将 okta openidconnect 与 .net 核心项目集成时，HttpContext.Current.User.Identity.IsAuthenticated 导致无限重定向循环

Question

这是startup.cs，我已经按照以下配置了okta openid connect。 请检查一下

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
        IConfigurationRoot configuration = new ConfigurationBuilder()
            .SetBasePath(Directory.GetCurrentDirectory())
            .AddJsonFile("appsettings.json")
            .Build();
        services.AddAuthentication(options =>
            {
                options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
            })
            .AddCookie()
            .AddOktaMvc(new OktaMvcOptions
            {
                // Replace these values with your Okta configuration
                OktaDomain = Configuration.GetValue<string>("AppSettings:OktaDomain"),
                ClientId = Configuration.GetValue<string>("AppSettings:ClientId"),
                ClientSecret = Configuration.GetValue<string>("AppSettings:ClientSecret"),
                Scope = new List<string> { "openid", "profile", "email" },
            });

        //services.AddAuthorization();


        services.Configure<FormOptions>(x => x.ValueCountLimit = 8192);

        services.Configure<CookiePolicyOptions>(options =>
        {
            options.CheckConsentNeeded = context => false;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });


        services.AddOptions();

        services.Configure<AppSettings>(Configuration.GetSection("AppSettings"));


        var lockoutOptions = new LockoutOptions()
        {
            AllowedForNewUsers = true,
            DefaultLockoutTimeSpan = TimeSpan.FromMinutes(5),
            MaxFailedAccessAttempts = 3
        };

        services.AddIdentity<ApplicationUser, IdentityRole<Guid>>(options =>
            {
                options.Password.RequireDigit = true;
                options.Password.RequiredLength = 6;
                options.Password.RequiredUniqueChars = 0;
                options.Password.RequireLowercase = false;
                options.Password.RequireUppercase = false;
                options.Password.RequireNonAlphanumeric = false;
                options.Lockout = lockoutOptions;
            })
            .AddEntityFrameworkStores<AmpCoreContext>().AddDefaultTokenProviders();

        services.ConfigureApplicationCookie(options =>
        {
            //     Cookie settings
            options.Cookie.HttpOnly = true;
            options.ExpireTimeSpan = TimeSpan.FromMinutes(20);
            options.LoginPath = new PathString("/Identity/Account/Login");
            options.AccessDeniedPath = "/Identity/Account/AccessDenied";
            options.ReturnUrlParameter = CookieAuthenticationDefaults.ReturnUrlParameter;
            options.SlidingExpiration = true;
        });
        services.AddSession(options => { options.IdleTimeout = TimeSpan.FromMinutes(20); });


        services
            .AddControllersWithViews()
            .SetCompatibilityVersion(CompatibilityVersion.Version_3_0)
            // Maintain property names during serialization. See:
            // https://github.com/aspnet/Announcements/issues/194
            .AddNewtonsoftJson(options => options.SerializerSettings.ContractResolver = new DefaultContractResolver());

        services.AddRazorPages().AddRazorRuntimeCompilation();

        services.AddHttpContextAccessor();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
    {
        var culture = CultureInfo.CreateSpecificCulture("en-US");
        var dateformat = new DateTimeFormatInfo
        {
            ShortDatePattern = "MM/dd/yyyy",
            LongDatePattern = "MM/dd/yyyy hh:mm:ss tt"
        };
        culture.DateTimeFormat = dateformat;

        var supportedCultures = new[] { culture };

        app.UseRequestLocalization(new RequestLocalizationOptions
        {
            DefaultRequestCulture = new RequestCulture(culture),
            SupportedCultures = supportedCultures,
            SupportedUICultures = supportedCultures
        });
        using (var serviceScope = app.ApplicationServices.GetService<IServiceScopeFactory>().CreateScope())
        {
            try
            {
                var context = serviceScope.ServiceProvider.GetRequiredService<AmpCoreContext>();
                var customers = context.Customer.ToListAsync().Result;
                string output =
                    Newtonsoft.Json.JsonConvert.SerializeObject(customers, Newtonsoft.Json.Formatting.Indented);
                File.WriteAllText("tenants.json", output);
            }
            catch (Exception)
            {
                throw;
            }
        }

        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }
        else
        {
            app.UseExceptionHandler("/Home/Error");
            // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
            app.UseHsts();
        }


        app.UseHttpsRedirection();
        app.UseStaticFiles();

        app.UseRouting();
        app.UseAuthentication();
        app.UseAuthorization();

        //app.UseCookiePolicy();
        app.UseSession();

        app.UseEndpoints(endpoints =>
        {
            endpoints.MapControllerRoute(
                name: "default",
                pattern: "{controller=Home}/{action=Index}/{id?}");

            endpoints.MapRazorPages();
        });
    }
}

这是我的帐户控制器，在登录按钮上单击我将其重定向到帐户控制器 singin 方法。 但它总是循环调用。 请检查下面的代码

public class AccountController : Controller
{
    public IActionResult SignIn()
    {
        if (!HttpContext.User.Identity.IsAuthenticated)
        {
            return Challenge(OktaDefaults.MvcAuthenticationScheme);
        }

        return RedirectToAction("Index", "Home");
    }

    [HttpPost]
    public IActionResult SignOut()
    {
        return new SignOutResult(
            new[]
            {
                OktaDefaults.MvcAuthenticationScheme,
                CookieAuthenticationDefaults.AuthenticationScheme,
            },
            new AuthenticationProperties { RedirectUri = "/Home/" });
    }
}

它重定向到 okta ， okta 返回但 HttpContext.User.Identity.IsAuthenticated 在帐户控制器中始终为 false，这是无限循环。

请帮忙

谢谢

Answer 1

如果您在操作或类上没有[Authorize] ，或者没有对用户进行身份验证的回退身份验证策略，则用户将不会通过身份验证。

我们可以在SignIn上放置[Authorize] ，但这会SignIn目的。

您还有另一种选择，手动验证并检查是否成功：

[HttpGet]
public async Task<ActionResult> SignIn()
{
    var oktaResult = await HttpContext.AuthenticateAsync(OktaDefaults.MvcAuthenticationScheme);
    if (oktaResult.Succeeded)
    {
        return RedirectToAction("Index", "Home");
    }
    
    return Challenge(OktaDefaults.MvcAuthenticationScheme);
}