Question

AM尝试根据组织请求实现多重身份验证。我在startup.auth.cs中有类似的内容

 foreach (OrganizationModel org in orgList)
    {
        if (org.AuthenticationType != "Azure")
        {
            var adfs = new WsFederationAuthenticationOptions
            {
                AuthenticationType = org.AuthenticationType,
                Caption = org.Caption,
                BackchannelCertificateValidator = null,
                MetadataAddress = org.MetadataUrl,
                Wtrealm = org.Realm,
                Notifications = new WsFederationAuthenticationNotifications
                {
                    AuthenticationFailed = context =>
                    {
                        context.HandleResponse();
                        context.Response.Redirect("Home/Error?message=" + context.Exception.Message);
                        return Task.FromResult(0);
                    }
                },
                TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = false },

            };
            app.UseWsFederationAuthentication(adfs);
        }
        else
        {
            var azure = new WsFederationAuthenticationOptions
            {
                AuthenticationType = org.AuthenticationType,
                Caption = org.Caption,
                BackchannelCertificateValidator = null,
                MetadataAddress = org.MetadataUrl,
                Wtrealm = org.Realm,
                Notifications = new WsFederationAuthenticationNotifications
                {
                    AuthenticationFailed = context =>
                    {
                        context.HandleResponse();
                        context.Response.Redirect("Home/Error?message=" + context.Exception.Message);
                        return Task.FromResult(0);
                    }
                },
                TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = false },

            };
            app.UseWsFederationAuthentication(azure);
        }
    }

我填充各种身份验证提供程序以进行登录。当我点击ADFS我能够进行身份验证，获得声明，一切正常。但是当我尝试对Azure AD进行身份验证时，我收到错误“ID 4037”，验证签名所需的密钥无法解析。注意：如果我尝试单独执行Azure AD（注释ADFS部分），它可以正常工作。 Orglist从DB填充，它包含元数据url，Realm等信息。对于Dev目的，我已将https://localhost:44303配置为两者的域。

登录后的回调方法是

 [AllowAnonymous]
        public async Task<ActionResult> ExternalLoginCallback(string returnUrl)
        {
            var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();

            if (loginInfo == null)
            {
                return RedirectToAction("Login");
            }

            // Sign in the user with this external login provider if the user already has a login
            var result = await SignInManager.ExternalSignInAsync(loginInfo, isPersistent: false);
            switch (result)
            {
                case SignInStatus.Success:
                    return RedirectToLocal(returnUrl);
                case SignInStatus.LockedOut:
                    return View("Lockout");
                case SignInStatus.RequiresVerification:
                    return RedirectToAction("SendCode", new { ReturnUrl = returnUrl, RememberMe = false });
                case SignInStatus.Failure:
                default:
                    // If the user does not have an account, then prompt the user to create an account
                    ViewBag.ReturnUrl = returnUrl;
                    ViewBag.LoginProvider = loginInfo.Login.LoginProvider;
                    return View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel { Email = loginInfo.DefaultUserName});
            }
        }

指导我出错的地方

Answer 1

我弄清楚问题是什么。当我们有多个身份验证提供程序时，添加到OWIN Middleware管道的每个身份验证选项的身份验证类型应该是唯一的。对于试图实现类似解决方案的人来说，下面给出了适用于我的代码。

 foreach (OrganizationModel org in orgList)
            {
                switch (org.AuthenticationName)
                {
                    case "ADFS":
                                var adfs = new WsFederationAuthenticationOptions
                                      {
                                          AuthenticationType = org.AuthenticationType,
                                          Caption = org.Caption,
                                          BackchannelCertificateValidator = null,
                                          MetadataAddress = org.MetadataUrl,
                                          Wtrealm = org.Realm,
                                          SignOutWreply = org.Realm,
                                          Notifications = new WsFederationAuthenticationNotifications
                                          {
                                              AuthenticationFailed = context =>
                                              {
                                                  context.HandleResponse();
                                                  context.Response.Redirect("Home/Error?message=" + context.Exception.Message);
                                                  return Task.FromResult(0);
                                              }
                                          },
                                          TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = false },
                                      };
                        app.UseWsFederationAuthentication(adfs);
                        break;
                    case "Azure":
                        OpenIdConnectAuthenticationOptions azure = null;
                        azure = new OpenIdConnectAuthenticationOptions
                        {
                            AuthenticationType = org.AuthenticationType,
                            Caption = org.Caption,
                            BackchannelCertificateValidator = null,
                            Authority = org.MetadataUrl,
                            ClientId = org.ClientId,
                            RedirectUri = org.Realm,
                      PostLogoutRedirectUri=org.Realm,
                            Notifications = new OpenIdConnectAuthenticationNotifications
                         {
                             AuthenticationFailed = context =>
                             {
                                 context.HandleResponse();
                                 context.Response.Redirect("Home/Error?message=" + context.Exception.Message);
                                 return Task.FromResult(0);
                             }
                         },
                        };
                        app.UseOpenIdConnectAuthentication(azure);
                        break;
                    case "Shibboleth":
                    break;
                    default:
                        break;
                }
            }

多个身份验证提供商

1 个答案: