Microsoft.AspNetCore.Authentication.JwtBearer
System.IdentityModel.Tokens.Jwt
Microsoft.EntityFrameworkCore (如果使用数据库)
Microsoft.EntityFrameworkCore.SqlServer (如果使用SQL Server)

{
  "Jwt": {
    "Key": "YourSuperSecretKeyHereAtLeast32CharactersLong",
    "Issuer": "YourAppIssuer",
    "Audience": "YourAppAudience",
    "ExpireMinutes": 60
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*"
}

public class User
{
    public int Id { get; set; }
    public string Username { get; set; }
    public string Password { get; set; } // 实际应用中应该存储哈希值
    public string Role { get; set; } // 例如 "Admin", "User" 等
}

public class TokenResponse
{
    public string Token { get; set; }
    public DateTime Expiration { get; set; }
    public string Username { get; set; }
    public string Role { get; set; }
}

public class LoginRequest
{
    public string Username { get; set; }
    public string Password { get; set; }
}

using System.IdentityModel.Tokens.Jwt;
using System.Security.Claims;
using System.Text;
using Microsoft.IdentityModel.Tokens;

public class JwtService
{
    private readonly IConfiguration _configuration;

    public JwtService(IConfiguration configuration)
    {
        _configuration = configuration;
    }

    public string GenerateToken(User user)
    {
        var securityKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(_configuration["Jwt:Key"]));
        var credentials = new SigningCredentials(securityKey, SecurityAlgorithms.HmacSha256);

        var claims = new[]
        {
            new Claim(ClaimTypes.NameIdentifier, user.Username),
            new Claim(ClaimTypes.Role, user.Role)
        };

        var token = new JwtSecurityToken(
            _configuration["Jwt:Issuer"],
            _configuration["Jwt:Audience"],
            claims,
            expires: DateTime.Now.AddMinutes(Convert.ToDouble(_configuration["Jwt:ExpireMinutes"])),
            signingCredentials: credentials);

        return new JwtSecurityTokenHandler().WriteToken(token);
    }
}

public class UserService
{
    // 实际应用中应该从数据库获取用户
    private readonly List<User> _users = new List<User>
    {
        new User { Id = 1, Username = "admin", Password = "admin123", Role = "Admin" },
        new User { Id = 2, Username = "user", Password = "user123", Role = "User" }
    };

    public User Authenticate(string username, string password)
    {
        // 实际应用中应该验证密码哈希
        var user = _users.SingleOrDefault(x => x.Username == username && x.Password == password);

        // 如果用户不存在或密码错误返回null
        if (user == null)
            return null;

        // 认证成功返回用户详情 (不包含密码)
        return user;
    }
}

using Microsoft.AspNetCore.Mvc;

[Route("api/[controller]")]
[ApiController]
public class AuthController : ControllerBase
{
    private readonly UserService _userService;
    private readonly JwtService _jwtService;

    public AuthController(UserService userService, JwtService jwtService)
    {
        _userService = userService;
        _jwtService = jwtService;
    }

    [HttpPost("login")]
    public IActionResult Login([FromBody] LoginRequest request)
    {
        var user = _userService.Authenticate(request.Username, request.Password);

        if (user == null)
            return Unauthorized(new { message = "用户名或密码错误" });

        var token = _jwtService.GenerateToken(user);

        return Ok(new TokenResponse
        {
            Token = token,
            Expiration = DateTime.Now.AddMinutes(Convert.ToDouble(_configuration["Jwt:ExpireMinutes"])),
            Username = user.Username,
            Role = user.Role
        });
    }
}

using Microsoft.AspNetCore.Authorization;

[Authorize]
[Route("api/[controller]")]
[ApiController]
public class ProtectedController : ControllerBase
{
    [HttpGet]
    public IActionResult Get()
    {
        // 可以从HttpContext.User获取用户信息
        var username = User.Identity.Name;
        var role = User.FindFirst(ClaimTypes.Role)?.Value;

        return Ok(new { 
            Message = $"你好 {username}, 你的角色是 {role}",
            Data = "这是受保护的数据" 
        });
    }

    [Authorize(Roles = "Admin")]
    [HttpGet("admin")]
    public IActionResult AdminOnly()
    {
        return Ok(new { Message = "只有管理员能看到这条消息" });
    }
}

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.IdentityModel.Tokens;
using System.Text;

var builder = WebApplication.CreateBuilder(args);

// 添加服务到容器
builder.Services.AddControllers();

// 配置JWT认证
builder.Services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidateAudience = true,
        ValidateLifetime = true,
        ValidateIssuerSigningKey = true,
        ValidIssuer = builder.Configuration["Jwt:Issuer"],
        ValidAudience = builder.Configuration["Jwt:Audience"],
        IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(builder.Configuration["Jwt:Key"]))
    };
});

// 注册自定义服务
builder.Services.AddScoped<UserService>();
builder.Services.AddScoped<JwtService>();

var app = builder.Build();

// 配置HTTP请求管道
if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}

app.UseHttpsRedirection();

// 添加认证和授权中间件
app.UseAuthentication();
app.UseAuthorization();

app.MapControllers();

app.Run();

{
    "username": "admin",
    "password": "admin123"
}

{
    "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...",
    "expiration": "2023-05-01T12:00:00",
    "username": "admin",
    "role": "Admin"
}

Authorization: Bearer <your_token>

Authorization: Bearer <your_token>

// 定义一个自定义的认证状态提供器类，继承自AuthenticationStateProvider
public class CustomAuthenticationStateProvider : AuthenticationStateProvider
{
    // 使用ProtectedSessionStorage来安全地存储用户会话信息
    private readonly ProtectedSessionStorage _sessionStorage;
    // 定义一个匿名用户的ClaimsPrincipal对象，表示未认证的用户
    private ClaimsPrincipal _anonymous = new ClaimsPrincipal(new ClaimsIdentity());

    // 构造函数，初始化会话存储对象
    public CustomAuthenticationStateProvider(ProtectedSessionStorage sessionStorage)
    {
        _sessionStorage = sessionStorage;
    }

