单声道与Owin身份验证

Question

我有一个我在Mono中运行的Owin应用程序，我正在尝试让身份验证在其上正常运行。 我使用此页面上的信息作为开始。 我很快意识到Owin Authentication使用了一些Windows特定的库。 不过， 这个问题有一个解决方法，我认为这就足够了。 事实并非如此。

以下代码抛出了另一个问题中描述的异常（在问题所描述的另一个地方（参见代码中的注释））。 如果我试图注释掉东西以找出关于Owin管道的错误异常被抛出（因为依赖性）。 如果我注释掉足以删除第一个异常再次出现。

有人能成功地在Mono中使用AspNet身份设置身份验证吗？

启动

public void Configure(IAppBuilder app)
{
    // Add the AspNet Identity user manager to the Owin context
    app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);

    // This was the first line to fail, but adding the AesDataProtectorProvider as
    // described in the referred question fixed that
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        LoginPath = new PathString("/login"),
        Provider = new CookieAuthenticationProvider
        {
            OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
                validateInterval: TimeSpan.FromMinutes(30),
                regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
        },
        TicketDataFormat = new SecureDataFormat<AuthenticationTicket>(
            DataSerializers.Ticket,
            new AesDataProtectorProvider("myAuthKey"),
            TextEncodings.Base64)
    });

    // This causes an exception complaining that the Windows only assembly
    // DpapiDataProtector can't be loaded, as described in the referred question
    app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

    // Set up the custom middleware as described in the first link
    // Something inside this causes other exceptions.
    app.Use(typeof(AuthMiddleware), app, new AuthOptions());
}

AuthMiddleware

public class AuthMiddleware : AuthenticationMiddleware<AuthOptions>
{
    public AuthMiddleware(OwinMiddleware next, IAppBuilder app, AuthOptions options)
        : base(next, options)
    {
        if (string.IsNullOrEmpty(Options.SignInAsAuthenticationType))
        {
            options.SignInAsAuthenticationType = app.GetDefaultSignInAsAuthenticationType();
        }
        if (options.StateDataFormat == null)
        {
            var dataProtector = app.CreateDataProtector(typeof(AuthMiddleware).FullName,
            options.AuthenticationType);
            options.StateDataFormat = new PropertiesDataFormat(dataProtector);
        }
    }

    protected override AuthenticationHandler<AuthOptions> CreateHandler()
    {
        return new AuthHandler();
    }
}

AuthOptions

public class AuthOptions : AuthenticationOptions
{
    public AuthOptions()
        : base("MyApp")
    {
        Description.Caption = "MyApp";
        // Where to redirect requests if not authenticated
        CallbackPath = new PathString("/login");            AuthenticationMode = AuthenticationMode.Passive;
    }

    public PathString CallbackPath { get; set; }
    public string SignInAsAuthenticationType { get; set; }
    public ISecureDataFormat<AuthenticationProperties> StateDataFormat { get; set; }
}

AuthHandler

public class AuthHandler : AuthenticationHandler<AuthOptions>
{
    protected override Task<AuthenticationTicket> AuthenticateCoreAsync()
    {
        var identity = new ClaimsIdentity(Options.SignInAsAuthenticationType);
        var properties = Options.StateDataFormat.Unprotect(Request.Query["state"]);
        return Task.FromResult(new AuthenticationTicket(identity, properties));
    }

    protected override Task ApplyResponseChallengeAsync()
    {
        if (Response.StatusCode == 401)
        {
            var challenge = Helper.LookupChallenge(Options.AuthenticationType, Options.AuthenticationMode);
            if (challenge != null)
            {
                var state = challenge.Properties;
                if (string.IsNullOrEmpty(state.RedirectUri))
                {
                    state.RedirectUri = Request.Uri.ToString();
                }
                var stateString = Options.StateDataFormat.Protect(state);
                Response.Redirect(WebUtilities.AddQueryString(Options.CallbackPath.Value, "state", stateString));
            }
        }
        return Task.FromResult<object>(null);
    }

    public override async Task<bool> InvokeAsync()
    {
        Request.Environment.Add("Context", Context);

        // If user is not logged in and tries to access any page that is not in
        // the list of allowed pages, redirect to login page
        if (Context.Authentication.User == null && 
            !Request.Path.ToString().StartsWith("/login"))
        {
            Response.Redirect(Options.CallbackPath.Value);
            return true;
        }

        return false;
    }
}

Answer 1

GitHub存储库展示Mono WebAPI，OAuth2 Bearer令牌认证， AspNet.Identity + MySQL UserStore ：

https://github.com/shturm/mono-webapi

很少有事情要清楚：

1. AspNet.Identity是一组接口（ Microsoft.AspNet.Identity.Core ）及其实现（ Microsoft.AspNet.Identity.EntityFramework / Owin ），它们粗略地描述了在数据库中持久存储帐户的存储库模式 。
2. AspNet.Identity不进行身份验证/授权。 它在处理密码时创建，保存，更新，删除用户。
3. 使用的AspNet.Identity主类是UserManager （来自Microsoft.AspNet.Identity.Core ）和SignInManger （来自Microsoft.AspNet.Identity.Owin ）。 SignInManager不需要执行任何类型的OWIN身份验证。
4. 您发布的代码与Microsoft.Owin严格相关，与AspNet.Identity无关，但Application Studio模板中的ApplicationUserManager扩展了Microsoft.AspNet.Identity.UserManager 。

Answer 2

显然，上面提交的代码包含的不仅仅是使Owin身份验证工作所必需的（而且不适用于Mono）。 经过研究和尝试了很多排列，我相信我现在已经在工作状态下进行了身份验证。 我不知道它是否必须是正确的条件，但只要它有效...

