クライアントアプリケーションでのベアラートークンの使用

<Project Sdk="Microsoft.NET.Sdk.Web">
  <PropertyGroup>
    <TargetFramework>netcoreapp2.1</TargetFramework>
  </PropertyGroup>
  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.App" />
  </ItemGroup>
</Project>

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddMvcCore()
            .AddAuthorization()
            .AddJsonFormatters();

        services.AddAuthentication("Bearer")
            .AddJwtBearer("Bearer", options =>
            {
                options.Authority = "https://localhost:44356";
                options.RequireHttpsMetadata = false;

                options.Audience = "sitecore.profile.api";
            });
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        app.UseAuthentication();
        app.UseMvc();
    }
}

[Route("[controller]")]
[Authorize]
public class IdentityController : ControllerBase
{
    [HttpGet]
    public IActionResult Get()
    {
        return new JsonResult(from c in User.Claims
            select new
            {
                c.Type,
                c.Value
            });
    }
}

<Project Sdk="Microsoft.NET.Sdk.Web">
  <PropertyGroup>
    <TargetFramework>netcoreapp2.1</TargetFramework>
  </PropertyGroup>

  <ItemGroup>
    <PackageReference Include="Microsoft.AspNetCore.All" Version="[2.1.3]" />
    <PackageReference Include="Microsoft.AspNetCore.Authentication.Abstractions" Version="[2.1.1.0]" />
    <PackageReference Include="IdentityModel" Version="[3.8.0]" />
  </ItemGroup>
</Project>

public class Startup
{
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddMvc();

        services.AddAuthentication(options =>
            {
                options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = "oidc";
            })
            .AddCookie(options =>
            {
                options.ExpireTimeSpan = TimeSpan.FromMinutes(60);
                options.Cookie.Name = "mvcimplicit";
            })
            .AddOpenIdConnect("oidc", options =>
            {
                options.ClientId = "MvcClient";
                options.Authority = "https://localhost:44356";
                options.RequireHttpsMetadata = false;
                options.GetClaimsFromUserInfoEndpoint = true;
                options.ResponseType = "code token";

                options.Scope.Clear();
                options.Scope.Add("openid");
                options.Scope.Add("sitecore.profile");
                options.Scope.Add("offline_access");
                options.Scope.Add("sitecore.profile.api");

                options.SaveTokens = true;

                options.TokenValidationParameters = new TokenValidationParameters
                {
                    NameClaimType = JwtClaimTypes.Name,
                    RoleClaimType = JwtClaimTypes.Role,
                };
            });
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        app.UseDeveloperExceptionPage();
        app.UseStaticFiles();
        app.UseAuthentication();
        app.UseMvcWithDefaultRoute();
    }
}

[Authorize]
public class Home : Controller
{
    private static readonly HttpClient HttpClient = new HttpClient();
 
    public async Task<IActionResult> Index()
    {
        string accessToken = await HttpContext.GetTokenAsync("access_token");
        string refreshToken = await HttpContext.GetTokenAsync("refresh_token");

        return Content($"Current user: <span id=\"UserIdentityName\">{User.Identity.Name ?? "anonymous"}</span><br/>" +
            $"<div>Access token: {accessToken}</div><br/>" +
            $"<div>Refresh token: {refreshToken}</div><br/>"
            , "text/html");
    }
}

Current user: sitecore\Admin
Access token: eyJhbG......L8A
Refresh token: 4cdf3b4d873a65135553afdf420a47dbc898ba0c1c0ece2407bbbf2bde02a68b

[Route("/callapi")]
    public async Task<IActionResult> CallApi()
    {
        string accessToken = await HttpContext.GetTokenAsync("access_token");

        var request = new HttpRequestMessage(HttpMethod.Get, "http://localhost:55600/identity");
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
        HttpResponseMessage response = await HttpClient.SendAsync(request);

        if (response.StatusCode != HttpStatusCode.OK)
        {
            return Content(response.ToString());
        }

        return Content($"{await response.Content.ReadAsStringAsync()}");
    }

request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);

[
{
"type": "nbf",
"value": "1543572239"
},
{
"type": "exp",
"value": "1543572359"
},
{
"type": "iss",
"value": "https://localhost:44356"
},
{
"type": "aud",
"value": "https://localhost:44356/resources"
},
{
"type": "aud",
"value": "sitecore.profile.api"
},
{
"type": "client_id",
"value": "MvcClient"
},
{
"type": "name",
"value": "sitecore\\Admin"
},
........

[Route("/exchange")]
public async Task<IActionResult> Exchange()
{
    var disco = await DiscoveryClient.GetAsync("https://localhost:44356");
    if (disco.IsError) throw new Exception(disco.Error);

    var tokenClient = new TokenClient(disco.TokenEndpoint, "MvcClient", "secret");
    var rt = await HttpContext.GetTokenAsync("refresh_token");
    var tokenResult = await tokenClient.RequestRefreshTokenAsync(rt);

    if (!tokenResult.IsError)
    {
        var expiresAt = (DateTime.UtcNow + TimeSpan.FromSeconds(tokenResult.ExpiresIn)).ToString("o", CultureInfo.InvariantCulture);

        var authService = HttpContext.RequestServices.GetRequiredService<IAuthenticationService>();
        AuthenticateResult authenticateResult = await authService.AuthenticateAsync(HttpContext, null);
        AuthenticationProperties properties = authenticateResult.Properties;

        properties.UpdateTokenValue(OpenIdConnectParameterNames.RefreshToken, tokenResult.RefreshToken);
        properties.UpdateTokenValue(OpenIdConnectParameterNames.AccessToken, tokenResult.AccessToken);
        properties.UpdateTokenValue(OpenIdConnectParameterNames.ExpiresIn, expiresAt);

        await authService.SignInAsync(HttpContext, null, authenticateResult.Principal, authenticateResult.Properties);

        return Redirect("/");
    }

    return BadRequest();
}