    // 重写基类的GetAuthenticationStateAsync方法，用于获取当前用户的认证状态
    public override async Task<AuthenticationState> GetAuthenticationStateAsync()
    {
        try
        {
            // 从会话存储中异步获取用户会话信息
            var userSessionStorageResult = await _sessionStorage.GetAsync<UserSession>("UserSession");
            // 检查获取结果是否成功，如果成功则获取用户会话信息，否则为null
            var userSession = userSessionStorageResult.Success ? userSessionStorageResult.Value : null;

            // 如果用户会话信息为null，返回匿名用户的认证状态
            if (userSession == null)
                return await Task.FromResult(new AuthenticationState(_anonymous));

            // 如果用户会话信息存在，创建一个包含用户名和角色的ClaimsPrincipal对象
            var claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity(new List<Claim>
            {
                new Claim(ClaimTypes.Name, userSession.UserName), // 用户名声明
                new Claim(ClaimTypes.Role, userSession.Role) // 角色声明
            }, "CustomAuth")); // 使用自定义认证类型

            // 返回包含用户信息的认证状态
            return await Task.FromResult(new AuthenticationState(claimsPrincipal));
        }
        catch
        {
            // 如果发生异常，返回匿名用户的认证状态
            return await Task.FromResult(new AuthenticationState(_anonymous));
        }
    }

    // 更新认证状态的方法，接收一个用户会话对象作为参数
    public async Task UpdateAuthenticationState(UserSession userSession)
    {
        ClaimsPrincipal claimsPrincipal;

        if (userSession != null)
        {
            // 如果用户会话信息不为null，将其存储到会话存储中
            await _sessionStorage.SetAsync("UserSession", userSession);
            // 创建包含用户名和角色的ClaimsPrincipal对象
            claimsPrincipal = new ClaimsPrincipal(new ClaimsIdentity(new List<Claim>
            {
                new Claim(ClaimTypes.Name, userSession.UserName), // 用户名声明
                new Claim(ClaimTypes.Role, userSession.Role) // 角色声明
            }));
        }
        else
        {
            // 如果用户会话信息为null，删除存储的会话信息
            await _sessionStorage.DeleteAsync("UserSession");
            // 设置为匿名用户
            claimsPrincipal = _anonymous;
        }

        // 通知认证状态已更改，传递新的认证状态
        NotifyAuthenticationStateChanged(Task.FromResult(new AuthenticationState(claimsPrincipal)));
    }
}

public class UserAccount
{
    public string UserName { get; set; }
    public string Password { get; set; }
    public string Role { get; set; }
}

public class UserAccountService
{
    private List<UserAccount> _users;

    public UserAccountService()
    {
        _users = new List<UserAccount>
        {
            new UserAccount{ UserName = "admin", Password = "admin", Role = "Administrator" },
            new UserAccount{ UserName = "user", Password = "user", Role = "User" }
        };
    }

    public UserAccount? GetByUserName(string userName)
    {
        return _users.FirstOrDefault(x => x.UserName == userName);
    }
}

public class UserSession
{
    public string UserName { get; set; }
    public string Role { get; set; }
}

@page "/login"
@using MyBlazorApp.Authentication
@inject UserAccountService userAccountService
@inject IJSRuntime js
@inject AuthenticationStateProvider authStateProvider
@inject NavigationManager navManager

<div class="row">
    <div class="col-lg-4 offset-lg-4 pt-4 pb-4 border">
        <div class="mb-3 text-center">
            <h3>LOGIN</h3>
        </div>
        <div class="mb-3">
            <label>User Name</label>
            <input @bind="model.UserName" class="form-control" placeholder="User Name" />
        </div>
        <div class="mb-3">
            <label>Password</label>
            <input @bind="model.Password" type="password" class="form-control" placeholder="Password" />
        </div>
        <div class="mb-3 d-grid gap-2">
            <button @onclick="Authenticate" class="btn btn-primary">Login</button>
        </div>
    </div>
</div>

@code {
    private class Model
    {
        public string UserName { get; set; } 
        public string Password { get; set; }
    } 
    private Model model = new Model(); 
    private async Task Authenticate()
    {
        var userAccount = userAccountService.GetByUserName(model.UserName); 
        if (userAccount == null || userAccount.Password != model.Password)
        {
            await js.InvokeVoidAsync("alert", "Invalid User Name or Password");
            return;
        } 
        var customAuthStateProvider = (CustomAuthenticationStateProvider)authStateProvider;
        await customAuthStateProvider.UpdateAuthenticationState(new UserSession
            {
                UserName = userAccount.UserName,
                Role = userAccount.Role
            });
        navManager.NavigateTo("/", true);
    }
} 

@inject AuthenticationStateProvider AuthStateProvider
@inject NavigationManager Navigation

<p>用户未授权，正在重定向到登录页面...</p>

@code {
    protected override async Task OnAfterRenderAsync(bool firstRender)
    {
        if (firstRender)
        {
            var authState = await AuthStateProvider.GetAuthenticationStateAsync();
            var user = authState.User; 
            if (user.Identity == null || !user.Identity.IsAuthenticated)
            {
                // 用户未认证，重定向到登录页面
                Navigation.NavigateTo("/login", true);
            }
        } 
    }
}

@using MyBlazorApp.Authentication
@inherits LayoutComponentBase
@inject AuthenticationStateProvider authStateProvider
@inject NavigationManager navManager

<PageTitle>MyBlazorApp</PageTitle>

<div class="page">
    <div class="sidebar">
        <NavMenu />
    </div>

    <main>
        <div class="top-row px-4">
            <a href="https://docs.microsoft.com/aspnet/" target="_blank">About</a>
            <AuthorizeView>
                <Authorized>
                    <a @onclick="Logout" href="javascript:void(0)">Logout</a>
                </Authorized>
                <NotAuthorized>
                    <a href="/login">Login</a>
                </NotAuthorized>
            </AuthorizeView>
        </div>

        <article class="content px-4">
            @Body
        </article>
    </main>
</div>

@code{
    private async Task Logout()
    {
        var customAuthStateProvider = (CustomAuthenticationStateProvider)authStateProvider;
        await customAuthStateProvider.UpdateAuthenticationState(null);
        navManager.NavigateTo("/", true);
    }
}

