owin | 易学教程

ASP.NET Core 与 .NET Core 演变与基础概述

阅读更多关于 ASP.NET Core 与 .NET Core 演变与基础概述

https://github.com/dotnet/core https://github.com/aspnet/home 今天看到 .NET Core 的改名计划，感觉跨平台的时代快要来了，从之前的 ASP.NET NEXT,ASP.NET 5,ASP.NET Core 1.0 等概念一路演变过来，花了点时间总结一下几个相关的概念。 OWIN 与 Katana 的关系 ASP.NET Core 1.0 的由来，要追溯到 Katana 这个项目， Katana 是 OWIN 定义规范的一个实现组件集合。 Open Web Interface for .NET (OWIN) OWIN 是 Open Web Server Interface for .NET 首字母缩写,OWIN 定义了 Web 服务器和应用程序组件之间的交互的规范( specifications ); OWIN 在 .NET Web 服务器和 .NET Web 应用之间定义了一套标准的接口,其目的是为了实现服务器与应用之间的解耦。由于这一规范的目的是发展一个广阔且充满活力的、基于 Microsoft .NET Framework 的 Web 服务器和应用程序组件生态系统，因此它可以将服务器与应用程序之间的交互减少到一小部分类型和单个函数签名，这个函数签名被称为应用程序委托（即 AppFunc） using

Sending large POST requests with integrated Windows authentication in OWIN self-host

阅读更多关于 Sending large POST requests with integrated Windows authentication in OWIN self-host

问题 I'm trying to set up an endpoint for authenticated HTTP POST requests that will handle requests whose bodies sit at around 15 kB. I followed the description on MSDN and defined var httpListener = (OwinHttpListener) appBuilder.Properties[typeof(OwinHttpListener).FullName]; httpListener.Listener.AuthenticationSchemeSelectorDelegate = request => request.HttpMethod == "POST" ? AuthenticationSchemes.IntegratedWindowsAuthentication : AuthenticationSchemes.Anonymous; in my Startup.Configuration .

Error on type WebActivatorEx.ActivationManager threw an exception …Parameter count mismatch

阅读更多关于 Error on type WebActivatorEx.ActivationManager threw an exception …Parameter count mismatch

问题 I am getting this error after I installed Microsoft.Owin.*. Target .Net Framework:4.5.2. Web Activator: 2.2.0 I have the same setup in another project and that seems to work fine. Please help me debug or fix this. Have I have done so far:- Updated all Nuget Packages Deleted obj folder contents Ran aspnet_compiler.exe -p C:\source\Application\MyAPI -v anything -errorstack . It did give the same error, but stopped after I added WebMatrix.data. Full Error Details :- Parameter count mismatch.

asp.net mvc azure AAD authentication infinite loop

阅读更多关于 asp.net mvc azure AAD authentication infinite loop

问题 I have an asp.net mvc application with azure AAD sign in. When I press f5 to debug the application goes to azure to authenticate in AAD, then it goes back to the application to the controller, and its redirected back again to azure. I know this because If I put a breakpoint on the Sign In controller it gets hit infinitely This is my route config public static void RegisterRoutes(RouteCollection routes) { routes.IgnoreRoute("{resource}.axd/{*pathInfo}"); //routes.IgnoreRoute(""); routes

MVC5 Identity/OWIN - Signout events

阅读更多关于 MVC5 Identity/OWIN - Signout events

问题 How to detect all possible SignOuts? Is there a way to get some event when SignOut is made manually, by timeout and any other possible ways? I need to know when user authentication ends like i know that it starts when SingIn is called. I'm using both internal accounts and external (like Facebook). 回答1: I need a spot that i can initialize user session when user is already authenticated. Below is code that should do the job, i don't like it at all. I need to check session at each request to be

Server side claims caching with Owin Authentication

阅读更多关于 Server side claims caching with Owin Authentication

问题 I have an application that used to use FormsAuthentication , and a while ago I switched it to use the IdentityModel from WindowsIdentityFramework so that I could benefit from claims based authentication, but it was rather ugly to use and implement. So now I'm looking at OwinAuthentication . I'm looking at OwinAuthentication and the Asp.Net Identity framework. But the Asp.Net Identity framework's only implementation at the moment uses EntityModel and I'm using nHibernate . So for now I'm

