Question

我已使用此UR1中的说明启用了AAD Oauth。它按此处设计和解释的方式工作。 https://docs.microsoft.com/en-us/azure/app-service/configure-authentication-provider-aad使用具有快速设置的配置

但是，我想向我的站点添加一些不需要身份验证的URL，或者我只希望对某些页面进行身份验证。此设置使每个页面都经过身份验证，而有些则没有。如何添加规则以避免某些页面的AAD身份验证？

Answer 1

据我所知，如果我们使用应用程序服务简易身份验证，则无法确定哪些页面需要身份验证。因此，我们需要使用自己的代码来实现它。详细步骤如下。

注册Azure AD应用程序当出现“注册应用程序”页面时，输入您的应用程序的注册信息：

a。在Name部分中，输入将显示给应用程序用户的有意义的应用程序名称，例如ASPNET-Quickstart。

b。在重定向URI中添加<your web app url>，然后单击注册。

c。在“管理”部分下的左侧导航窗格中，选择Authentication 在“隐式授予”子部分下，选择“ ID令牌”。然后选择保存。

更新项目一种。安装软件包

Install-Package Microsoft.Owin.Security.OpenIdConnect
Install-Package Microsoft.Owin.Security.Cookies
Install-Package Microsoft.Owin.Host.SystemWeb

b。添加OWIN启动类

using System;
using System.Threading.Tasks;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using Microsoft.IdentityModel.Tokens;
using Microsoft.Owin;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.Notifications;
using Microsoft.Owin.Security.OpenIdConnect;
using Owin;

[assembly: OwinStartup(typeof(WebappAD.Startup))]

namespace WebappAD
{
   public class Startup
   {


       string clientId = System.Configuration.ConfigurationManager.AppSettings["ClientId"];

       string redirectUri = System.Configuration.ConfigurationManager.AppSettings["RedirectUri"];



       static string tenant = System.Configuration.ConfigurationManager.AppSettings["Tenant"];

       string authority = String.Format(System.Globalization.CultureInfo.InvariantCulture, System.Configuration.ConfigurationManager.AppSettings["Authority"], tenant);

       public void Configuration(IAppBuilder app)
       {
           app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

           app.UseCookieAuthentication(new CookieAuthenticationOptions());
           app.UseOpenIdConnectAuthentication(
               new OpenIdConnectAuthenticationOptions
               {
               // Sets the ClientId, authority, RedirectUri as obtained from web.config
               ClientId = clientId,
               Authority = authority,
               RedirectUri = redirectUri,

                   // PostLogoutRedirectUri is the page that users will be redirected to after sign-out. In this case, it is using the home page
                   PostLogoutRedirectUri = redirectUri,
               Scope = OpenIdConnectScope.OpenIdProfile,
               // ResponseType is set to request the id_token - which contains basic information about the signed-in user
               ResponseType = OpenIdConnectResponseType.IdToken,
               // ValidateIssuer set to false to allow personal and work accounts from any organization to sign in to your application
               // To only allow users from a single organizations, set ValidateIssuer to true and 'tenant' setting in web.config to the tenant name
               // To allow users from only a list of specific organizations, set ValidateIssuer to true and use ValidIssuers parameter
               TokenValidationParameters = new TokenValidationParameters()
                   {
                       ValidateIssuer = false // This is a simplification
               },
               // OpenIdConnectAuthenticationNotifications configures OWIN to send notification of failed authentications to OnAuthenticationFailed method
               Notifications = new OpenIdConnectAuthenticationNotifications
                   {
                       AuthenticationFailed = OnAuthenticationFailed
                   }
               }
           );
       }

       /// <summary>
       /// Handle failed authentication requests by redirecting the user to the home page with an error in the query string
       /// </summary>
       /// <param name="context"></param>
       /// <returns></returns>
       private Task OnAuthenticationFailed(AuthenticationFailedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> context)
       {
           context.HandleResponse();
           context.Response.Redirect("/?errormessage=" + context.Exception.Message);
           return Task.FromResult(0);
       }
   }
}

c。更新web.config

<appSettings>
 <add key="webpages:Version" value="3.0.0.0" />
 <add key="webpages:Enabled" value="false" />
 <add key="ClientValidationEnabled" value="true" />
 <add key="UnobtrusiveJavaScriptEnabled" value="true" />
 <add key="ClientId" value="Enter_the_Application_Id_here" />
<add key="redirectUri" value="Enter_the_Redirect_URL_here" />
<add key="Tenant" value="common" />
<add key="Authority" value="https://login.microsoftonline.com/{0}/v2.0" />
</appSettings>

d。在您的控制器中添加登录方法

public void SignIn()
       {
           if (!Request.IsAuthenticated)
           {


               HttpContext.GetOwinContext().Authentication.Challenge(
                   new AuthenticationProperties { RedirectUri = "/" },
                   OpenIdConnectAuthenticationDefaults.AuthenticationType);
           }
       }

e。使用它

[Authorize] // add it on the method you need to authenticate

有关更多详细信息，请参阅document

Answer 2

您可以将echo $(perl -e 'print unpack "f", pack "L", 0x41000000')设置为Action to take when request is not authenticated。然后在根文件夹中包含文件allow anonymous或authorization.json

在该文件中，您可以定义规则以排除/包括需要身份验证/授权的网址。

有关示例，请参见https://azure.github.io/AppService/2016/11/17/URL-Authorization-Rules.html

启用AAD将未经身份验证的页面添加到AppService

2 个答案: