开发环境的 Microsoft Azure Active Directory 身份验证登录 URL

Question

Update:

As suggested I changed my Startup.auth.cs to code below

    public partial class Startup
    {
        private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
        private static string appKey = ConfigurationManager.AppSettings["ida:ClientSecret"];
        private static string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
        private static string tenantId = ConfigurationManager.AppSettings["ida:TenantId"];
        private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];

        public static readonly string Authority = aadInstance + tenantId;

        // This is the resource ID of the AAD Graph API.  We'll need this to request a token to call the Graph API.
        string graphResourceId = "https://graph.windows.net";

        public void ConfigureAuth(IAppBuilder app)
        {
            ApplicationDbContext db = new ApplicationDbContext();

            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {
                    ClientId = clientId,
                    Authority = Authority,
                    PostLogoutRedirectUri = postLogoutRedirectUri,

                    Notifications = new OpenIdConnectAuthenticationNotifications()
                    {
                        // If there is a code in the OpenID Connect response, redeem it for an access token and refresh token, and store those away.
                       AuthorizationCodeReceived = (context) => 
                       {
                           var code = context.Code;
                           ClientCredential credential = new ClientCredential(clientId, appKey);
                           string signedInUserID = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;
                           AuthenticationContext authContext = new AuthenticationContext(Authority, new ADALTokenCache(signedInUserID));



                               AuthenticationResult result =
                                 authContext.AcquireTokenByAuthorizationCode(
                                     code,
                                     new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)),
                                     credential,
                                     graphResourceId);


                           return Task.FromResult(0);
                       },


                        RedirectToIdentityProvider = context =>
                        {
                            string appBaseUrl = context.Request.Scheme + "://" + context.Request.Host + context.Request.PathBase;
                            string currentUrl = context.Request.Scheme + "://" + context.Request.Host + context.Request.Path;
                            context.ProtocolMessage.RedirectUri = currentUrl;
                            context.ProtocolMessage.PostLogoutRedirectUri = appBaseUrl;
                            return Task.FromResult(0);
                        }
                    }
                });
        }
    }

And now I have this:

Sometimes a DbEntityValidationException happens on my ApplicationDbContext (used to store ADALTokenCache)

---

When coding a web application using Azure AD ou Office 365 for user authentication you need to create a application key and configure an url for Azure redirect to your application after login. This url should be configured in web.config, but Azure AD ignores URI parameter that your application sends and redirects you to production URI instead of development URI.

my development url: https://localhost:44315/ production url: http://timesheet.tecnun.com.br/

the application ignores web.config and redirects to production url always

web.config:

  <appSettings>
    <add key="webpages:Version" value="3.0.0.0" />
    <add key="webpages:Enabled" value="false" />
    <add key="ClientValidationEnabled" value="true" />
    <add key="UnobtrusiveJavaScriptEnabled" value="true" />
    <add key="ida:ClientId" value="xxxxx" />
    <add key="ida:AADInstance" value="https://login.microsoftonline.com/" />
    <add key="ida:ClientSecret" value="xxxx" />
    <add key="ida:Domain" value="tecnun.com.br" />
    <add key="ida:TenantId" value="xxx" />
    <add key="ida:PostLogoutRedirectUri" value="https://localhost:44315/" />
  </appSettings>

my azure configuration:

Id like to work with two environments, development and production/real. But I can't find out how to do this without creating two applications.

Answer 1

To make the same application works for the different redirect URL, we can change it dynamically before the web app redirect to the identity data provider.

Here is the code sample for your reference:

app.UseOpenIdConnectAuthentication(
    new OpenIdConnectAuthenticationOptions
    {
        ClientId = clientId,
        Authority = authority,

        Notifications = new OpenIdConnectAuthenticationNotifications
        {
            RedirectToIdentityProvider=context=>
            {                                  
                string appBaseUrl = context.Request.Scheme + "://" + context.Request.Host + context.Request.PathBase;
                string currentUrl = context.Request.Scheme + "://" + context.Request.Host + context.Request.Path;
                context.ProtocolMessage.RedirectUri = currentUrl;
                context.ProtocolMessage.PostLogoutRedirectUri = appBaseUrl;
                return Task.FromResult(0);
            }
        }
    });