<CascadingAuthenticationState>
    <Router AppAssembly="@typeof(App).Assembly">
        <Found Context="routeData">
            <AuthorizeRouteView RouteData="@routeData" DefaultLayout="@typeof(MainLayout)">
                <NotAuthorized>
                    <RedirectToLogin />
                </NotAuthorized>
                <Authorizing>
                    You are getting authorized  
                </Authorizing>
            </AuthorizeRouteView>
            <FocusOnNavigate RouteData="@routeData" Selector="h1" />
        </Found>
        <NotFound>
            <PageTitle>Not found</PageTitle>
            <LayoutView Layout="@typeof(MainLayout)">
                <p role="alert">Sorry, there's nothing at this address.</p>
            </LayoutView>
        </NotFound>
    </Router>
</CascadingAuthenticationState>

var builder = WebApplication.CreateBuilder(args); 
builder.Services.AddAuthenticationCore();
builder.Services.AddRazorPages();
builder.Services.AddServerSideBlazor();
builder.Services.AddScoped<ProtectedSessionStorage>();
builder.Services.AddScoped<AuthenticationStateProvider, CustomAuthenticationStateProvider>();
builder.Services.AddSingleton<UserAccountService>();
builder.Services.AddSingleton<WeatherForecastService>();

var app = builder.Build(); 
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
}  
app.UseStaticFiles(); 
app.UseRouting(); 
app.MapBlazorHub();
app.MapFallbackToPage("/_Host"); 
app.Run();

@page "/counter"
@attribute [Authorize(Roles = "Administrator,User")]

<AuthorizeView Roles="Administrator,User">
    <Authorized>
        <div class="nav-item px-3">
            <NavLink class="nav-link" href="counter">
                <span class="oi oi-plus" aria-hidden="true"></span> Counter
            </NavLink>
        </div>
    </Authorized>
</AuthorizeView>
<AuthorizeView Roles="Administrator">
    <Authorized>
        <div class="nav-item px-3">
            <NavLink class="nav-link" href="fetchdata">
                <span class="oi oi-list-rich" aria-hidden="true"></span> Fetch data
            </NavLink>
        </div>
    </Authorized>
</AuthorizeView>

<ItemGroup>
  <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="6.0.31" />
  <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />
</ItemGroup>

 builder.Services.AddAuthentication(options =>
 {
     options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
     options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
 })
.AddJwtBearer(options =>
{
    options.Authority = "https://localhost:7097/";
    options.Audience = "resource_api_1";
    options.RequireHttpsMetadata = false; // 仅限开发环境
});

 builder.Services.AddAuthentication(options =>
 {
     options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
     options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
 })
.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new TokenValidationParameters
    {
        // 配置解密密钥
        TokenDecryptionKey = new X509SecurityKey(new X509Certificate2(
             builder.Configuration.GetValue<string>("Certificate:Path"),
             builder.Configuration.GetValue<string>("Certificate:PassWord"))
         ),
        // 配置证书的公钥
        IssuerSigningKey = new X509SecurityKey(new X509Certificate2(
            builder.Configuration.GetValue<string>("Certificate:Path"), 
            builder.Configuration.GetValue<string>("Certificate:PassWord"))
        ),
        // 验证令牌发行者
        ValidateIssuer = true,
        ValidIssuer = "https://localhost:7097/",
        // 验证令牌受众
        ValidateAudience = true,
        ValidAudience = "resource_api_1",
        // 验证令牌签名
        ValidateIssuerSigningKey = true,
        // 验证令牌有效期
        ValidateLifetime = true,
        // 如果需要时钟偏差，可以设置ClockSkew
        // ClockSkew = TimeSpan.FromMinutes(5)
    };
    // 是否要求HTTPS
    options.RequireHttpsMetadata = false; // 仅限开发环境
});

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("Admin", policy =>
    {
        policy.RequireRole("Admin");
    });
    options.AddPolicy("User", policy =>
    {
        policy.RequireRole("User");
    });
});

app.UseSwagger();
app.UseSwaggerUI();

app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();

app.UseEndpoints(endpoints =>
{
    endpoints.MapControllers();
});

[ApiController]
[Route("[controller]")]
public class WeatherForecastController : ControllerBase
{
    private static readonly string[] Summaries = new[]
    {
        "Freezing", "Bracing", "Chilly", "Cool", "Mild", "Warm", "Balmy", "Hot", "Sweltering", "Scorching"
    };

    private readonly ILogger<WeatherForecastController> _logger;

    public WeatherForecastController(ILogger<WeatherForecastController> logger)
    {
        _logger = logger;
    }

    //无需授权
    [HttpGet("GetWeatherForecastV1")]
    public IEnumerable<WeatherForecast> GetV1()
    {
        return Enumerable.Range(1, 5).Select(index => new WeatherForecast
        {
            Date = DateTime.Now.AddDays(index),
            TemperatureC = Random.Shared.Next(-20, 55),
            Summary = Summaries[Random.Shared.Next(Summaries.Length)]
        })
        .ToArray();
    }

    //通用授权
    [Authorize]
    [HttpGet("GetWeatherForecastV2")]
    public IEnumerable<WeatherForecast> GetV2()
    {
        return Enumerable.Range(1, 5).Select(index => new WeatherForecast
        {
            Date = DateTime.Now.AddDays(index),
            TemperatureC = Random.Shared.Next(-20, 55),
            Summary = Summaries[Random.Shared.Next(Summaries.Length)]
        })
        .ToArray();
    }

    //特定角色授权
    [Authorize("Admin")]
    [HttpGet("GetWeatherForecastV3")]
    public IEnumerable<WeatherForecast> GetV3()
    {
        return Enumerable.Range(1, 5).Select(index => new WeatherForecast
        {
            Date = DateTime.Now.AddDays(index),
            TemperatureC = Random.Shared.Next(-20, 55),
            Summary = Summaries[Random.Shared.Next(Summaries.Length)]
        })
        .ToArray();
    }

    //特定角色授权
    [Authorize("User")]
    [HttpGet("GetWeatherForecastV4")]
    public IEnumerable<WeatherForecast> GetV4()
    {
        return Enumerable.Range(1, 5).Select(index => new WeatherForecast
        {
            Date = DateTime.Now.AddDays(index),
            TemperatureC = Random.Shared.Next(-20, 55),
            Summary = Summaries[Random.Shared.Next(Summaries.Length)]
        })
        .ToArray();
    }

}

{
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }, 
  },  
  "Certificate": {
    "Path": "Certificate/SelfSignedCertificate.pfx",
    "PassWord": "12345678" 
  },
  "AllowedHosts": "*"
}

 <ItemGroup>
   <PackageReference Include="Microsoft.AspNetCore.Authentication.JwtBearer" Version="6.0.31" />
   <PackageReference Include="Microsoft.AspNetCore.Identity.EntityFrameworkCore" Version="6.0.31" />
   <PackageReference Include="Microsoft.EntityFrameworkCore.InMemory" Version="6.0.31" />
   <PackageReference Include="Microsoft.EntityFrameworkCore.Sqlite" Version="6.0.31" />
   <PackageReference Include="Microsoft.IdentityModel.Protocols.OpenIdConnect" Version="7.6.0" />
   <PackageReference Include="OpenIddict.EntityFrameworkCore" Version="5.6.0" />
   <PackageReference Include="OpenIddict.Server.AspNetCore" Version="5.6.0" />
   <PackageReference Include="OpenIddict.Validation.AspNetCore" Version="5.6.0" />
   <PackageReference Include="Swashbuckle.AspNetCore" Version="6.6.2" />
   <PackageReference Include="System.Linq.Async" Version="6.0.1" />
 </ItemGroup>

public class ApplicationUser : IdentityUser
{
}

 public class ApplicationRole : IdentityRole
 {
     public ApplicationRole() : base() { }
     public ApplicationRole(string roleName) : base(roleName)
     {
     }
 }

//string：指定了用户ID和角色ID的数据类型。在这个例子中，ID被指定为字符串类型。
public class ApplicationDbContext : IdentityDbContext<ApplicationUser, ApplicationRole, string>
{
    public DbSet<ApplicationRole>? ApplicationRoles { get; set; }
    public ApplicationDbContext(DbContextOptions<ApplicationDbContext> options)
        : base(options)
    {
    }

    protected override void OnModelCreating(ModelBuilder builder)
    {
        base.OnModelCreating(builder);

        // 配置OpenIddict实体
        builder.UseOpenIddict();
    }
}

public static class OpenIddictExtension
{
    public static IServiceCollection AddOpenIddictServices(this IServiceCollection services, IConfiguration Configuration)
    {
        services.AddDbContext<ApplicationDbContext>(options =>
        {
            // 配置数据库提供程序
            options.UseSqlite(Configuration.GetConnectionString("DefaultConnection"));
            options.UseOpenIddict();
        });

        // 添加ASP.NET Core Identity配置
        services.AddIdentity<ApplicationUser, ApplicationRole>()
            .AddEntityFrameworkStores<ApplicationDbContext>()
            .AddDefaultTokenProviders();

        // 配置OpenIddict
        services.AddOpenIddict()
            // 配置 OpenIddict 核心组件
            .AddCore(options =>
            {
                options.UseEntityFrameworkCore()
                       .UseDbContext<ApplicationDbContext>();
            })
            // 配置 OpenIddict 服务器
            .AddServer(options =>
            {
                #region 模式
                //1.授权码模式
                options.AllowAuthorizationCodeFlow();
                //2. 简化模式
                //     适用于无法进行客户端认证的客户端，如纯前端应用。由于安全性较低，这种模式已不再推荐使用。
                //3. 密码模式
                options.AllowPasswordFlow();
                //4. 客户端凭据模式
                //options.AllowClientCredentialsFlow();
                #endregion
                
                #region 证书
                // 签名证书, 仅限开发环境使用
                //options.AddDevelopmentSigningCertificate();
                //options.AddDevelopmentEncryptionCertificate();

                // 使用自己的证书进行签名
                options.AddSigningCertificate(new X509Certificate2(Configuration.GetValue<string>("Certificate:Path"), Configuration.GetValue<string>("Certificate:PassWord")));
                options.AddEncryptionCertificate(new X509Certificate2(Configuration.GetValue<string>("Certificate:Path"), Configuration.GetValue<string>("Certificate:PassWord")));

                // 禁用 访问令牌加密
                //options.DisableAccessTokenEncryption();
                #endregion
                
                #region 其他必要的配置
                //token过期时间
                options.SetAccessTokenLifetime(TimeSpan.FromHours(6));

                // 设置令牌和授权端点
                options.SetTokenEndpointUris("/connect/token")
                       .SetAuthorizationEndpointUris("/connect/authorize")
                       .SetUserinfoEndpointUris("/connect/userinfo")
                       ;

                // 重要：配置与 ASP.NET Core 的集成
                options.UseAspNetCore()
                       .EnableAuthorizationEndpointPassthrough()//这个调用配置 OpenIddict 对于授权请求不要自己处理，而是直接传递给 ASP.NET Core。这意味着你需要在你的 ASP.NET Core 应用中自己实现授权端点的逻辑。
                       .EnableTokenEndpointPassthrough()//允许 OpenIddict 将令牌请求直接传递给 ASP.NET Core，你需要自己处理这些请求。
                       //.EnableLogoutEndpointPassthrough()//启用此选项可以让 OpenIddict 将注销请求直接传递给 ASP.NET Core，需要你自己实现注销逻辑。
                       ;
                #endregion
            })
            .AddValidation(options =>
            {
                // 配置受众验证
                options.AddAudiences("api");
            });
        return services;
    }

    //自动创建表
    public static IApplicationBuilder UseOpenIddict(this IApplicationBuilder app)
    {
        using (IServiceScope serviceScope = app.ApplicationServices.CreateScope())
        {
            //自动创建表
            var context = serviceScope.ServiceProvider.GetRequiredService<ApplicationDbContext>();

            // 先删除数据库
            context.Database.EnsureDeleted();

            // 再重新创建数据库
            context.Database.EnsureCreated();

            // 调用种子数据方法
            SeedEssentialsAsync(serviceScope.ServiceProvider).Wait();

            // 调用OpenIddict种子数据方法
            SeedOpenIddictAsync(serviceScope.ServiceProvider).Wait();
        }
        return app;
    }

    // 生成种子数据
    private static async Task SeedEssentialsAsync(IServiceProvider serviceProvider)
    {
        // 获取数据库上下文
        var context = serviceProvider.GetRequiredService<ApplicationDbContext>();
        // 获取用户和角色管理器
        var userManager = serviceProvider.GetRequiredService<UserManager<ApplicationUser>>();
        var roleManager = serviceProvider.GetRequiredService<RoleManager<ApplicationRole>>();

