问题描述

我正在尝试编写一个使用混合身份验证方案的 ASP.NET 应用程序.用户可以将其用户名和密码哈希存储在 UserStore 中，也可以通过 Azure Active Directory 进行身份验证.

I am attempting to write an ASP.NET application that uses a hybrid authentication scheme. A user can either have his username and password hash stored in the UserStore, or he can authenticate via Azure Active Directory.

我已经创建了如图所示的登录表单.它具有标准的 UserName 和 Password 输入，还具有通过 Active Directory 登录"按钮.

I have created the login form pictured. It has the standard UserName and Password inputs, but also has a "Login via Active Directory" button.

这很好用.

现在解决问题:应用程序的主页具有 [Authorize] 属性.

Now for the problem: The application's home page has the [Authorize] attribute.

public class DefaultController : Controller
{
    [Authorize]
    public ViewResult Index()
    { 
    // Implementation
    }
}

如果用户没有登录，我希望它重定向到页面Account/Login，让用户选择认证方式.

If the user is not logged in, I want it to redirect to the page Account/Login, allowing the user to choose the authentication method.

将 IAppBuilder.UseOpenIdConnectAuthentication 添加到管道设置后，它不再重定向到该页面.相反，它直接进入 Microsoft 登录页面.

Once I added IAppBuilder.UseOpenIdConnectAuthentication to the pipeline setup, it no longer redirects to that page. Instead, it goes straight to the Microsoft Login page.

我如何配置它以使 OpenID 身份验证成为系统的一部分，但允许我指定在用户未通过身份验证时如何执行重定向?

How do I configure it so that OpenID authentication is part of the system, but allow me to specify how to perform redirections when the user is not authenticated?

这是我设置管道的代码:

Here's the code where I set up the pipeline:

appBuilder.SetDefaultSignInAsAuthticationType(CookieAuthenticationDefaults.AuthenticationType_;
var cookieAuthenticationOptions = new CookieAuthenticationOptions
{
     AuthenticationType = DefaultAuthenticationType.ApplicationCookie,
     LoginPath = new Microsoft.Owin.PathString("/Account/Login"),
     Provider = new Security.CookieAuthenticationProvider()
};
appBuilder.UseCookieAuthentication(cookieAuthenticationOptions);
// Now the OpenId authentication
var notificationHandlers = new OpenIdConnectAuthenticationNotificationHandlers 
{
   AuthorizationCodeReceived = async(context) => {
       var jwtSecurityToken = context.JwtSecurityToken;
       // I've written a static method to convert the claims
       // to a user
       var user = await GetOrCreateUser(context.OwinContext, jwtSecurityToken.Claims);
       var signInManager = context.OwinContext.Get<SignInManager>();
       await signInManager.SignInAsync(user, true, false);
   }
}
var openIdOptions = new OpenIdConnectAuthenticationOptions
{
     ClientId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx",
     Authority = "https://login.microsoftonline.com/xxxxx.onmicrosoft.com",
     PostLogoutRedirectUri = "https://localhost:52538/Account/Login",
     Notifications = notifcationHandlers
}
appBuilder.UseOpenIdConnectAuthentication(openIdOptions);

当您单击Active Directory 登录"时，它会发布到Account/SignInWithOpenId"

When you click "Active Directory Signin", it posts to "Account/SignInWithOpenId"

public ActionResult SignInWithOpenId()
{
    // Send an OpenID Connect sign-in request.
    if (!Request.IsAuthenticated)
    {
        var authenticationProperties = new AuthenticationProperties
        {
            RedirectUri = "/"
        };
        HttpContext.GetOwinContext().Authentication.Challenge
        (
            authenticationProperties,
            OpenIdConnectAuthenticationDefaults.AuthenticationType
        );
        return new EmptyResult();
    }
    else
    {
        return RedirectToAction("Index", "Default");
    }
}

推荐答案

对 IAppBuilder.UseOpenIdConnectAuthentication(...) 的调用将 Owin 中间件组件放入管道中.当 ASP.NET MVC 返回 401(未授权)的 HttpResponse 时，Owin 中间件组件会检测到这一点并将其更改为 Http Redirect(代码 302)，并且重定向路径是 Open Id 提供程序.

The call to IAppBuilder.UseOpenIdConnectAuthentication(...) puts an Owin middleware component in the pipeline. When ASP.NET MVC returns an HttpResponse of 401 (Unauthorized), the Owin Middleware component detects this and changes it to an Http Redirect (code 302), and the redirection path is to the Open Id provider.

但是有一种方法可以解决这个问题:在中间件组件执行重定向之前，它会调用回调 RedirectToIdentityProvider.从这里，您可以覆盖此重定向.

But there's a way to get around this: before the middleware component performs the redirect, it invokes the callback RedirectToIdentityProvider. From here, you can override this redirection.

这是我的代码，它会覆盖重定向，除非它来自请求路径 Account/SignInWithOpenId.

Here is my code that overrides the redirection unless it is from the request path Account/SignInWithOpenId.

var notificationHandlers = new OpenIdConnectAuthenticationNotifications
{
    AuthorizationCodeReceived = async(context) => {
       // Sign in the user here
    },
    RedirectToIdentityProvider = (context) => {
        if(context.OwinContext.Request.Path.Value != "/Account/SignInWithOpenId")
        {
             context.OwinContext.Response.Redirect("/Account/Login");
             context.HandleResponse();
        }
        return Task.FromResult(0);
    }
}
var openIdOptions = new OpenIdConnectAuthenticationOptions
{
     ClientId = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxx",
     Authority = "https://login.microsoftonline.com/xxxxx.onmicrosoft.com",
     PostLogoutRedirectUri = "https://localhost:52538/Account/Login",
     Notifications = notifcationHandlers
}
appBuilder.UseOpenIdConnectAuthentication(openIdOptions);

这篇关于带有 OpenIdAuthentication 的 ASP.NET:如果未授权，则重定向到 url的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持跟版网！