Question

在azure广告应用程序和owin openid身份验证方面遇到了一个奇怪的问题。重现这个问题。

1.在vs 2015中选择云应用模板，使用azure广告身份验证创建一个Web应用。

2.let标准代码按原样。

3.let startup.auth原样。

4.在本地运行应用程序它工作正常。

5.现在在启动àuth中更改代码如下

public partial class Startup
{
    private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
    private static string appKey = ConfigurationManager.AppSettings["ida:ClientSecret"];
    private static string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
    private static string tenantId = ConfigurationManager.AppSettings["ida:TenantId"];
    private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];

    public static readonly string Authority = aadInstance + tenantId;

    // This is the resource ID of the AAD Graph API.  We'll need this to request a token to call the Graph API.
    string graphResourceId = "https://graph.windows.net";

    private static readonly log4net.ILog logger = log4net.LogManager.GetLogger(System.Reflection.MethodBase.GetCurrentMethod().DeclaringType);

    public void ConfigureAuth(IAppBuilder app)
    {
        ApplicationDbContext db = new ApplicationDbContext();

        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
        logger.Debug("SetDefaultSignInAsAuthenticationType called");
        //app.UseCookieAuthentication(new CookieAuthenticationOptions());
        app.UseCookieAuthentication(
        new CookieAuthenticationOptions
        {
            Provider = new CookieAuthenticationProvider
            {
                OnResponseSignIn = ctx =>
                {
                    //logger.Debug("OnResponseSignIn called");
                    ////ctx.Identity = TransformClaims(ctx.Identity);
                    //logger.Debug("TransformClaims called");
                }
            }
        });

app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = clientId,
                Authority = Authority,
                PostLogoutRedirectUri = postLogoutRedirectUri,

                Notifications = new OpenIdConnectAuthenticationNotifications()
                {
                    // If there is a code in the OpenID Connect response, redeem it for an access token and refresh token, and store those away.
                   AuthorizationCodeReceived = (context) =>
                   {
                       var code = context.Code;
                       ClientCredential credential = new ClientCredential(clientId, appKey);
                       string signedInUserID = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;
                       logger.Debug("OnResponseSignIn called");
                       logger.Debug("signedInUserID =" + signedInUserID);
                       TransformClaims(context.AuthenticationTicket.Identity);
                       logger.Debug("TransformClaims called");
                       AuthenticationContext authContext = new AuthenticationContext(Authority, new ADALTokenCache(signedInUserID));
                       AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode(
                       code, new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), credential, graphResourceId);



                       return Task.FromResult(0);
                   },



                    // we use this notification for injecting our custom logic
                    SecurityTokenValidated = (context) =>
                    {
                        logger.Debug("SecurityTokenReceived called");
                        //TransformClaims();  //pass the identity
                        return Task.FromResult(0);
                    },


                }
            });
    }


    private static void TransformClaims(System.Security.Claims.ClaimsIdentity identity)
    {
        if (identity != null && identity.IsAuthenticated == true)
        {
            var usserobjectid = identity.FindFirst(ConfigHelpers.Azure_ObjectIdClaimType).Value;
                ((System.Security.Claims.ClaimsIdentity)identity).AddClaim(new System.Security.Claims.Claim("DBID", "999"));
                ((System.Security.Claims.ClaimsIdentity)identity).AddClaim(new System.Security.Claims.Claim("Super","True"));
        }

        // return identity;
    }

}

6.在本地运行应用程序它将完美无缺。

7.在azure网站上部署应用程序，并且永远不会调用启动àuthowin通知方法。但是应用程序有效，但身份转换不是

有人可以帮助解决这个问题，因为azure广告应用不支持Cookie或通知不会解雇或代码出现任何问题。

只是为了重新声明其他而不是startup.àuth，没有标准代码被更改。

Answer 1

我知道这有点旧，但我最近遇到了完全相同的问题，花了好几个小时试图理解为什么它在Azure中不起作用但它在我的localhost中工作得非常好。

这基本上是配置问题：在portal.azure.com中选择您的应用，然后转到设置＆gt;身份验证/授权，并确保应用服务身份验证已关闭。

事实证明，此设置将接管您的startup.auth设置。

我必须完全赞扬维托里奥·贝尔托奇（Vittorio Bertocci）对我的指示。

Azure活动目录和owin身份验证

1 个答案: