Azure 廣告重定向 Uri 獲取 http 而不是 https

Question

I have asp.net core project that require azure ad single sign on but I have issue that my application keep getting the redirect uri as http instead of https I tried to add the following in startup

導致 http 而不是 https 的舊啟動

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"))
            // Add the possibility of acquiring a token to call a protected web API
            .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
            // Enables controllers and pages to get GraphServiceClient by dependency injection
            // And use an in memory token cache
            .AddMicrosoftGraph(Configuration.GetSection("DownstreamApi"))
            .AddInMemoryTokenCaches();

解決重定向 uri 添加之前的代碼如下

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApp(msIdentityOption =>
            {
                msIdentityOption.ClientId = Configuration["AzureAd:ClientId"];
                msIdentityOption.Scope.Add("user.read.all");

                
                msIdentityOption.Events.OnRedirectToIdentityProvider = context =>
                {
                    context.ProtocolMessage.RedirectUri = Configuration["RedirectUrl"];
                    return Task.CompletedTask;
                };

                msIdentityOption.Instance = Configuration["AzureAd:Instance"];
                msIdentityOption.TenantId = Configuration["AzureAd:TenantId"];
                msIdentityOption.ClientSecret = Configuration["AzureAd:clientSecret"];
            })
            // Add the possibility of acquiring a token to call a protected web API
            .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)

            // Enables controllers and pages to get GraphServiceClient by dependency injection
            // And use an in memory token cache
            .AddMicrosoftGraph(Configuration.GetSection("DownstreamApi"))
            .AddInMemoryTokenCaches();

這在 login.microsoftonline.com 和我的應用程序之間創建了一個重定向循環，我最終在 Microsoft 的登錄頁面上收到消息，我們無法登錄我檢查我的日志，它是以下內容

A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details.  Original exception: AADSTS500112: The reply address 'http://mysite/signin-oidc' does not match the reply address 'https://mysite/signin-oidc' provided when requesting Authorization code.

所以無論如何都要覆蓋重定向uri以使其成為https

Answer 1

重定向 URI 在 Azure Active Directory 的應用程序注冊窗格中設置。

如果您在此處添加“https://mysite/signin-oidc”，則必須確保您的 ASP.NET 核心應用程序也在“https://mysite/signin-oidc”上偵聽傳入請求以獲取返回的令牌(s)。