在 .net 6 web API 中实现多重授权

Question

I have auth0 authentication implemented for my webAPIs. But now due to some requirement change few of APIs need to be authorized with another scheme. So I need below specified different authorization schemes to authorize my API

1. Auth0 scheme (already authorizing api's)
2. Azure AD B2C

I have implemented Azure AD B2C and which is working fine when used alone but when I am trying to add it enable it with a previous scheme it is causing issues.

public static IServiceCollection AddSecurityPolicy(this IServiceCollection services, ConfigurationManager config)
        {
            const string ClientPortalScheme = "ClientPortalBearerScheme";
            //from https://auth0.com/blog/securing-aspnet-minimal-webapis-with-auth0/
            services.AddAuthentication(options =>
            {
                options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
            }).AddJwtBearer(options =>
            {
                options.Authority = config["AuthenticationSettings:Domain"];
                options.Audience = config["AuthenticationSettings:Audience"];
            }).AddJwtBearer(ClientPortalScheme, ClientPortalScheme, options =>
            {
                options.Authority = config["AzureADB2CSettings:Domain"];
                options.Audience = config["AzureADB2CSettings:Tenant"];
            });
            //services.AddMicrosoftIdentityWebApiAuthentication(config, "AzureADB2CSettings");

            //By default, require an authenticated user
            //Only one JWT bearer authentication is registered with the default authentication scheme JwtBearerDefaults.AuthenticationScheme.
            //Additional authentication has to be registered with a unique authentication scheme.
            //see https://docs.microsoft.com/en-us/aspnet/core/security/authorization/limitingidentitybyscheme?view=aspnetcore-6.0
            services.AddAuthorization(options =>
             {
                 var defaultAuthorizationPolicyBuilder = new AuthorizationPolicyBuilder(
                     JwtBearerDefaults.AuthenticationScheme,
                     ClientPortalScheme);
                 defaultAuthorizationPolicyBuilder =
                     defaultAuthorizationPolicyBuilder.RequireAuthenticatedUser();
                 options.DefaultPolicy = defaultAuthorizationPolicyBuilder.Build();
             });

            return services;
        }

This is how my code looks like. Issue is when I am calling my endpoint it says

Unable to obtain configuration from: 'https://mydomain.auth0.com/.well-known/openid-configuration'.
 ---> System.IO.IOException: IDX20804: Unable to retrieve document from: 'https://mydomain.auth0.com/.well-known/openid-configuration'.

Please let me know if any information is required int this regard

Answer 1

I tried to reproduce the issue in my environment.

It occurs when app config is not receiving OpenIDmeta data properly

The issue was due to TLS configuration in my case as TLS 1.1 or TLS 1.0 are depreciated.

Please make sure to set TLS to 1.2 or greater.

System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12;

Startup.cs

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                IdentityModelEventSource.ShowPII = true;
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
                app.UseHsts();
            }
           ......
            System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12 | SecurityProtocolType.Ssl3;;
               ....
            app.UseAuthentication();
            app.UseAuthorization();
          ....

}

Please make sure your backend API refers to /.well-known/openid-configuration Or check this way.

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
    {
        MetadataAddress = "http[s]://{IdentityServer}/.well-known/openid-configuration"
        ...
    });

• In AzureAdB2c make sure to set the Authority or (Domain and instance ) property correctly.
• Authority being the combination of Instance and domain Appsettings.json Authority: https://[yourb2ctenant}.b2clogin.com/{Configuration["AzureAdB2C:Tenant"]}/{Configuration["AzureAdB2C:Policy"]}/v2.0

Also see if Instance can be https://<tenant>.b2clogin.com/tfp/ Domain : <b2ctenant>.onmicrosoft.com

Then the authentication can be carried on successfully: