问题陈述

我们正在开发一个新的企业级应用程序，并希望利用 Azure Active Directory 登录该应用程序，这样我们就不必创建另一组用户凭据。但是，我们针对此应用程序的权限模型比通过 AAD 内部的组处理的权限模型要复杂。

思想

我们的想法是，除了 ASP.NET Core 身份框架之外，我们还可以使用 Azure Active Directory OAuth 2.0 来强制用户通过 Azure Active Directory 进行身份验证，然后使用身份框架来处理授权/权限。

问题

您可以使用 Azure OpenId 身份验证创建开箱即用的项目，然后您可以使用身份框架轻松地将 Microsoft 帐户身份验证(非 AAD)添加到任何项目。但是没有内置任何内容来将 AAD 的 OAuth 添加到身份模型。

在尝试破解这些方法让它们按我需要的方式工作后，我终于尝试在 OAuthHandler 和 OAuthOptions 的基础上自制我自己的解决方案类。

我在这条路上遇到了很多问题，但设法解决了其中的大部分问题。现在我到了从端点取回 token 但我的 ClaimsIdentity 似乎无效的地步。然后，当重定向到 ExternalLoginCallback 时，我的 SigninManager 无法获取外部登录信息。

几乎可以肯定，一定有一些我遗漏的简单内容，但我似乎无法确定它是什么。

代码

启动.cs

services.AddAuthentication()
.AddAzureAd(options =>
{
    options.ClientId = Configuration["AzureAd:ClientId"];
    options.AuthorizationEndpoint = $"{Configuration["AzureAd:Instance"]}{Configuration["AzureAd:TenantId"]}/oauth2/authorize";
    options.TokenEndpoint = $"{Configuration["AzureAd:Instance"]}{Configuration["AzureAd:TenantId"]}/oauth2/token";
    options.UserInformationEndpoint = $"{Configuration["AzureAd:Instance"]}{Configuration["AzureAd:TenantId"]}/openid/userinfo";
    options.Resource = Configuration["AzureAd:ClientId"];
    options.ClientSecret = Configuration["AzureAd:ClientSecret"];
    options.CallbackPath = Configuration["AzureAd:CallbackPath"];
});

AzureAD 扩展

namespace Microsoft.AspNetCore.Authentication.AzureAD
{
    public static class AzureAdExtensions
    {
        public static AuthenticationBuilder AddAzureAd(this AuthenticationBuilder builder)
            => builder.AddAzureAd(_ => { });

        public static AuthenticationBuilder AddAzureAd(this AuthenticationBuilder builder, Action<AzureAdOptions> configureOptions)
        {
            return builder.AddOAuth<AzureAdOptions, AzureAdHandler>(AzureAdDefaults.AuthenticationScheme, AzureAdDefaults.DisplayName, configureOptions);
        }

        public static ChallengeResult ChallengeAzureAD(this ControllerBase controllerBase, SignInManager<ApplicationUser> signInManager, string redirectUrl)
        {
            return controllerBase.Challenge(signInManager.ConfigureExternalAuthenticationProperties(AzureAdDefaults.AuthenticationScheme, redirectUrl), AzureAdDefaults.AuthenticationScheme);
        }
    }
}

AzureADOptions 和默认值

public class AzureAdOptions : OAuthOptions
{

    public string Instance { get; set; }

    public string Resource { get; set; }

    public string TenantId { get; set; }

    public AzureAdOptions()
    {
        CallbackPath = new PathString("/signin-azureAd");
        AuthorizationEndpoint = AzureAdDefaults.AuthorizationEndpoint;
        TokenEndpoint = AzureAdDefaults.TokenEndpoint;
        UserInformationEndpoint = AzureAdDefaults.UserInformationEndpoint;
        Scope.Add("https://graph.windows.net/user.read");
        ClaimActions.MapJsonKey("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", "unique_name");
        ClaimActions.MapJsonKey("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname", "given_name");
        ClaimActions.MapJsonKey("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname", "family_name");
        ClaimActions.MapJsonKey("http://schemas.microsoft.com/ws/2008/06/identity/claims/groups", "groups");
        ClaimActions.MapJsonKey("http://schemas.microsoft.com/identity/claims/objectidentifier", "oid");
        ClaimActions.MapJsonKey("http://schemas.microsoft.com/ws/2008/06/identity/claims/role", "roles");            
    }
}


public static class AzureAdDefaults
{
    public static readonly string DisplayName = "AzureAD";
    public static readonly string AuthorizationEndpoint = "https://login.microsoftonline.com/common/oauth2/authorize";
    public static readonly string TokenEndpoint = "https://login.microsoftonline.com/common/oauth2/token";
    public static readonly string UserInformationEndpoint = "https://login.microsoftonline.com/common/openid/userinfo"; // "https://graph.windows.net/v1.0/me";
    public const string AuthenticationScheme = "AzureAD";
}

AzureADHandler

internal class AzureAdHandler : OAuthHandler<AzureAdOptions>
{
    public AzureAdHandler(IOptionsMonitor<AzureAdOptions> options, ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock)
      : base(options, logger, encoder, clock)
    {
    }

    protected override async Task<AuthenticationTicket> CreateTicketAsync(ClaimsIdentity identity, AuthenticationProperties properties, OAuthTokenResponse tokens)
    {
        HttpRequestMessage httpRequestMessage = new HttpRequestMessage(HttpMethod.Get, Options.UserInformationEndpoint);
        httpRequestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", tokens.AccessToken);
        HttpResponseMessage httpResponseMessage = await Backchannel.SendAsync(httpRequestMessage, Context.RequestAborted);
        if (!httpResponseMessage.IsSuccessStatusCode)
            throw new HttpRequestException(message: $"Failed to retrived Azure AD user information ({httpResponseMessage.StatusCode}) Please check if the authentication information is correct and the corresponding Microsoft Account API is enabled.");
        JObject user = JObject.Parse(await httpResponseMessage.Content.ReadAsStringAsync());
        OAuthCreatingTicketContext context = new OAuthCreatingTicketContext(new ClaimsPrincipal(identity), properties, Context, Scheme, Options, Backchannel, tokens, user);
        context.RunClaimActions();
        await Events.CreatingTicket(context);
        return new AuthenticationTicket(context.Principal, context.Properties, Scheme.Name);
    }

    protected override async Task<OAuthTokenResponse> ExchangeCodeAsync(string code, string redirectUri)
    {
        Dictionary<string, string> dictionary = new Dictionary<string, string>();
        dictionary.Add("grant_type", "authorization_code");
        dictionary.Add("client_id", Options.ClientId);
        dictionary.Add("redirect_uri", redirectUri);
        dictionary.Add("client_secret", Options.ClientSecret);
        dictionary.Add(nameof(code), code);
        dictionary.Add("resource", Options.Resource);

        HttpRequestMessage httpRequestMessage = new HttpRequestMessage(HttpMethod.Post, Options.TokenEndpoint);
        httpRequestMessage.Headers.Accept.Add(new MediaTypeWithQualityHeaderValue("application/json"));
        httpRequestMessage.Content = new FormUrlEncodedContent(dictionary);
        HttpResponseMessage response = await Backchannel.SendAsync(httpRequestMessage, Context.RequestAborted);
        if (response.IsSuccessStatusCode)
            return OAuthTokenResponse.Success(JObject.Parse(await response.Content.ReadAsStringAsync()));
        return OAuthTokenResponse.Failed(new Exception(string.Concat("OAuth token endpoint failure: ", await Display(response))));
    }

    protected override string BuildChallengeUrl(AuthenticationProperties properties, string redirectUri)
    {
        Dictionary<string, string> dictionary = new Dictionary<string, string>();
        dictionary.Add("client_id", Options.ClientId);
        dictionary.Add("scope", FormatScope());
        dictionary.Add("response_type", "code");
        dictionary.Add("redirect_uri", redirectUri);
        dictionary.Add("state", Options.StateDataFormat.Protect(properties));
        dictionary.Add("resource", Options.Resource);
        return QueryHelpers.AddQueryString(Options.AuthorizationEndpoint, dictionary);
    }

    private static async Task<string> Display(HttpResponseMessage response)
    {
        StringBuilder output = new StringBuilder();
        output.Append($"Status: { response.StatusCode };");
        output.Append($"Headers: { response.Headers.ToString() };");
        output.Append($"Body: { await response.Content.ReadAsStringAsync() };");
        return output.ToString();
    }
}

