具有两个提供商的 AddMicrosoftIdentityWebApp 未设置 IsAuthenticated

Question

我正在尝试让双重身份验证方法适用于我的 .NET6 网站。 对于前端，我实现了 Azure AD B2C，对于后端，我实现了 Azure AD。 这是我的代码：

Startup.cs

public void ConfigureServices(IServiceCollection services)
{
...
services.AddAuthentication()
        .AddMicrosoftIdentityWebApp(options => {
            options.ResponseType = OpenIdConnectResponseType.Code;
            options.UsePkce = true;
            options.Instance = "Instance1";
            options.TenantId = "TenantId1";
            options.ClientId = "ClientId1";
            options.ClientSecret = "ClientSecret1";
            options.CallbackPath = "/signin-oidc/aadb2b";

            options.Scope.Clear();
            options.Scope.Add(OpenIdConnectScope.OpenId);
            options.Scope.Add(OpenIdConnectScope.OfflineAccess);
            options.Scope.Add(OpenIdConnectScope.Email);
            options.Scope.Add(OpenIdConnectScope.OpenIdProfile);
            options.MapInboundClaims = false;

            options.TokenValidationParameters = new TokenValidationParameters
            {
                NameClaimType = "preferred_username",
                ValidateIssuer = false
            };

            options.Events.OnRedirectToIdentityProvider = ctx =>
            {
                if (ctx.Response.StatusCode == 401)
                {
                    ctx.HandleResponse();
                }

                return Task.CompletedTask;
            };

            options.Events.OnAuthenticationFailed = ctx =>
            {
                ctx.HandleResponse();
                ctx.Response.BodyWriter.WriteAsync(Encoding.ASCII.GetBytes(ctx.Exception.Message));
                return Task.CompletedTask;
            };
        }, options => {
            options.Events.OnSignedIn = async ctx =>
            {
                if (ctx.Principal?.Identity is ClaimsIdentity claimsIdentity)
                {
                    // Syncs user and roles so they are available to the CMS
                    var synchronizingUserService = ctx
                        .HttpContext
                        .RequestServices
                        .GetRequiredService<ISynchronizingUserService>();
                    await synchronizingUserService.SynchronizeAsync(claimsIdentity);
                }
            };
        }, "AADB2B.OpenIdConnect", "AADB2B.Cookies");

services.AddAuthentication()
        .AddMicrosoftIdentityWebApp(options => {
            options.Instance = "Instance2";
            options.Domain = "Domain2";
            options.TenantId = "TenantId2";
            options.ClientId = "ClientId2";
            options.ClientSecret = "ClientSecret2";
            options.SignUpSignInPolicyId = "USUIP";
            options.ResetPasswordPolicyId = "RPP";
            options.EditProfilePolicyId = "EPP";
            options.CallbackPath = "/signin-oidc/aadb2c";

            options.TokenValidationParameters = new TokenValidationParameters
            {
                RoleClaimType = "roles"
            };

            options.Events.OnRedirectToIdentityProvider = ctx =>
            {
                if (ctx.Response.StatusCode == 401)
                {
                    ctx.HandleResponse();
                }

                return Task.CompletedTask;
            };

            options.Events.OnAuthenticationFailed = ctx =>
            {
                ctx.HandleResponse();
                ctx.Response.BodyWriter.WriteAsync(Encoding.ASCII.GetBytes(ctx.Exception.Message));
                return Task.CompletedTask;
            };
        }, options => {
            options.Events.OnSignedIn = async ctx =>
            {
                if (ctx.Principal?.Identity is ClaimsIdentity claimsIdentity)
                {
                    // Syncs user and roles so they are available to the CMS
                    var synchronizingUserService = ctx
                        .HttpContext
                        .RequestServices
                        .GetRequiredService<ISynchronizingUserService>();
                    await synchronizingUserService.SynchronizeAsync(claimsIdentity);
                }
            };
        }, "AADB2C.OpenIdConnect", "AADB2C.Cookies");

// Added as an experiment, doesn't seem to help
services.AddAuthorization(options => 
    options.DefaultPolicy = 
        new AuthorizationPolicyBuilder("AADB2B.OpenIdConnect")
            .RequireAuthenticatedUser()
            .Build());
...
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    app.UseNotFoundHandler();
    if (env.IsDevelopment())
    {
        app.UseDeveloperExceptionPage();
    }

    app.UseGetaCategories();
    app.UseGetaCategoriesFind();

    app.UseAnonymousId();
    app.UseStaticFiles();
    app.UseRouting();
    app.UseAuthentication();
    app.UseAuthorization();

    app.UseEndpoints(endpoints =>
    {
        endpoints.MapGet("/LoginPath", async ctx => ctx.Response.Redirect("/")).RequireAuthorization(authorizeData: new AuthorizeAttribute { AuthenticationSchemes = "AADB2B.OpenIdConnect" });
        endpoints.MapGet("/LogoutPath", async ctx => await MapLogout(ctx));

        endpoints.MapControllerRoute(name: "Default", pattern: "{controller}/{action}/{id?}");
        endpoints.MapControllers();
        endpoints.MapRazorPages();
        endpoints.MapContent();
    });
}

public async Task MapLogout(HttpContext ctx)
{
    await ctx.SignOutAsync("AADB2B.OpenIdConnect");
    await ctx.SignOutAsync("AADB2B.Cookies");
    ctx.Response.Redirect("/");
}

Controller.cs

[HttpGet]
[AllowAnonymous]
public IActionResult ExternalLogin(string scheme, string returnUrl)
{
    return Challenge(new AuthenticationProperties { RedirectUri = string.IsNullOrEmpty(returnUrl) ? "/" : returnUrl });
}

