DotNetOpenAuth 声称来自 Facebook 的标识符永远不会相同

Question

我正在使用 DotNetOpenAuth v3.5.0.10357，每次用户针对 Facebook 进行身份验证时，我都会得到一个不同的声明标识符。该令牌看起来是加密的，因此我假设 DNOA 以某种方式对令牌及其过期时间进行加密。谁能证实这一点吗？还是我使用错误：

    public ActionResult FacebookLogOn(string returnUrl)
    {
        IAuthorizationState authorization = m_FacebookClient.ProcessUserAuthorization();
        if (authorization == null)
        {
            // Kick off authorization request
            return new FacebookAuthenticationResult(m_FacebookClient, returnUrl);
        }
        else
        {
            // TODO: can we check response status codes to see if request was successful?
            var baseTokenUrl = "https://graph.facebook.com/me?access_token=";
            var requestUrl = String.Format("{0}{1}", baseTokenUrl, Uri.EscapeDataString(authorization.AccessToken));
            var claimedIdentifier = String.Format("{0}{1}", baseTokenUrl, authorization.AccessToken.Split('|')[0]);

            var request = WebRequest.Create(requestUrl);
            using (var response = request.GetResponse())
            {
                using (var responseStream = response.GetResponseStream())
                {
                    var graph = FacebookGraph.Deserialize(responseStream);
                    var token = RelyingPartyLogic.User.ProcessUserLogin(graph, claimedIdentifier);
                    this.FormsAuth.SignIn(token.ClaimedIdentifier, false);
                }
            }

            return RedirectAfterLogin(returnUrl);
        }
    }

这是 FacebookAuthenticationResult 的代码：

    public class FacebookAuthenticationResult : ActionResult
{
    private FacebookClient m_Client;
    private OutgoingWebResponse m_Response;

    public FacebookAuthenticationResult(FacebookClient client, string returnUrl)
    {
        m_Client = client;

        var authorizationState = new AuthorizationState(new String[] { "email" });
        if (!String.IsNullOrEmpty(returnUrl))
        {
            var currentUri = HttpContext.Current.Request.Url;
            var path = HttpUtility.UrlDecode(returnUrl);

            authorizationState.Callback = new Uri(String.Format("{0}?returnUrl={1}", currentUri.AbsoluteUri, path));

        }
        m_Response = m_Client.PrepareRequestUserAuthorization(authorizationState);
    }

    public FacebookAuthenticationResult(FacebookClient client) : this(client, null) { }

    public override void ExecuteResult(ControllerContext context)
    {
        m_Response.Send();
    }
}

另外，我正在使用 DNOA 示例中包含的 RelyingPartyLogic 项目，但我为 facebook 特有的 ProcessUserLogin 添加了一个重载：

    public static AuthenticationToken ProcessUserLogin(FacebookGraph claim, string claimedIdentifier)
    {
        string name = claim.Name;
        string email = claim.Email;
        if (String.IsNullOrEmpty(name))
            name = String.Format("{0} {1}", claim.FirstName, claim.LastName).TrimEnd();
        return ProcessUserLogin(claimedIdentifier, "http://facebook.com", email, name, claim.Verified);
    }

看起来好像 FacebookClient 继承自 WebServerClient 但我看起来对于 GitHub 上的源代码，我没有看到与相应 v3.5 版本相关（或至少没有标记）的分支或标签。

Answer 1

Facebook 不支持 OpenID。声明的标识符是一个 OpenID 术语。 Facebook 使用 OAuth 2.0，因此您混淆了 OpenID 和 OAuth。

Facebook 每次都会发送不同的访问令牌，这对于 OAuth 协议来说是正常的。您必须使用访问令牌来查询 Facebook，以获取每次访问时都一致的用户 ID。

Answer 2

我认为您还需要在令牌请求中添加离线访问权限，请参阅 https:// /developers.facebook.com/docs/reference/api/permissions/