AccountController.cs

    [HttpGet]
    [AllowAnonymous]
    public async Task<IActionResult> SignIn()
    {
        var redirectUrl = Url.Action(nameof(ExternalLoginCallback), "Account");
        return this.ChallengeAzureAD(_signInManager, redirectUrl);
    }

    [HttpGet]
    [AllowAnonymous]
    public async Task<IActionResult> ExternalLoginCallback(string returnUrl = null, string remoteError = null)
    {
        if (remoteError != null)
        {
            _logger.LogInformation($"Error from external provider: {remoteError}");
            return RedirectToAction(nameof(SignedOut));
        }
        var info = await _signInManager.GetExternalLoginInfoAsync();
        if (info == null) //This always ends up true!
        {
            return RedirectToAction(nameof(SignedOut));
        }
    }

给你!

这是我的代码，我几乎可以肯定，在这一点上，我缺少一些简单的东西，但我不确定它是什么。我知道我的 CreateTicketAsync 方法也有问题，因为我没有击中正确的用户信息端点(或正确击中它)，但根据我的理解，我关心的声明应该作为 token 。

如有任何帮助，我们将不胜感激!

最佳答案

我最终解决了我自己的问题，因为它最终变成了几个问题。我为资源字段传递了错误的值，没有正确设置我的 NameIdentifer 映射，然后使用错误的端点来提取用户信息。用户信息 block 是最大的，因为它是我发现外部登录 block 正在寻找的 token 。

更新代码

启动.cs

services.AddAuthentication()
.AddAzureAd(options =>
{
    options.ClientId = Configuration["AzureAd:ClientId"];
    options.AuthorizationEndpoint = $"{Configuration["AzureAd:Instance"]}{Configuration["AzureAd:TenantId"]}/oauth2/authorize";
    options.TokenEndpoint = $"{Configuration["AzureAd:Instance"]}{Configuration["AzureAd:TenantId"]}/oauth2/token";
    options.ClientSecret = Configuration["AzureAd:ClientSecret"];
    options.CallbackPath = Configuration["AzureAd:CallbackPath"];
});

AzureADOptions 和默认值

public class AzureAdOptions : OAuthOptions
{

    public string Instance { get; set; }

    public string Resource { get; set; }

    public string TenantId { get; set; }

    public AzureAdOptions()
    {
        CallbackPath = new PathString("/signin-azureAd");
        AuthorizationEndpoint = AzureAdDefaults.AuthorizationEndpoint;
        TokenEndpoint = AzureAdDefaults.TokenEndpoint;
        UserInformationEndpoint = AzureAdDefaults.UserInformationEndpoint;
        Resource = AzureAdDefaults.Resource;
        Scope.Add("user.read");

        ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "id");
        ClaimActions.MapJsonKey(ClaimTypes.Name, "displayName");
        ClaimActions.MapJsonKey(ClaimTypes.GivenName, "givenName");
        ClaimActions.MapJsonKey(ClaimTypes.Surname, "surname");
        ClaimActions.MapJsonKey(ClaimTypes.MobilePhone, "mobilePhone");
        ClaimActions.MapCustomJson(ClaimTypes.Email, user => user.Value<string>("mail") ?? user.Value<string>("userPrincipalName"));       
    }
}

public static class AzureAdDefaults
{
    public static readonly string DisplayName = "AzureAD";
    public static readonly string AuthorizationEndpoint = "https://login.microsoftonline.com/common/oauth2/authorize";
    public static readonly string TokenEndpoint = "https://login.microsoftonline.com/common/oauth2/token";
    public static readonly string Resource =  "https://graph.microsoft.com";
    public static readonly string UserInformationEndpoint =  "https://graph.microsoft.com/v1.0/me";
    public const string AuthenticationScheme = "AzureAD";
}

关于c# - 在 ASP.NET Core 2.0 中将 Azure Active Directory OAuth 与身份模型结合使用，我们在Stack Overflow上找到一个类似的问题： https://stackoverflow.com/questions/47188066/