使用 Azure AD 注册单个 ASP.NET 核心 3.1 应用程序，并与许多不同的 ASP.NET 3.1 核心应用程序共享身份验证

Question

I have created one ASP.NET Core 3.1 application and I have implemented Azure AD OpenID Connect based authentication. I want to share this authentication mechanism with other ASP.NET Core 3.1 applications, instead creating this logic with every application. All of the apps will reside on the same IIS server.

Would it make sense to pull out the logic within the Startup.cs code related to Azure AD to one application, consisting just of the Azure AD authentication code, with other apps redirecting to this application for authentication? What is the best way to do this? Or should every application be registered explicitly in Azure AD and have their own Azure AD code in the Startup.cs file? Or do I have to implement on premises Identity Server that is integrated with Azure AD OpenID Connect in some way?

Answer 1

Jeremy's points are very good, so I would mark his as the accepted answer. Here is a bit more detail though.

SHARING OIDC PLUMBING

The usual option is to produce a small shared C# library with the common plumbing, then plug that into each app.

Each app needs to be able to deal with OIDC redirects and responses, along with auth cookies, handling expiry etc.

STANDARD 'SINGLE SIGN ON' OPTION

This is the most standard and recommended approach:

• Each app has its own OAuth Client Configuration
• Each app has its own client_id and redirect_uri
• Each app gets its own OAuth tokens and Auth cookies

If the user navigates from App A to App B they are redirected but sign on is automatic, due to the Authorization Server Session Cookie, so the experience is seamless.

INTEGRATED WEB PLATFORM OPTION

In some cases you may want to avoid the extra redirect in the same way as Google does:

• User logs in to GMail (mail.google.com) and is redirected
• User navigates to Google Drive (drive.google.com)
• There is no second redirect for the Drive app

To implement this in OIDC you could do this:

• Register a single OAuth client for all apps
• Assign multiple redirect and post logout Uris

Auth cookie properties would include these:

• Domain =.google.com
• Path = /
• Http Only
• Secure
• SameSite = strict

I usually recommend against this option though, since it can easily cause more problems over time than it solves:

• Cookies and tokens can end up having too many privileges
• If an attacker steals a token / cookie they can do more with it
• Apps are more likely to impact each other in multiple ways