Api 的自定义身份验证 Azure 移动服务

Posted 2023-02-19

【中文标题】Api 的自定义身份验证 Azure 移动服务

【英文标题】：Custom Authentication Azure Mobile Services by Api

【发布时间】：2014-03-12 21:56:14

【问题描述】：

我正在通过 Azure 移动服务上的 API 创建自定义身份验证，并根据以下答案进行选择：

Registering and login users in Azure Mobile Services

然后加入上一个链接的代码来创建认证令牌。

但是当我调用 API 时出现“内部服务器错误”。错误发生在这里：“...results.length...”

    var crypto = require('crypto');
    var iterations = 1000;
    var bytes = 32;
    var aud = "Custom";
    var masterKey = "wkeHEoWUaPJSHsSOcWgmVLOZbIpeeg92";
    var _request;
    var _response;

    exports.post = function(request, response) 
        var user = request.body.userName;
        var pass = request.body.password;
        _request = request;
        _response = response
        validateUserNamePassword(user, pass, function(error, userId, token) 
            if (error) 
                response.send(401,  error: "Unauthorized" );
             else 
                response.send(200,  user: userId, token: token );
            
        );
    

    function validateUserNamePassword(user, pass, funcao)

        var accounts = _request.service.tables.getTable('account');

        accounts
            .where( userid : user )
            .read(
                success: function(results) 
                
                    if (results.length === 0) 
                    
                        _response.send(401,  error: "Unauthorized1" );
                        console.log("Incorrect username or password");
                        _request.respond(401, "Incorrect username or password");
                    
                    else 

                        _response.send(401,  error: "Unauthorized2" );
                        var account = results[0];
                        hash(item.password, account.salt, function(err, h) 
                            var incoming = h;
                            if (slowEquals(incoming, account.password)) 
                                var expiry = new Date().setUTCDate(new Date().getUTCDate() + 30);
                                var userId = aud + ":" + account.id;
                                _request.respond(200, 
                                    userId: userId,
                                    token: zumoJwt(expiry, aud, userId, masterKey) 
                                );
                            
                            else 
                                _request.respond(401, "Incorrect username or password");
                            
                        );
                    
                
            );
    



    function hash(text, salt, callback) 
        crypto.pbkdf2(text, salt, iterations, bytes, function(err, derivedKey)
            if (err)  callback(err); 
            else 
                var h = new Buffer(derivedKey).toString('base64');
                callback(null, h);
            
        );
    

    function slowEquals(a, b) 
        var diff = a.length ^ b.length;
        for (var i = 0; i < a.length && i < b.length; i++) 
            diff |= (a[i] ^ b[i]);
        
        return diff === 0;
    

    function zumoJwt(expiryDate, aud, userId, masterKey) 

        var crypto = require('crypto');

        function base64(input) 
            return new Buffer(input, 'utf8').toString('base64');
        

        function urlFriendly(b64) 
            return b64.replace(/\+/g, '-').replace(/\//g, '_').replace(new RegExp("=", "g"), '');
        

        function signature(input) 
            var key = crypto.createHash('sha256').update(masterKey + "JWTSig").digest('binary');
            var str = crypto.createHmac('sha256', key).update(input).digest('base64');
            return urlFriendly(str);
        

        var s1 = '"alg":"HS256","typ":"JWT","kid":0';
        var j2 = 
            "exp":expiryDate.valueOf() / 1000,
            "iss":"urn:microsoft:windows-azure:zumo",
            "ver":1,
            "aud":aud,
            "uid":userId 
        ;
        var s2 = JSON.stringify(j2);
        var b1 = urlFriendly(base64(s1));
        var b2 = urlFriendly(base64(s2));
        var b3 = signature(b1 + "." + b2);
        return [b1,b2,b3].join(".");
    

我是这样调用的：

        try 
         
            var loginInput = new JObject();
            loginInput.Add("userName", "breno");
            loginInput.Add("password", "test");
            var loginResult = await LoginAuthenticationService.InvokeApiAsync("login", loginInput);
            LoginAuthenticationService.CurrentUser = new MobileServiceUser((string)loginResult["user"]);
            LoginAuthenticationService.CurrentUser.MobileServiceAuthenticationToken = (string)loginResult["token"];
        
        catch (MobileServiceInvalidOperationException e)
        
            var exception = e;
        

【问题讨论】：

如果您放入“console.log(results);”，您会在日志中看到什么在检查长度之前打电话？您确定 request.body.userName 包含用户名吗？

@Chris 我用我调用的方式更新了帖子，我做错了什么？感谢您的帮助！

听起来请求正在发送到您的自定义 API，因为您获得了 500。如果您在帖子开头执行 console.log(request.body)，您会看到什么方法？

@Chris 我把 console.log(request.body) 像你说的那样放在日志上：“无法加载脚本文件'login.js'：SyntaxError: Unexpected token ”

你在validateUserNamePassword/accounts.read/success中的else之后缺少

【参考方案1】：

如果您在 cmets 中看到此错误“无法加载脚本文件 'login.js': SyntaxError: Unexpected token ”，则说明您的脚本存在语法问题。您需要检查您的脚本并找出问题所在。