        // 添加角色种子数据
        if (!await roleManager.RoleExistsAsync("Admin"))
        {
            await roleManager.CreateAsync(new ApplicationRole { Name = "Admin" });
        }

        // 添加用户种子数据
        if (await userManager.FindByNameAsync("admin") == null)
        {
            var user = new ApplicationUser { UserName = "admin", Email = "123@qq.com" };
            await userManager.CreateAsync(user, "QWE@qwe123");
            await userManager.AddToRoleAsync(user, "Admin");
        }
        
    }

    // 生成种子api
    public static async Task SeedOpenIddictAsync(IServiceProvider serviceProvider)
    {
        // 获取OpenIddict的应用、作用域和授权管理器
        var applicationManager = serviceProvider.GetRequiredService<IOpenIddictApplicationManager>();
        var scopeManager = serviceProvider.GetRequiredService<IOpenIddictScopeManager>();


        // 检查并添加作用域
        if (await scopeManager.FindByNameAsync("api") == null)
        {
            await scopeManager.CreateAsync(new OpenIddictScopeDescriptor
            {
                Name = "api",
                DisplayName = "Access to API",
                Resources = { "resource_api_1" },
            });
        }

        #region 检查并添加API资源 (只需要token就可访问的客户端)
        if (await applicationManager.FindByClientIdAsync("clientid") == null)
        {
            await applicationManager.CreateAsync(new OpenIddictApplicationDescriptor
            {
                ClientId = "clientid",
                DisplayName = "Demo.Resources.WebApi",
                Permissions =
                {
                    OpenIddictConstants.Permissions.Endpoints.Token,
                    OpenIddictConstants.Permissions.GrantTypes.Password,
                    OpenIddictConstants.Permissions.GrantTypes.RefreshToken,

                    // 这里添加允许的作用域
                    OpenIddictConstants.Permissions.Prefixes.Scope + "api",
                    // 添加offline_access作用域
                    OpenIddictConstants.Permissions.Prefixes.Scope + OpenIddictConstants.Scopes.OfflineAccess, 
                },

            });
        }
        #endregion
    }

}

builder.Services.AddOpenIddictServices(builder.Configuration);

app.UseHttpsRedirection();

//种子数据
app.UseOpenIddict();

//下面是需要的,以便于访问端点
app.UseRouting();
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
    endpoints.MapControllers();
});

public class LoginDto
{
    public string username { get; set; } = "admin";
    public string password { get; set; } = "123546";
    public string grant_type { get; set; } = "password";
    public string client_id { get; set; } = "clientid";
    public string scope { get; set; } = "api";
}

// 禁用 访问令牌加密
options.DisableAccessTokenEncryption();

[ApiController]
[Route("connect")]
public class TokenController : ControllerBase
{
    private readonly SignInManager<ApplicationUser> _signInManager;
    private readonly UserManager<ApplicationUser> _userManager;
    private readonly IOpenIddictScopeManager _scopeManager;
    private readonly ApplicationDbContext _context;
    public TokenController( SignInManager<ApplicationUser> signInManager,
        UserManager<ApplicationUser> userManager,
        IOpenIddictScopeManager scopeManager,
        ApplicationDbContext context)
    {
        _signInManager = signInManager;
        _userManager = userManager;
        _scopeManager = scopeManager;
        _context = context;
    }

    // 资源webapi未启用JWT加密,只能手动从数据库中获取 Resources https://documentation.openiddict.com/configuration/claim-destinations.html
    [Consumes("application/x-www-form-urlencoded")]
    [HttpPost("token1")]
    public async Task<IActionResult> GetToken_NoEncryption([FromForm] LoginDto loginDto)
    {
        var user = await _userManager.FindByNameAsync(loginDto.username);
        if (user == null || !await _userManager.CheckPasswordAsync(user, loginDto.password))
        {
            return BadRequest(new { message = "Username or password is incorrect." });
        }

        // 创建用户主体
        var principal = await _signInManager.CreateUserPrincipalAsync(user);

        // 确保添加了 sub 声明
        var identity = principal.Identity as ClaimsIdentity;
        identity.AddClaim(new Claim(OpenIddictConstants.Claims.Subject, user.Id));

        var ticket = new AuthenticationTicket(principal,
            new AuthenticationProperties(),
            OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);

        // 设置请求的作用域
        var requestedScopes = new[] { OpenIddictConstants.Scopes.OfflineAccess };
        requestedScopes = requestedScopes.Concat(loginDto.scope.Split(new[] { ' ' }, StringSplitOptions.RemoveEmptyEntries)).Distinct().ToArray();

        ticket.Principal.SetScopes(requestedScopes);

        // 根据请求的作用域动态设置资源（aud）
        foreach (var scope in requestedScopes)
        {
            var resources = await GetResourcesForScopeAsync(scope);
            foreach (var resource in resources)
            {
                // 这里我们直接将资源作为audience添加到声明中
                identity.AddClaim(new Claim(JwtRegisteredClaimNames.Aud, resource, ClaimValueTypes.String, OpenIddictServerAspNetCoreDefaults.AuthenticationScheme));
            }
        }

        // 为所有声明设置目的地为访问令牌
        foreach (var claim in identity.Claims)
        {
            // 防止ASP.NET Core Identity的角色和策略声明被添加到访问令牌中
            if (claim.Type != ClaimTypes.Name && claim.Type != ClaimTypes.NameIdentifier)
            {
                claim.SetDestinations(OpenIddictConstants.Destinations.AccessToken);
            }
        }

        return SignIn(ticket.Principal, ticket.Properties, ticket.AuthenticationScheme);
    }

    private async Task<IEnumerable<string>> GetResourcesForScopeAsync(string scope)
    {
        // 从数据库查询与指定作用域相关联的资源列表
        var resources = await _context.Set<OpenIddictEntityFrameworkCoreScope>()
            .Where(s => s.Name == scope)
            .Select(s => s.Resources)
            .FirstOrDefaultAsync();

        if (!string.IsNullOrEmpty(resources))
        {
            var resourceList = System.Text.Json.JsonSerializer.Deserialize<List<string>>(resources);
            return resourceList ?? Enumerable.Empty<string>();
        }

        return Enumerable.Empty<string>();
    }
}

[ApiController]
[Route("connect")]
public class TokenController : ControllerBase
{
    private readonly SignInManager<ApplicationUser> _signInManager;
    private readonly UserManager<ApplicationUser> _userManager;
    private readonly IOpenIddictScopeManager _scopeManager;
    private readonly ApplicationDbContext _context;
    public TokenController( SignInManager<ApplicationUser> signInManager,
        UserManager<ApplicationUser> userManager,
        IOpenIddictScopeManager scopeManager,
        ApplicationDbContext context)
    {
        _signInManager = signInManager;
        _userManager = userManager;
        _scopeManager = scopeManager;
        _context = context;
    }
    
