Client Credentials ​

public static class Config
{
    //Identity data
    public static IEnumerable<IdentityResource> IdentityResources =>
        new IdentityResource[] {new IdentityResources.OpenId(),};

    //APIs
    public static IEnumerable<ApiScope> ApiScopes =>
        new[]
        {
            new ApiScope("WeatherApi", "天气预报")
        };

    //Clients
    public static IEnumerable<Client> Clients =>
        new[]
        {
            new Client
            {
                ClientId = "ClientCredentialConsoleClient",
                ClientSecrets = {new Secret("ClientCredentialConsoleClient".Sha256())},
                AllowedGrantTypes = GrantTypes.ClientCredentials,
                AllowedScopes = {"WeatherApi"}
            }
        };
}

public void ConfigureServices(IServiceCollection services)
{
    var builder = services.AddIdentityServer(options => options.EmitStaticAudienceClaim = true)
        .AddInMemoryIdentityResources(Config.IdentityResources)
        .AddInMemoryApiScopes(Config.ApiScopes)
        .AddInMemoryClients(Config.Clients);

    // not recommended for production - you need to store your key material somewhere secure
    builder.AddDeveloperSigningCredential();
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment environment)
{
    if (environment.IsDevelopment())
        app.UseDeveloperExceptionPage();

    app.UseIdentityServer();
}

public void ConfigureServices(IServiceCollection services)
{
    services.AddControllers();
    var identityServerOptions =
        Configuration.GetSection(nameof(IdentityServerOptions)).Get<IdentityServerOptions>();
    services
        .AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(JwtBearerDefaults.AuthenticationScheme, options =>
        {
            options.Authority = identityServerOptions.Address;
            options.TokenValidationParameters.ValidateAudience = false;
        });
    services.AddAuthorization(options =>
    {
        foreach (var scope in identityServerOptions.Scopes)
            options.AddPolicy(scope, policy =>
            {
                policy.RequireAuthenticatedUser();
                policy.RequireClaim("scope", scope);
            });
    });
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseHttpsRedirection();
    app.UseRouting();
    app.UseAuthentication();
    app.UseAuthorization();
    app.UseEndpoints(endpoints => endpoints.MapControllers());
}

public class IdentityServerOptions
{
    public string Address { get; set; }
    public IEnumerable<string> Scopes { get; set; }
}

[ApiController]
[Route("[controller]")]
[Authorize("WeatherApi")]
public class WeatherForecastController : ControllerBase
{
    private static readonly string[] Summaries =
    {
        "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
    };

    [HttpGet]
    public IEnumerable<WeatherForecast> Get()
    {
        var rng = new Random();
        return Enumerable.Range(1, 5).Select(index => new WeatherForecast
            {
                Date = DateTime.Now.AddDays(index),
                TemperatureC = rng.Next(-20, 55),
                Summary = Summaries[rng.Next(Summaries.Length)]
            })
            .ToArray();
    }
}

static async Task Main(string[] args)
{
    var options = new ConfigurationBuilder()
        .AddJsonFile("appsettings.json")
        .Build()
        .GetSection(nameof(IdentityServerOptions))
        .Get<IdentityServerOptions>();

    using var client = new HttpClient();
    //发现IdentityServer配置
    var disco = await client.GetDiscoveryDocumentAsync(new DiscoveryDocumentRequest
    {
        Address = options.Address,
        // Policy = new DiscoveryPolicy
        // {
        //     RequireHttps = false,
        //     ValidateEndpoints = false,
        //     ValidateIssuerName = false
        // }
    });
    if (disco.IsError)
    {
        Console.WriteLine(disco.Error);
        return;
    }

    //获取Token
    var tokenResponse = await client.RequestClientCredentialsTokenAsync(new ClientCredentialsTokenRequest
    {
        Address = disco.TokenEndpoint,
        ClientId = options.ClientId,
        ClientSecret = options.ClientSecret,
        Scope = options.Scope
    });
    if (tokenResponse.IsError)
    {
        Console.WriteLine(tokenResponse.Error);
        return;
    }

    //API调用
    using var apiClient = new HttpClient();
    apiClient.SetBearerToken(tokenResponse.AccessToken);
    var response = await apiClient.GetAsync(options["WeatherApi"]);
    if (!response.IsSuccessStatusCode)
    {
        Console.WriteLine(response.StatusCode);
        return;
    }
    var content = await response.Content.ReadAsStringAsync();
    Console.WriteLine(JArray.Parse(content));
}

public void ConfigureServices(IServiceCollection services)
{
    var builder = services.AddIdentityServer(options => options.EmitStaticAudienceClaim = true)
        .AddInMemoryIdentityResources(Config.IdentityResources)
        .AddInMemoryApiScopes(Config.ApiScopes)
        .AddInMemoryClients(Config.Clients);

    if (_env.IsDevelopment() || _env.IsStaging())
        builder.AddDeveloperSigningCredential();
    else
        builder.AddSigningCredential(
            new X509Certificate2(Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "is4.pfx"),
                "5C6CE27CBA3DD15B4EFBE5A7EC679CBBE79D14F5"));
}