系列目录：

DotNetOpenAuth实践系列（源码在这里）

上篇我们讲到WCF服务作为资源服务器接口提供数据服务，那么这篇我们介绍WebApi作为资源服务器，下面开始：

一、环境搭建

1、新建WebAPI项目

2、利用Nuget添加DotNetOpenAuth

注意：

Nuget里面的 NotNetOpenAuth 5.0.0 alpha3有bug，要到github(DotNetOpenAuth)里面下源码自己编译，用编译的dll替换掉Nuget引用的dll

3、把上次制作的证书文件拷贝的项目中

二、关键代码编写

1、公共代码

ResourceServerConfiguration

1 using System.Security.Cryptography.X509Certificates; WebApiResourcesServer.Code 4 { ResourceServerConfiguration 6 { 7 public X509Certificate2 EncryptionCertificate { get; set; } 8 public X509Certificate2 SigningCertificate { get; set; } 9 } 10 }

Common.cs

1 namespace WebApiResourcesServer.Code 2 { Common 4 { ResourceServerConfiguration Configuration = new ResourceServerConfiguration(); 6 } 7 }

Global.cs

1 using System; 2 using System.Collections.Generic; 3 using System.Linq; 4 using System.Security.Cryptography.X509Certificates; 5 using System.Web; 6 using System.Web.Http; 7 using System.Web.Mvc; 8 using System.Web.Optimization; 9 using System.Web.Routing; 10 using WebApiResourcesServer.Code; WebApiResourcesServer 13 { WebApiApplication : System.Web.HttpApplication 15 { Application_Start() 17 { 18 Common.Configuration = new ResourceServerConfiguration 19 { ), ), )) 22 }; 23 AreaRegistration.RegisterAllAreas(); 24 GlobalConfiguration.Configure(WebApiConfig.Register); 25 FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters); 26 RouteConfig.RegisterRoutes(RouteTable.Routes); 27 BundleConfig.RegisterBundles(BundleTable.Bundles); 28 } 29 } 30 }

注意：

这里有个地方要注意，就是认证服务器上面用公钥加密，在资源服务器要用私钥解密，所以ResourceServeConfiguration里面传进去的证书是和认证服务器里面的是对调的

2、重写DelegatingHandler

1 using DotNetOpenAuth.OAuth2; 2 using System; 3 using System.Net.Http; 4 using System.Security.Cryptography; 5 using System.Security.Principal; 6 using System.Threading; 7 using System.Threading.Tasks; 8 using System.Web; WebApiResourcesServer.Code 11 { OAuth2Handler : DelegatingHandler 13 { Task<IPrincipal> VerifyOAuth2(HttpRequestMessage httpDetails, params string[] requiredScopes) 15 { 16 // for this sample where the auth server and resource server are the same site, resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer((RSACryptoServiceProvider)Common.Configuration.SigningCertificate.PublicKey.Key, (RSACryptoServiceProvider)Common.Configuration.EncryptionCertificate.PrivateKey)); resourceServer.GetPrincipalAsync(httpDetails, requiredScopes: requiredScopes); 20 } Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken) 23 { ) 25 { principal =VerifyOAuth2(request); (principal.Result != null) 30 { 31 HttpContext.Current.User = principal.Result; 32 Thread.CurrentPrincipal = principal.Result; 33 } } .SendAsync(request, cancellationToken); 39 } 40 41 } 42 }

3、App_Start/WebApiConfig.cs里面添加OAuthHandler