    [Consumes("application/x-www-form-urlencoded")]
    [HttpPost("token")]
    public async Task<IActionResult> GetToken_Encryption([FromForm] LoginDto model)
    {
        var user = await _userManager.FindByNameAsync(model.username);
        if (user == null || !await _userManager.CheckPasswordAsync(user, model.password))
        {
            return BadRequest(new { message = "Username or password is incorrect." });
        }

        // 创建用户主体
        var principal = await _signInManager.CreateUserPrincipalAsync(user);

        // 确保添加了 sub 声明
        var identity = principal.Identity as ClaimsIdentity;
        identity.AddClaim(new Claim(OpenIddictConstants.Claims.Subject, user.Id));

        // 设置作用域
        principal.SetScopes(new[]
        {
            OpenIddictConstants.Scopes.OpenId,
            OpenIddictConstants.Scopes.Profile,
            OpenIddictConstants.Scopes.OfflineAccess,
            "api"
        });

        // 设置资源
        principal.SetResources(await _scopeManager.ListResourcesAsync(principal.GetScopes()).ToListAsync());

        // 设置声明目的地
        principal.SetDestinations(claim =>
        {
            switch (claim.Type)
            {
                case Claims.Name when claim.Subject.HasScope(OpenIddictConstants.Scopes.Profile):
                    return new[] { OpenIddictConstants.Destinations.AccessToken, OpenIddictConstants.Destinations.IdentityToken };

                case "secret_value":
                    return Array.Empty<string>();

                default:
                    return new[] { OpenIddictConstants.Destinations.AccessToken };
            }
        });

        var ticket = new AuthenticationTicket(principal,
            new AuthenticationProperties(),
            OpenIddictServerAspNetCoreDefaults.AuthenticationScheme);

        return SignIn(ticket.Principal, ticket.Properties, ticket.AuthenticationScheme);
    }
}

curl -X 'POST' \
  'https://localhost:7097/connect/token' \
  -H 'accept: */*' \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  -d 'username=admin&password=QWE%40qwe123&grant_type=password&client_id=clientid&scope=api'

{
  "access_token": "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJraWQiOiJEODFDODgyQ0RDNTg3RkQ5RjlCQjNGQzg3OEY4RDg0MEZCMTlBMjQ4IiwidHlwIjoiYXQrand0IiwiY3R5IjoiSldUIn0.CijmUD9Wxosv1aaQjgEosG6GliK1s9lgBdZVl60Nx4F4W9HQ_8Wr1P8klQVS-NG9k9P7hcyjSJY64CXnpN57ZvTXdc2F7dKvYeNsKgaQRn7yGPwlcOUOgks02BuizIsw9Pl6_lDVHwJcecqcpRh3ec2MWB-aB21N0UA7fabFi4YHV7pzr_Mr0A8Krdxu8Xe0UC8f51Tk5tawAQA3rqwXm3ZXpDN8EzJxWkeiPmVpYEBKuoI6aouK4GgprMYJqL3-DBPbt5cT8-mPGlEfyQRhTrq5uxd-y6arbVXRbuJIhmTZIixdAC-gab8zSplwcc-IfTEUKHEk66YV7i1AzveQqQ._TEuhLFw7LInL7u6twY8Zg.FOaBEVwRNp3JKkc4rwSu7Ggm_vLkXYYQmWrY6RFBeE5SFDwOxxdcIdx-vBdwmBrIvCBVlKV5DEEhyjuI4p2XHANNn7ObIpvJnKYwZJm5_dM4AGE1-ZdYgL8o0v0O0ZnufU07zav9zcOtsXcujBV_sdYEEdDvW2-x0xc4so_z3dh4Z4PwsvYf2TiTqKPqjKF9lzcjjEzIGEMIDM-lEP7hLwd1Z200-Tqs8PeaFy1yXdx0jN5cOzCO_ehSTKo4IAxpuw5GUMJjjqQI25F5JaHEhctHbLQpc90ghrDYqGTeEDuVC-hgLz58b-ctw-iINtBJKFFQSCjyIFje4nz7dq2Ek_9pjPnC7RVk6MTg7utGEaI3altvUUJHnPznkBaFazOFZbWrVDC0Uy097WrNbk-GS1rij3YjvWQ5780BtpF8O7MDE_gnJRI_fUNQHO9AKU9Pi-GCIT8DRQmeNEBzGXcSh-NdF6rmHEJQuUq57Awan-aYBmVtDZRSm_zb9PbmccqZKcf9y-ahvlEXwnWU6QLU_herm3mDEmknexLw8X8y6M1pCPhqGaUE-flVk3aIU6mmJ2o9wvG_mQsxF7BAPA2AUVfiBCsCgK2rnAfuo-PU4A1qres6GXFU0TXkWvyZkLZ3O0cPW21nQLHwUAH1rfCMwMIg5vptUOts2CpcqKLNcFm3U5lbMGB-o15v7VDW_ioF88VKDzLi0kU_k89GVmmD4tzlhxEqu9fOhOHU49aBR7b7zV0eUlfI0ubNRZuox6ODPYLKor_7zn-JhPz4b_D32RhdyvTiXNzMotdahqjCWAkUKOWhRXQbZIbi0Bo3VnlQsg3HhIToZpLsfQOByynJpY4knH_A2k5BfOIw0CliVGkkM_QETJT5051lyfzixeV2_-bEHRj9MzHJqSlyK5ldZZDtcP8T456da2kp9TAc6s_wUYeiha7NbtbGOutFHdhGxHxiwja0QkVYAtGx3Gq3KXxrTeWb_VPSJz27RQk_hCH2RJQdfdR_UzEvKe-M4ncbDNPjCeJRHV7WGTeQDKYSnSqg6ZYVsXL5OD1QQxx7BYFXh681XAXOwpLAWu4OOa9brF2PTGC86DdyzmgCTsG8teju3N5gOepngEjgBz6XtV7zPUjBoCH6uegExgLgbjFZqbJcaRpzcb5RYGHis0mpdT9VzrExVANNaRqYTBfNdzynTsZmszkrB0SQKp4sPyg_NDupeNl9SGZRsPW8WhvItxAWE5g4fkuU0vVdsO6BxMG-qN473wwOPJVqS0kP0rLp0CLg3adPZtuSja0SItoXhBXiNf94ehDS4n90PrjL93L7huVZ4_NaMHOGk7CJ73H9hLRMKhRdcqFXVWDbxoseo-fBXLqLXMvNmk9_FSZMzaOKvMZmZddMk8nCAxwlAoHntSw_yU7-JUoNszk1qZofHYBqCJDwQFcTEMBPd18csYhXQiumRQ0HMQInVsVFBPNqPeR3sMpqPXW2xxfcbLnwBqTpbQrkvLDwFpfXcZ14RPnyTb-Ho5Pg-DR9p06cvfYq77SENayRaDhgMehhKlF0MIPycw2ob0e6S0cAxMxRzOgvMzm7wR0D4Y-RA9ZrqR8_s2tQPLJM8mdsTGRemsTsYkhwljw8ye-8zIHA3YeMahhCBUgHvDAW8QXDZPa5myxWnWC7gCL3q_fv3QAgFbgFGcWjQqg1dvxgQwHap14BjvWpa_RL3CmP7zr1fNoZdUi8thrSYOc6RG2zd1_wB-SuD_Sv4sofzOND0FG8r4ziq1V-IfS8Irio-HaOUdUYjye01Y0OhlgZDHesL0ZszWO1jReIQF76S9JtrVlAJTZTnWGEquJ7x7loZplD1tuxnvnBE5ZhBnuJEfLlWj8TXeAUQmDzYYIfKyw1jA9fAL1W7s_fQpJtYmrgEbY-kdToK-HOnxKJfJIZBoL7Vf-EQdWGDsDYL0EbULrSGWPmlCEb9dEZxPzffbRzY2Fi1O7DDp46C7fR33U7V5mkHycLWOvoG6_WQFTiA3j8HY_oIGLHE8ikDETGbtEMo0UBX5Cb14HQ.FIagVnKoIoUCO0qWtZf7mYGLOACWbSG2O0OcvR_xF5E",
  "token_type": "Bearer",
  "expires_in": 21599,
  "scope": "openid profile offline_access api",
  "id_token": "eyJhbGciOiJSUzI1NiIsImtpZCI6IkQ4MUM4ODJDREM1ODdGRDlGOUJCM0ZDODc4RjhEODQwRkIxOUEyNDgiLCJ4NXQiOiIyQnlJTE54WWY5bjV1el9JZVBqWVFQc1pva2ciLCJ0eXAiOiJKV1QifQ.eyJpc3MiOiJodHRwczovL2xvY2FsaG9zdDo3MDk3LyIsImV4cCI6MTcxNzQ5NDM2OCwiaWF0IjoxNzE3NDkzMTY4LCJhdWQiOiJjbGllbnRpZCIsInN1YiI6IjQ0ZTE3ZDE2LTgxOGUtNDJlMi04OTllLTAxODIzZWVhZmE0YiIsIm9pX2F1X2lkIjoiOGYwZDliNDEtMTQ3Ny00Zjk0LWIxOGUtOTZhNTdiNDgzYWE3IiwiYXpwIjoiY2xpZW50aWQiLCJhdF9oYXNoIjoiNy14amd0Y3dHM1NwbUhBYXhkNzFXQSIsIm9pX3Rrbl9pZCI6IjU5MjhmNjJkLTE2YzItNGUwNS1hODc2LTM3MDY2NjZlZTIxMSJ9.rH1MATGfGmy-k9l_W4TNIjpbKjkcTON2j_oGWQhaKpCvhP723FZ8b7ahBkX8ITByBadV_WEXb8y04NXNDAELh0e15S5tllKkUNMSkrgcQK3l5bh5LXb9nuKUtO2HrQfg3Wkavgu2caK7nzUj6fmh0vahnBOdoTXny1xFYLJP79UAdLKwNQ1Vpnvk6RttEG69SbAySAelE0XajocshmuAK2TVwVOBBNB4V16evjzD-alzDmr312r8RlCnul6AzSkpMf_TZ4-aYbhpdt6CZA8wqvWT-SioLlGB89PEN6-LKrSD0NtKN3wWMUTv-fVyXtFpJyd-SIGv9hYUHM1qgttTAA",
