IdentityServer3 的 ASP.NET Identity 插件 UI (IdentityManager) 在部署到 Azure (WebApp) 后不起作用

Question

I set-up IdentityServer3 to use ASP.NET Identity using the sample provided. Everything works fine locally, I can access the Identity Manager UI via '/admin' and can add/remove users/roles.

However, when I deploy it to Azure and try to access it then nothing happens and takes me to an URL that looks like this: https://IdentityServer3/admin/authorize?state=11373557769572288&client_id=idmgr&response_type=token

It works fine locally regardless if I use a local or remote (Azure SQL) database.

IdentityManager automatically logs-in the local user on first access which I suspect might be an issue when accessing a remote server but I'm not sure how to customize/change this.

The sample I used is here: https://github.com/IdentityServer/IdentityServer3.Samples/tree/master/source/AspNetIdentity

Answer 1

Ok, in case someone else stumbles upon this the solution is to change IdentityManager's SecurityConfiguration to HostSecurityConfiguration and then either:

1. Manually implement a simple authentication mechanism like the one shown here: https://vimeo.com/125427106

   or

2. Configure the IdentityManager like any other OIDC client. More details here: https://www.scottbrady91.com/ASPNET-Identity/Identity-Manager-using-ASPNET-Identity

All of the above is necessary because by default the IdentityManager uses LocalhostSecurityConfiguration which only allows authentication via localhost .

For the second option, the IdentityManager's SecurityConfiguration will end up looking like this:

managerApp.UseIdentityManager(new IdentityManagerOptions()
                {                            
                    SecurityConfiguration = new HostSecurityConfiguration
                    {
                        HostAuthenticationType = "cookies",
                        AdditionalSignOutType = "oidc",
                        NameClaimType = Constants.ClaimTypes.Name,
                        RoleClaimType = Constants.ClaimTypes.Role,
                        AdminRoleName = "IdentityManagerAdministrator" //default role name for IdentityManager
                    }
                });

As a tip, if you're running the IdentityManager in the same web application as the IdentityServer itself then make sure you place the IdentityManager's authentication logic after the IdentityServer mapping and before the IdentityManager's mapping:

app.Map("/identity", idsrvApp =>

//this sets IdentityManager to use IdentityServer as Idp
ConfigureIdentityManagerAuthentication(app);

app.Map("/manager", managerApp =>

If you place it before the IdentityServer's mapping then you will see an additional external 'OpenId' provider in the IdentityServer login page. If you put it after the IdentityManager map then the authentication won't work.