Windows 身份验证适用于 IIS 但不适用于 Kestrel / Microsoft.AspNetCore.Authentication.Negotiate（不在 Chrome 中，有时在 Edge 中，总是在 IE 中）？

Question

我使用 Windows 身份验证创建了一个新的 Blazor（服务器端）应用程序，并使用 IIS Express 运行它。 它将显示一条消息“Hello Domain\User!” 来自右上角的以下剃刀组件 ( ...\BlazorApp1\BlazorApp1\Shared\LoginDisplay.razor )。

<AuthorizeView>
    Hello, @context.User.Identity.Name!
</AuthorizeView>

如果使用 Kestrel 运行，则不会显示该消息。 所以我尝试了以下步骤使其在 Kestrel 中工作。

1. 导入 NuGet 包Microsoft.AspNetCore.Authentication.Negotiate

2. 在Startup.cs的ConfigureService()中添加以下代码。

    services.AddAuthentication(NegotiateDefaults.AuthenticationScheme).AddNegotiate();

3. 在Startup.cs的Configure()中添加以下代码。 它们被添加到app.UseRouting();之间。 和app.UseEndpoints(... ;

            app.UseAuthentication();
            app.UseAuthorization();

它仍然没有显示 Hello 消息。 我读到“允许匿名请求。使用 ASP.NET Core 授权来挑战匿名请求以进行身份验证。” 在文档中，所以我做了以下操作来禁用匿名请求。

在_Host.cshtml中，在@namespace BlazorApp1.Pages之后添加以下行。

@using Microsoft.AspNetCore.Authorization
@attribute [Authorize]

但是，消息仍然没有显示？ 这是否意味着授权不起作用？

---

更新：

我将文件...\BlazorApp1\BlazorApp1\Shared\LoginDisplay.razor为

<AuthorizeView>
    <Authorized>
        Hello, @context.User.Identity.Name!
    </Authorized>
    <NotAuthorized>
        You are not authorized to view that page...
    </NotAuthorized>
</AuthorizeView>

它显示“您无权查看该页面...”。 Windows 身份验证似乎不起作用？

---

更新2：

文档中提到了以下内容。

Windows 环境配置 Microsoft.AspNetCore.Authentication.Negotiate 组件执行用户模式身份验证。 服务主体名称 (SPN) 必须添加到运行服务的用户帐户，而不是计算机帐户。 在管理命令 shell 中执行setspn -S HTTP/mysrevername.mydomain.com myuser 。

我尝试在家里个人电脑上的 Administrator powershell 控制台中运行以下命令。

setspn -S HTTP/mypcname myusername

但是，它得到了错误

PS C:\WINDOWS\system32> setspn -S HTTP/desktop8930 nkucw
Ldap Error(0x51 -- Server Down): ldap_connect
Failed to retrieve DN for domain "" : 0x00000051
Warning: No valid targets specified, reverting to current domain.
FindDomainForAccount: Call to DsGetDcNameWithAccountW failed with return value 0x0000054B
Unable to locate account nkucw