使用以下设置，只有允许页面列表中的页面（由public override async Task<bool> InvokeAsync()的方法public override async Task<bool> InvokeAsync() AuthHandler ）可供未登录的用户访问。在登录页面上，我可以使用ApplicationUserManager登录用户。 登录后，Owin托管的所有页面均可访问。

启动

app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
    LoginPath = new PathString("/login"),
    Provider = new CookieAuthenticationProvider
    {
        OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
            validateInterval: TimeSpan.FromMinutes(30),
            regenerateIdentity: (manager, user) => user.GenerateUserIdentityAsync(manager))
    },
    TicketDataFormat = new SecureDataFormat<AuthenticationTicket>(
        DataSerializers.Ticket,
        new AesDataProtectorProvider("myAuthKey"),
        TextEncodings.Base64)
});

app.Use(typeof(AuthMiddleware), app, new AuthOptions());

AuthMiddleware

public class AuthMiddleware : AuthenticationMiddleware<AuthOptions>
{
    public AuthMiddleware(OwinMiddleware next, IAppBuilder app, AuthOptions options)
        : base(next, options)
    {
        if (options.StateDataFormat == null)
        {
            options.StateDataFormat = new PropertiesDataFormat(new AesDataProtectorProvider("myAuthKey"));
        }
    }

    protected override AuthenticationHandler<AuthOptions> CreateHandler()
    {
        return new AuthHandler();
    }
}

AuthHandler

public class AuthHandler : AuthenticationHandler<AuthOptions>
{
    protected override Task<AuthenticationTicket> AuthenticateCoreAsync()
    {
        // This method never gets called in the current setup,
        // but it is required because the compilation fails otherwise.
        // Therefore only return an empty object.
        return Task.FromResult<AuthenticationTicket>(null);
    }

    protected override Task ApplyResponseChallengeAsync()
    {
        if (Response.StatusCode == 401)
        {
            var challenge = Helper.LookupChallenge(Options.AuthenticationType, Options.AuthenticationMode);
            if (challenge != null)
            {
                var state = challenge.Properties;
                if (string.IsNullOrEmpty(state.RedirectUri))
                {
                    state.RedirectUri = Request.Uri.ToString();
                }
                var stateString = Options.StateDataFormat.Protect(state);
                Response.Redirect(WebUtilities.AddQueryString(Options.CallbackPath.Value, "state", stateString));
            }
        }
        return Task.FromResult<object>(null);
    }

    public override async Task<bool> InvokeAsync()
    {
        // If user is not logged in and tries to access any page that is not in
        // the list of allowed pages, redirect to login page.
        // Add any additional pages not protected by authentication here
        if (Context.Authentication.User == null && 
            !Request.Path.ToString().StartsWith("/login"))
        {
            Response.Redirect(Options.CallbackPath.Value);
            return true;
        }

        return false;
    }
}

Answer 3

Owin中的身份验证使用异步管道，但Mono不支持。

我对单声道https://github.com/mono/mono/pull/3048提出拉取请求。 它使异步Web api堆栈的同步执行成为可能。

现在，您可以使用此修复程序使用Owin身份验证。

Answer 4

我要留下一个答案，但不解决OP的问题，作为那些没有跳过.NET Core的人的资源。

在Mono，Mod-Mono和Apache上，我的经验是，在Mono上， regenerateIdentity函数失败了，但是从VS本地运行时会成功。

在修复之前（startup.auth.cs）

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
   AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
   LoginPath = new PathString("/Account/Login"),
   Provider = new CookieAuthenticationProvider
   {  
       OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
           validateInterval: TimeSpan.FromMinutes(2),
           regenerateIdentity: (manager, user) => AuthenticationService.RefreshIdentityAsync(manager, user))
   }
});

我在Chrome的Dev Tools（应用程序选项卡）中注意到cookie仍然存在，因为它将在未来的2周内到期。

我的解决方案是调整cookie的“Expires”时间，使其与验证间隔保持一致 。 现在客户端负责cookie驱逐，而Mono不必在重新生成时处理cookie。 我意识到这不是一般的修复，但对很多人来说，我确信这已经足够了。

修复后

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
   AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
   LoginPath = new PathString("/Account/Login"),
   ExpireTimeSpan = TimeSpan.FromMinutes(2),
   SlidingExpiration = false,
   Provider = new CookieAuthenticationProvider
   {
       OnValidateIdentity = SecurityStampValidator.OnValidateIdentity<ApplicationUserManager, ApplicationUser>(
           validateInterval: TimeSpan.FromMinutes(2),
           regenerateIdentity: (manager, user) => AuthenticationService.RefreshIdentityAsync(manager, user))
   }
});