C#中实现SSO单点登录的常用方案及实际案例

// Startup.cs
public void ConfigureServices(IServiceCollection services)
{
    // 配置身份验证
    services.AddDbContext<ApplicationDbContext>(options =>
        options.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));
    
    services.AddDefaultIdentity<IdentityUser>(options =>
        options.SignIn.RequireConfirmedAccount = true)
        .AddEntityFrameworkStores<ApplicationDbContext>();
    
    // 配置认证服务器
    services.AddIdentityServer()
        .AddApiAuthorization<IdentityUser, ApplicationDbContext>();
    
    services.AddAuthentication()
        .AddIdentityServerJwt();
}
​
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // ...
    app.UseAuthentication();
    app.UseIdentityServer();
    app.UseAuthorization();
    // ...
}

// appsettings.json
"IdentityServer": {
  "Authority": "https://your-auth-server.com",
  "ClientId": "your-client-id",
  "ClientSecret": "your-client-secret",
  "ResponseType": "code"
}
​
// Startup.cs
public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(options =>
    {
        options.DefaultScheme = "Cookies";
        options.DefaultChallengeScheme = "oidc";
    })
    .AddCookie("Cookies")
    .AddOpenIdConnect("oidc", options =>
    {
        options.Authority = "https://your-auth-server.com";
        options.ClientId = "your-client-id";
        options.ClientSecret = "your-client-secret";
        options.ResponseType = "code";
        options.Scope.Add("profile");
        options.Scope.Add("email");
        options.SaveTokens = true;
    });
}

public class JwtHelper
{
    private readonly string _secretKey;
    private readonly string _issuer;
    private readonly string _audience;
    
    public JwtHelper(IConfiguration configuration)
    {
        _secretKey = configuration["Jwt:SecretKey"];
        _issuer = configuration["Jwt:Issuer"];
        _audience = configuration["Jwt:Audience"];
    }
    
    public string GenerateToken(string userId, string username, IEnumerable<string> roles)
    {
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.NameIdentifier, userId),
            new Claim(ClaimTypes.Name, username)
        };
        
        foreach (var role in roles)
        {
            claims.Add(new Claim(ClaimTypes.Role, role));
        }
        
        var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_secretKey));
        var credentials = new SigningCredentials(key, SecurityAlgorithms.HmacSha256);
        
        var token = new JwtSecurityToken(
            issuer: _issuer,
            audience: _audience,
            claims: claims,
            expires: DateTime.Now.AddHours(1),
            signingCredentials: credentials
        );
        
        return new JwtSecurityTokenHandler().WriteToken(token);
    }
    
    public bool ValidateToken(string token, out ClaimsPrincipal principal)
    {
        var tokenHandler = new JwtSecurityTokenHandler();
        var key = Encoding.UTF8.GetBytes(_secretKey);
        
        try
        {
            principal = tokenHandler.ValidateToken(token, new TokenValidationParameters
            {
                ValidateIssuerSigningKey = true,
                IssuerSigningKey = new SymmetricSecurityKey(key),
                ValidateIssuer = true,
                ValidateAudience = true,
                ValidIssuer = _issuer,
                ValidAudience = _audience,
                ClockSkew = TimeSpan.Zero
            }, out _);
            
            return true;
        }
        catch
        {
            principal = null;
            return false;
        }
    }
}

[ApiController]
[Route("api/[controller]")]
public class AuthController : ControllerBase
{
    private readonly JwtHelper _jwtHelper;
    private readonly IUserService _userService;
    
    public AuthController(JwtHelper jwtHelper, IUserService userService)
    {
        _jwtHelper = jwtHelper;
        _userService = userService;
    }
    
    [HttpPost("login")]
    public async Task<IActionResult> Login([FromBody] LoginRequest request)
    {
        var user = await _userService.ValidateCredentials(request.Username, request.Password);
        
        if (user == null)
        {
            return Unauthorized("用户名或密码错误");
        }
        
        var roles = await _userService.GetUserRoles(user.Id);
        var token = _jwtHelper.GenerateToken(user.Id.ToString(), user.UserName, roles);
        
        // 设置SSO Cookie
        Response.Cookies.Append("SSO_TOKEN", token, new CookieOptions
        {
            HttpOnly = true,
            Secure = true,
            SameSite = SameSiteMode.None,
            Domain = ".yourcompany.com", // 注意设置为父域名
            Expires = DateTime.Now.AddHours(1)
        });
        
        return Ok(new { Token = token, UserId = user.Id, Username = user.UserName });
    }
    
    [HttpGet("check")]
    public IActionResult CheckLogin()
    {
        if (Request.Cookies.TryGetValue("SSO_TOKEN", out var token))
        {
            if (_jwtHelper.ValidateToken(token, out var principal))
            {
                return Ok(new { IsLoggedIn = true, UserInfo = principal.Identity.Name });
            }
        }
        
        return Ok(new { IsLoggedIn = false });
    }
    
    [HttpPost("logout")]
    public IActionResult Logout()
    {
        Response.Cookies.Delete("SSO_TOKEN", new CookieOptions
        {
            Domain = ".yourcompany.com",
            SameSite = SameSiteMode.None,
            Secure = true
        });
        
        return Ok("退出成功");
    }
}

public static IEnumerable<Client> Clients =>
    new Client[]
    {
        new Client
        {
            ClientId = "oa-client",
            ClientName = "内部OA系统",
            AllowedGrantTypes = GrantTypes.Code,
            ClientSecrets = { new Secret("oa-secret".Sha256()) },
            RedirectUris = { "https://oa.yourcompany.com/signin-oidc" },
            PostLogoutRedirectUris = { "https://oa.yourcompany.com/signout-callback-oidc" },
            AllowedScopes = { "openid", "profile", "email" }
        },
        new Client
        {
            ClientId = "crm-client",
            ClientName = "CRM系统",
            AllowedGrantTypes = GrantTypes.ClientCredentials,
            ClientSecrets = { new Secret("crm-secret".Sha256()) },
            AllowedScopes = { "crm-api" }
        },
        new Client
        {
            ClientId = "hr-client",
            ClientName = "人力资源系统",
            AllowedGrantTypes = GrantTypes.Code,
            ClientSecrets = { new Secret("hr-secret".Sha256()) },
            RedirectUris = { "https://hr.yourcompany.com/authentication/login-callback" },
            PostLogoutRedirectUris = { "https://hr.yourcompany.com/authentication/logout-callback" },
            AllowedScopes = { "openid", "profile", "email", "hr-api" }
        }
    };