (HttpWebRequest)WebRequest.Create("http://domain.com/secure");
req.Headers["Authorization"] = "basic " + base64Token;

如果你想通过url登录，那么你想注册一个CredentialsAuthProvider，即:

Plugins.Add(new AuthFeature(() => new AuthUserSession(),
    new AuthProvider[] { new CredentialsAuthProvider() }
));

这将允许您登录在url:

/auth/credentials?Username=john&Password=test

创建自己的自定义凭据提供程序

如果你愿意，你可以提供你自己的自定义认证提供商，你可以继承CredentialsAuthProvider和覆盖TryAuthenticate与你自己的自定义实现，例如:

public class CustomCredentialsAuthProvider : CredentialsAuthProvider
{
    public override bool TryAuthenticate(IServiceBase authService, 
        string userName, string password)
    {
        return userName == "john" && password == "test";
    }
}

你可以注册:

Plugins.Add(new AuthFeature(() => new AuthUserSession(),
    new AuthProvider[] { 
        new CustomCredentialsAuthProvider(),
    }
));
相关文章：