Protecting webapi with IdentityServer and Autofac - can't get claims

阅读更多关于 Protecting webapi with IdentityServer and Autofac - can't get claims

问题 I'm trying to protect my webapi with IdentityServer and OpenID Connect using Autofac. I'm using OWIN. But for some reason I can't get claims of the user. It seems that AccessTokenValidation is not triggered at all. That makes me think there is something wrong in the order of my declarations at my startup. Here is my startup. public class Startup { public void Configuration(IAppBuilder appBuilder) { // Add authentication this.AddAuthentication(appBuilder); HttpConfiguration config = new

Azure AD Authentication Breaking HTTP Post Actions When Session Times Out

阅读更多关于 Azure AD Authentication Breaking HTTP Post Actions When Session Times Out

问题 I recently changed from windows authentication to Azure AD using roughly the "out of the box" code; public void ConfigureAuth(IAppBuilder app) { app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType); app.UseKentorOwinCookieSaver(); app.UseCookieAuthentication(new CookieAuthenticationOptions()); app.UseOpenIdConnectAuthentication( new OpenIdConnectAuthenticationOptions { ClientId = clientId, Authority = Authority, PostLogoutRedirectUri =

初识Identity

阅读更多关于初识Identity

摘要通过本文你将了解ASP.NET身份验证机制，表单认证的基本流程，ASP.NET Membership的一些弊端以及ASP.NET Identity的主要优势。文件夹身份验证（Authentication）和授权（Authorization） ASP.NET身份验证方式理解表单验证流程认识ASP.NET Membership 拥抱ASP.NET Identity ASP.NET Identity主要组成部分总结身份验证（Authentication）和授权（Authorization）我们先来思考一个问题：怎样构建安全的WEB应用？一直以来，这都是比較热门的话题。不幸的是。眼下还没有一种万能方法。来保证您的WEB应用是绝对安全的。无论是系统本身的漏洞，还是其它外来的攻击。我们每天都饱受着安全问题的煎熬。事实上，我们也无需沮丧和纠结。既然，我们不能阻止攻击，可是能够提前预防，尽量将损失减到最小，不是吗？眼下，有很多适用于ASP.NET应用的安全原则。比方深度防御、不信任不论什么输入数据、关闭不必要的功能等等。可是，最主要的、最重要的原则还是身份验证（Authentication）和授权（Authorization）。初次看到这两个概念。或许大家非常easy犯迷糊。由于，Authentication和Authorization确实长得非常像。事实上

ASP.NET MVC 随想录——开始使用ASP.NET Identity，初级篇

阅读更多关于 ASP.NET MVC 随想录——开始使用ASP.NET Identity，初级篇

在之前的文章中，我为大家介绍了OWIN和Katana，有了对它们的基本了解后，才能更好的去学习ASP.NET Identity，因为它已经对OWIN 有了良好的集成。在这篇文章中，我主要关注ASP.NET Identity的建立和使用，包括基础类的搭建和用户管理功能的实现—— 点此进行预览点此下载示例代码在后续文章中，我将探索它更高级的用法，比如身份验证并联合ASP.NET MVC 进行授权、使用第三方登录、声明式认证等。 ASP.NET Identity 前世今生 ASP.NET Membership 在 ASP.NET 2.0 时代， ASP.NET Membership 用于用户管理的常见需求。包括表单身份验证（ Form Authentication ），一个用于存储用户名、密码和其他用户信息的 SQL Server 数据库。但是现在，对于 Web 应用程序的数据存储我们有了更多的选择。而且，大多数开发者希望自己的站点能够使用第三方供应商提供的社交账号来实现身份验证和授权。但是，由于 ASP.NET Membership 自身设计的限制，已经难以满足如下变化：数据库架构为 SQL Server 设计，而且无法修改。虽然你可以添加额外的用户信息，但这些数据被存入了一张不同的数据表。而且这些信息难以访问，除了使用 Profile Provider API 。虽然通过

订阅 owin