Azure MSAL 认证和自定义 JWT 认证在 Blazor

Question

我正在尝试将 Azure MSAL 身份验证添加到现有的 Blazor WASM 应用程序，该应用程序已经使用 JWT 处理身份验证。但是如果我注册我使用的自定义AuthenticationStateProvider ，blazor 在运行时抛出：

未处理的异常呈现组件：指定的转换无效。 System.InvalidCastException：指定的转换无效。

查看源代码，它似乎会抛出，因为 MSAL class 期望 IServiceProvider 返回IRemoteAuthenticationService<TRemoteAuthenticationState>作为AuthenticationStateProvider请参阅第 65 行的 WebAssemblyAuthenticationServiceCollectionExtensions

那是我使用的AuthenticationStateProvider实现：

public class ApiAuthenticationStateProvider : AuthenticationStateProvider
{
    private readonly HttpClient _httpClient;
    private readonly ILocalStorageService _localStorage;

    public ApiAuthenticationStateProvider(AuthenticationHttpClient authHttpClient, ILocalStorageService localStorage)
    {
        _httpClient = authHttpClient.HttpClient;
        _localStorage = localStorage;
    }
    public override async Task<AuthenticationState> GetAuthenticationStateAsync()
    {
        var savedToken = await _localStorage.GetItemAsync<string>("authToken");

        if (string.IsNullOrWhiteSpace(savedToken))
        {
            return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity()));
        }

        _httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", savedToken);

        return new AuthenticationState(new ClaimsPrincipal(new ClaimsIdentity(ParseClaimsFromJwt(savedToken), "jwt")));
    }

    public void MarkUserAsAuthenticated(string email)
    {
        var authenticatedUser = new ClaimsPrincipal(new ClaimsIdentity(new[] { new Claim(ClaimTypes.Name, email) }, "apiauth"));
        var authState = Task.FromResult(new AuthenticationState(authenticatedUser));
        NotifyAuthenticationStateChanged(authState);
    }

    public void MarkUserAsLoggedOut()
    {
        var anonymousUser = new ClaimsPrincipal(new ClaimsIdentity());
        var authState = Task.FromResult(new AuthenticationState(anonymousUser));
        NotifyAuthenticationStateChanged(authState);
    }

    private IEnumerable<Claim> ParseClaimsFromJwt(string jwt)
    {
        var claims = new List<Claim>();
        var payload = jwt.Split('.')[1];
        var jsonBytes = ParseBase64WithoutPadding(payload);
        var keyValuePairs = JsonSerializer.Deserialize<Dictionary<string, object>>(jsonBytes);

        keyValuePairs.TryGetValue(ClaimTypes.Role, out object roles);

        if (roles != null)
        {
            if (roles.ToString().Trim().StartsWith("["))
            {
                var parsedRoles = JsonSerializer.Deserialize<string[]>(roles.ToString());

                foreach (var parsedRole in parsedRoles)
                {
                    claims.Add(new Claim(ClaimTypes.Role, parsedRole));
                }
            }
            else
            {
                claims.Add(new Claim(ClaimTypes.Role, roles.ToString()));
            }
            keyValuePairs.Remove(ClaimTypes.Role);
        }

        claims.AddRange(keyValuePairs.Select(kvp => new Claim(kvp.Key, kvp.Value.ToString())));

        return claims;
    }

    private byte[] ParseBase64WithoutPadding(string base64)
    {
        switch (base64.Length % 4)
        {
            case 2: base64 += "=="; break;
            case 3: base64 += "="; break;
        }
        return Convert.FromBase64String(base64);
    }
}

我注册如下： builder.Services.AddScoped<AuthenticationStateProvider, ApiAuthenticationStateProvider>();

有没有办法解决这个问题？ 我看过其他SO 问题，但无法解决。

Answer 1

使用AuthenticationStateProvider时，必须将适当的 System.Security.Claims.AuthenticationTypes 值之一添加为参数以及 claimsIdentity。

IE; 对于您的 blazor 应用程序，您必须使用 ClaimsIdentity 添加 authenticationType 参数值，以便您的代码将更改为：

var authenticatedUser = new ClaimsPrincipal(new ClaimsIdentity(claims, "Needs Auth Type Here"));

例子：

 public class ApiAuthenticationStateProvider: AuthenticationStateProvider { public override Task<AuthenticationState> GetAuthenticationStateAsync() {.... var claims = new[] { new Claim(ClaimTypes.Name, "xyz@afs.com") }; var authenticatedUser = new ClaimsPrincipal(new ClaimsIdentity(claims, AuthenticationTypes.Password)); var authState = Task.FromResult(new AuthenticationState(authenticatedUser)); ... return Task.FromResult(authState); } }

请注意上述代码中用于 ClaimsIdentity 的 AuthenticationTypes.Password 参数。 检查以在构造 ClaimsIdentity 的所有位置更改它。

如果需要检查用户的身份验证类型

if (User.Identity.AuthenticationType == AuthenticationTypes.Password) { //... }

这样您就可以成功登录。

或者尝试使用https中所说的RemoteAuthenticationService://github.com/do.net/as.netcore/issues

参考： .net 核心 - 自定义AuthenticationStateProvider身份验证失败 - 堆栈内存溢出