这是输出：（它显示“授权成功。”在日志中几次，但最后一次显示授权失败）

info: Microsoft.AspNetCore.DataProtection.KeyManagement.XmlKeyManager[0]
      User profile is available. Using 'C:\Users\nkucw\AppData\Local\ASP.NET\DataProtection-Keys' as key repository and Windows DPAPI to encrypt keys at rest.
info: Microsoft.Hosting.Lifetime[0]
      Now listening on: https://localhost:5001
info: Microsoft.Hosting.Lifetime[0]
      Now listening on: http://localhost:5000
info: Microsoft.Hosting.Lifetime[0]
      Application started. Press Ctrl+C to shut down.
info: Microsoft.Hosting.Lifetime[0]
      Hosting environment: Development
info: Microsoft.Hosting.Lifetime[0]
      Content root path: C:\Users\nkucw**strong text**\source\repos\TestPS\BlazorApp1
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:5001/
info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
      Authorization failed.
info: Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler[12]
      AuthenticationScheme: Negotiate was challenged.
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished in 135.0172ms 401
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:5001/
info: Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler[0]
      None
info: Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler[1]
      Incomplete Negotiate handshake, sending an additional 401 Negotiate challenge.
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished in 16.6473ms 401
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:5001/
info: Microsoft.AspNetCore.Authentication.Negotiate.NegotiateHandler[0]
      None
info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[1]
      Authorization was successful.
info: Microsoft.AspNetCore.Routing.EndpointMiddleware[0]
      Executing endpoint '/_Host'
info: Microsoft.AspNetCore.Mvc.RazorPages.Infrastructure.PageActionInvoker[3]
      Route matched with {page = "/_Host"}. Executing page /_Host
info: Microsoft.AspNetCore.Mvc.RazorPages.Infrastructure.PageActionInvoker[103]
      Executing an implicit handler method - ModelState is Valid
info: Microsoft.AspNetCore.Mvc.RazorPages.Infrastructure.PageActionInvoker[104]
      Executed an implicit handler method, returned result Microsoft.AspNetCore.Mvc.RazorPages.PageResult.
info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[1]
      Authorization was successful.
info: Microsoft.AspNetCore.Mvc.RazorPages.Infrastructure.PageActionInvoker[4]
      Executed page /_Host in 206.51090000000002ms
info: Microsoft.AspNetCore.Routing.EndpointMiddleware[1]
      Executed endpoint '/_Host'
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished in 270.6847ms 200 text/html; charset=utf-8
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:5001/css/bootstrap/bootstrap.min.css
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:5001/css/site.css
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:5001/_framework/blazor.server.js
info: Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware[6]
      The file /css/site.css was not modified
info: Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware[6]
      The file /_framework/blazor.server.js was not modified
info: Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware[6]
      The file /css/bootstrap/bootstrap.min.css was not modified
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished in 26.105700000000002ms 304 text/css
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished in 21.6629ms 304 application/javascript
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished in 21.6629ms 304 text/css
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:5001/css/open-iconic/font/css/open-iconic-bootstrap.min.css
info: Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware[6]
      The file /css/open-iconic/font/css/open-iconic-bootstrap.min.css was not modified
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished in 7.1119ms 304 text/css
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 POST https://localhost:5001/_blazor/negotiate text/plain;charset=UTF-8 0
info: Microsoft.AspNetCore.Routing.EndpointMiddleware[0]
      Executing endpoint '/_blazor/negotiate'
info: Microsoft.AspNetCore.Routing.EndpointMiddleware[1]
      Executed endpoint '/_blazor/negotiate'
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished in 22.780900000000003ms 200 application/json
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:5001/css/open-iconic/font/fonts/open-iconic.woff
info: Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware[6]
      The file /css/open-iconic/font/fonts/open-iconic.woff was not modified
info: Microsoft.AspNetCore.Hosting.Diagnostics[1]
      Request starting HTTP/1.1 GET https://localhost:5001/_blazor?id=ase9fodeUXavBCDTwk1Suw
info: Microsoft.AspNetCore.Hosting.Diagnostics[2]
      Request finished in 7.676900000000001ms 304 application/font-woff
info: Microsoft.AspNetCore.Routing.EndpointMiddleware[0]
      Executing endpoint '/_blazor'
info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
      Authorization failed.

---

更新3：

发现它在 Edge 中有效，但在 Chrome 中无效。 它是服务器端 Blazor 的错误吗？

更新4：

即使使用Edge，不断刷新页面也显示有时可能无法通过身份验证。

Answer 1

我在处理类似问题时发现了您的问题。 我想我知道你的问题的答案 - 你可以使用一个简单的中间件来挑战身份验证并显示登录。

1. 在您的 Configure 方法中添加：

app.UseMiddleware<ValidateAuthentication>();

2. 这是中间件本身：

internal class ValidateAuthentication : IMiddleware
{
  public async Task InvokeAsync(HttpContext context, RequestDelegate next)
  {
    if (context.User.Identity.IsAuthenticated)
        await next(context);
    else
        await context.ChallengeAsync();
  }
}

3. 在配置服务中：

 services.AddSingleton<ValidateAuthentication>();

你不应该需要一个构造函数。

Answer 2

内容Hello, @context.User.Identity.Name! 包含在开始元素<AuthorizeView>和结束元素</AuthorizeView>是AuthorizeView组件的ChildContent。 组件被用户用来授权用户时显示内容。 您可以改为使用Authorized RenderFragment属性，但不能同时使用两者，如下所示：

<AuthorizeView>
    <Authorized>
        Hello, @context.User.Identity.Name!</a>
    </Authorized>
</AuthorizeView>

AuthorizeView组件还定义了NotAuthorized属性，以显示未经授权访问的内容，因此您的AuthorizeView可能如下所示：

<AuthorizeView>
    <Authorized>
        Hello, @context.User.Identity.Name!
    </Authorized>
    <NotAuthorized>
       You are not authorized to view that page...
    </NotAuthorized>
</AuthorizeView>

现在无论哪种情况都会显示一条消息。

AuthorizeView组件不知道您的应用程序采用的身份验证方法，无论是身份身份验证还是Windows身份验证，因此问题的标题相当容易引起误解。 我猜您在配置Kestrel时遇到问题，并且您之前提出的问题对您没有帮助...就个人而言，我建议您使用In Process而不是Out of Process。

如果解决了您的问题，您是否愿意将其标记为答案，所以其他人都知道它很有用。

Answer 3

根据您的描述，我猜您可能启用了使用当前用户名和密码设置的 IE 用户身份验证自动登录，因为 chrome 也使用此设置来避免显示 windows 身份验证的弹出窗口。

我建议您可以尝试按照以下步骤修改设置并重试。

1.打开IE，找到internet选项。

2.修改用户认证方式，提升为用户名和密码

3.关闭ie和chrome再试。