  "refresh_token": "eyJhbGciOiJSU0EtT0FFUCIsImVuYyI6IkEyNTZDQkMtSFM1MTIiLCJraWQiOiJEODFDODgyQ0RDNTg3RkQ5RjlCQjNGQzg3OEY4RDg0MEZCMTlBMjQ4IiwidHlwIjoib2lfcmVmdCtqd3QiLCJjdHkiOiJKV1QifQ.EUXrtSTDQ3NstYhpAYaugHs73gW2LZeuqRwGftuxVScLMm6u8VL1MSkXgaOYNclyPeeaaopfja8tIv6-ms9K2Kj-8M9EcOfPia_-daLWJM8fgH9_mOb_5AY_khLRWSnT5vV3sTvokDY6glSd7Egqlvlkrt-lMRRBxKJa9zh8Fswp68IYImtjnlHwMqC_BXkHPKMTVNGsRBAGVBd1p_FhPQjes_p9tR_jcf1s3u3ekQhaYo9-qg-WzfImDXbsLoW9o70zgT_I0k605NhxBxiEf_3kLHYogWsg5pdicZy8yPUwuOhtNu1sY-2QWPzmxq7lOWGteclThjGlh4ptzubeAw.vmNtqW7nQ95FuTHrkQnGSQ.jFiSeMwY8GxZjugGo_69H-S63F2zj2iwdvzQd_5MEZZudvRpF3OHV9n3tVcA_FKSXmo3H7Tl7jOdLE6oMWL5EjCM5ik0MU7hBN4IB-HOCJhEBC7VTmEF68HdqC7xbJX55rPNK2F4fna1cFAc0wr0w5eGaIccITpSoeqOPh2rmapjQw53lb_EY15D2XgRHiXX7qiw6-fBUBFjqI3J3eOcNWQC2Jg1JsN1okhvD5AVSRHjhzb4AwUXGTrV2xanm_p0YfQMohaObMQsOCZLazLCCWIYyA9LFJnyy6kV8pOpoyMh2CRiCB0ahBWf9cKYqpBbPMlls8g6_KUA_6TGgXwxxGMYL7RCu_B4NZtne6wnMCSAztO8Fu9swTREJOhygiAlW-eTTICuX3dyNC7QSjCk4ISdZvGXaK5UeBxMvVD85_QikAO2jqDxFk2O_xQEvHAZ9mXRiPtrcGedvUipo49q30abMCKW572lucahUTXQF_v_Y-OQ7Y0OVZr6KtkOpu71Ot-_8OBpKxMscGx3RqugQITLgShjLIrkCwSxykoCADKtu-ySIadjMViYW0sl4Xfdk4a-IFWeYfCYfCbXFzBxfNafuK9kRWZT2eo5poT-o17wmhI747s75FY6E7c0p9HFDbcxZ_U3KYzMlr6WrexVJqqb4qHO9CNPwxGlhP0WM3F0_JF44Drdcm2nDzyHurE2PmhagTaAAt-0qb2vz0jwdEZDj7vY93pShMoIQW3W_e_2NDAnBLMcZgANs5Oh8pHEbsaU7TgghTwqMgwnyS5uYqcEyqfRPCpoHXGbvrmxeiN1ODlsw0To7qk9NfAOPAV7z_CP7MCEHkpTJgI9cIYt9PEK_fxN2Bq8D0tyiah3Sc2TFVqvH5DbcgdaIG5wpV_S6pc55q-iU7lSgBzJziQiURHEJj1v8j_hP0n4HK9IADw6umEqNsz2KlpKWGMubDoh1ZwibNiweqwzH7C09kHMhlHifgjP7oLe5LGLagZyYD6BV9Z0io5vgl7imZrUiIxhA3vWZrrrZGi9j9KQQrkDuZxNuiUSW66-o13mJ_Ki3Z5kwA8gBssL27oAitL3l_rlhOhjcsACIU9AdA2eVu5xeijf_a4QqQEx8l2sbAzgNLJr4mOaYuUFQlPjFUaw30LXhf9VEa8ks8AVMhjRVtrfEekArrCBvUIrza5fzj-ofICtLoPRbd7K3fxT2NVB57zLra4YYchM5Cqgdqg26ETOpvUDQM8_G55Bw-zYWRQe6JmSpjj8_UBE1EE9L7pWy_6xFxk1Hci1G1dITdthPFlanQnzpX71fHLI69C_I71zrr_On5XIyjZHeGB7Fo2GPV_uurKuB_mmjMKuofpJ-fxuNPbDNUVO2qNg_mfC_aJIP8gCvetsrV-Zpv090hBewMnBrg6nh1rfRatFxKgCv7ZF-SWAb7MqHM4ngoZBoUdVy1gLFfQmmMPWsEB3P4A5tnOEornWAeEsYE92HAtD6AY0W6nSyAIdfHQURq_5DgVxtjqmrBDkYhc0DZmdcSSB4CuCQN7EQKrADAyw48jlldbKMZEDnhcUW855Hru37nf53z5JCp13b8extVI9Fb2ZNkxWhm3vvqOrxPjHGlONO7MesGzxYbmK76XtJzOcDStDydYR9nX7V4OR6zbgjTN517FSxcD9VMOc1r-DYo28K5a9sDOvoyasHIsvKDZlx5j472Vtm1q9JvcG-j1djbkfu462ymD0CjVZss_aGHl8Wn2t3ZFk44s5A1ceRY39jfC4iYzBl3ysTbmJF3uPRc-fZEeAMa239hBhWDOgi8f4udbLcHxbz3QEQBDMgsxTLpJKLfXL4ofJZy6BKdHQtMqokRKvTYTTIPtzoKJNgXycdD88o-C-I8MK8orLTN2reLjSevvg8fKR81rlWWoT1JN3pMzbmsns3Bi4AD1sA-5ZqWtyZiG1_KarZCwhvfe3iH-5PQaMVqOZoluwW9Y0CK9khfoB2gGDEUM7fqAB6ES_3oOA_CbXR6xh39BBQS--Qa1sOU_xaE7HTeL0S_QswHgUb8OJzvybaD19jE8eCFlPb1xkHIN7rDeqjWhtYs_RMmJUHkTzOjhCT6icaPZD8Q7aw0E0PW37K8f25lRNvwzlt-MI8K37aypoxwk0q4A2KKd5EWnPG-tNNQtcxRdIzQtZ7s3_G_TVMeJRiv86JKNXk_MrMFMJ6Ys7N_QcO4dtjFQTWdwag-tnm8j1fsB8AZFtUgLzsSyIKj2WfJQ9cw00UJggx14e5EggbvOYnMdMn7EC56dLyP_Ew1r4rciCyx4RPsk8r0djTXzU5HJ-Af3YM1yvn0-NMcsTky73E2LigXwdEIF4ohQjEzJEbuIGhbPCd8S0C2WZc7XRd6-ki-SHMCSbn87OMI5jsVHGX_8gFALaEqT02PHnMHHo5Z3XHjGck2TfI2kpBQ9q3UPomI0R6U7YR1w0CoPwFzKNosFh6y1d6T-ulpMIMOM3LoyZo3AvWb9c0K6Tnixky1S_5ALsIeg01dOVUSPYwTOI8Jw493cGdQ6SA6NvvZMCw20nAS2jRc_0e3QU6EAtN8srnVw7pzXysE939uVxbzhMyzStmWYH_KtV0tXC7uGam6x88V04ee-Um2oejVz6HbTSQQZJlE76ZUB5MC9cggk_DME1r1otWU2NuxPKtZZkeDpA1Xv6pDYarVLrI5QEXJB8xeh-upWepsQlJ3j9HPTC2NK5RQwp64c7DHqfGZ8WYY2N6-d3XLT7X6rpxxUT20ZeAkKyZ6Se9KljJWa4X8l5LsaO3ZidHBI.kQ_u2mD3-p2GUlKi3S4MxylC-tJhj1MmBf-70PPb35I"
}