Controller 正在接收 QueryString scheme=AADB2B.OpenIdConnect和scheme=AADB2C.OpenIdConnect的超链接。

单击超链接后，浏览器会分别正确重定向到 AAD B2C 或 AAD 的登录页面，然后正确重定向回网站。 OnSignedIn 事件中的断点正确显示 Principal.Identity 确实是 ClaimsIdentity，并且 IsAuthenticated 为真。 当到达网站时，cookies 似乎存在：

但是，在页面加载完成后，在后续页面上检查IHttpContextAccessor会发现HttpContext.User似乎是一个全新的，而不是上述身份验证调用后存在的那个。

我试着改成这样：

[HttpGet]
[AllowAnonymous]
public IActionResult ExternalLogin(string scheme, string returnUrl)
{
    return Challenge(new AuthenticationProperties { RedirectUri = Url.Action("ExternalLoginCallback", new { scheme = scheme, returnUrl = returnUrl }) }, scheme);
}

[Authorize(AuthenticationSchemes = "AADB2B.OpenIdConnect,AADB2C.OpenIdConnect")]
public async Task<ActionResult> ExternalLoginCallback(string scheme, string returnUrl)
{
    var authenticate = await HttpContext.AuthenticateAsync(scheme);
    if (authenticate.Succeeded)
        User.AddIdentity((ClaimsIdentity)authenticate.Principal.Identity);

    return Redirect(string.IsNullOrEmpty(returnUrl) ? "/" : returnUrl);
}

在authenticate.Succeeded行中，我看到我的用户已正确通过身份验证。 User.AddIdentity行正确地将身份添加到该用户。 但是，当我查看随后的页面加载时，上面的标识消失了。

我束手无策。 任何建议将不胜感激。 谢谢！

更新 1

直接导航到装饰有[Authorize(AuthenticationSchemes = "AADB2C.OpenIdConnect")]的页面确实会正确地导致页面将用户识别为已通过身份验证。 但是，从那里导航到其他任何地方都会显示它们不再经过身份验证。

更新 2

在我无法使用Authorize标志装饰的地方调用IHttpContextAccessor.HttpContext?.AuthenticateAsync("AADB2C.OpenIdConnect") （由于还需要未经身份验证的用户的访问权限）正确获取经过身份验证的用户及其信息。 因此，现在我需要解决的唯一难题是找到一种方法，让Authorize进入我无法访问的代码区域，因为这些区域隐藏在专有的第三方代码后面。

更新 3

我不确定为什么，但看起来好像我使用AddOpenIdConnect而不是AddMicrosoftIdentityWebApp ，它......有效吗？ 它默认为那个，我的后端现在可以正确识别我的身份验证。

services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
    options.DefaultAuthenticateScheme = null;
    options.DefaultSignInScheme = null;
}).AddCookie(options =>
{
    options.Events.OnSignedIn = async ctx =>
    {
        if (ctx.Principal?.Identity is ClaimsIdentity claimsIdentity)
        {
            // Syncs user and roles so they are available to the CMS
            var synchronizingUserService = ctx
                .HttpContext
                .RequestServices
                .GetRequiredService<ISynchronizingUserService>();

            await synchronizingUserService.SynchronizeAsync(claimsIdentity);
        }
    };
}).AddOpenIdConnect(options =>
{
    options.ResponseType = OpenIdConnectResponseType.Code;
    options.UsePkce = true;
    options.Authority = $"MyAuthority";
    options.ClientId = "MyClientId";
    options.ClientSecret = "MyClientSecret";
    options.CallbackPath = "/signin-oidc/aadb2b";

    options.Scope.Clear();
    options.Scope.Add(OpenIdConnectScope.OpenId);
    options.Scope.Add(OpenIdConnectScope.OfflineAccess);
    options.Scope.Add(OpenIdConnectScope.Email);
    options.Scope.Add(OpenIdConnectScope.OpenIdProfile);
    options.MapInboundClaims = false;

    options.TokenValidationParameters = new TokenValidationParameters
    {
        RoleClaimType = "roles",
        NameClaimType = "preferred_username",
        ValidateIssuer = false
    };

    options.Events.OnRedirectToIdentityProvider = ctx =>
    {
        if (ctx.Response.StatusCode == 401)
        {
            ctx.HandleResponse();
        }

        return Task.CompletedTask;
    };

    options.Events.OnAuthenticationFailed = ctx =>
    {
        ctx.HandleResponse();
        ctx.Response.BodyWriter.WriteAsync(Encoding.ASCII.GetBytes(ctx.Exception.Message));
        return Task.CompletedTask;
    };
});

Answer 1

因此，总结一下我为解决此问题所采取的步骤：

1. 添加[Authorize(AuthenticationSchemes = "MyScheme")]到控制器将在使用 controller 路线导航时正确地强制进行身份验证。
2. 调用IHttpContextAccessor.HttpContext?.AuthenticateAsync("MyScheme")返回经过身份验证的主体的详细信息，允许在[Authorize]方法不起作用的地方进行基于代码的控制（因为它需要允许匿名用户和经过身份验证的用户，并呈现根据该条件不同）。
3. 对于我无法访问的特定后端代码，因为它隐藏在第三方专有代码（在本例中为EPiServer ）之后，我能够通过切换到使用AddOpenIdConnect而不是AddMicrosoftIdentityWebApp来解决问题。 我不确定为什么这样做有效，但目前我不打算进一步质疑它。