Question

我有一个IdentityServer4实现，该实现具有默认的内部OIDC OpenIdConnect中间件，以从Microsoft开始提供对本地API的访问以及对外部登录提供程序的支持。我已经实现了自定义IClientStore，并使用

将其附加到中间件

   .AddClientStore<IS4ClientStore>();

当内部OIDC隐式连接进行身份验证时，BuildLoginViewModelAsync会调用IS4ClientStore.FindClientByIdAsync

 _clientStore.FindEnabledClientByIdAsync(context.ClientId);

返回预期的IdentityServer4.Client并进行所有身份验证，等等。

当我呼叫外部提供程序（Microsoft OAuth）时，它会通过连接到我提供的applicationid的auth进程，由Microsoft进行声明过程，然后Microsoft重定向回到https://localhost:5001/signin-microsoft。

启动时从调用services.AddAuthentication（）。AddMicrosoftAccount（options）调用的asp.net核心中间件没有使用我的客户端存储来查找客户端ID，它只是报告错误：

 Request starting HTTP/1.1 GET https://localhost:5001/signin-microsoft?code=M91ae2ef1-701d-ceb4-d479-a905d3d02a4d&state=CfDJ8GGNLFmYOI9KouhmbB3NzeJ5omhARPg-YVCPW7u1aCyhnGfOx9_Nj4VL8cMIxmO48nk_8UkfB9Pv7Q7tzZZb8nsq5y26giY9fXuVyRsn5qx8a1nSX8tKFWk1uo9ongL5V0MXY6sgU6eNUEzsxgyNFz_20QLVU20y9G7jRpmxoOcpQ1s1SJx0Tu2BBlRrI840-D-jUmg1ix7xDUfmXF_rPVp6e88rzIuCfbQO4otNq2fAsm4
info: Microsoft.AspNetCore.Authentication.MicrosoftAccount.MicrosoftAccountHandler[4]
      Error from RemoteAuthentication: OAuth token endpoint failure: Status: BadRequest;Headers: Cache-Control: no-cache, no-store
      Pragma: no-cache
      Strict-Transport-Security: max-age=31536000; includeSubDomains
      X-Content-Type-Options: nosniff
      x-ms-request-id: 759b3046-cbad-489d-98c1-6e83bb390b00
      P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
      Set-Cookie: fpc=AZFdz4kBW-ZHi5twlc6DCrARHQUSAQDQZKAdWIfWCA; expires=Sat, 02-Mar-2019 08:43:04 GMT; path=/; secure; HttpOnly, x-ms-gateway-slice=prod; path=/; secure; HttpOnly, stsservicecookie=ests; path=/; secure; HttpOnly
      Date: Thu, 31 Jan 2019 08:43:04 GMT
      ;Body: {"error":"unauthorized_client","error_description":"AADSTS700016: Application with identifier '000000005D256100' was not found in the directory '9188040d-6c67-4c5b-b112-36a304b66dad'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant\r\nTrace ID: 759b3046-cbad-489d-98c1-6e83bb390b00\r\nCorrelation ID: 858c340d-7c0c-4fa9-86c2-f8417e5915f1\r\nTimestamp: 2019-01-31 08:43:04Z","error_codes":[700016],"timestamp":"2019-01-31 08:43:04Z","trace_id":"759b3046-cbad-489d-98c1-6e83bb390b00","correlation_id":"858c340d-7c0c-4fa9-86c2-f8417e5915f1"};.
fail: Microsoft.AspNetCore.Server.Kestrel[13]
      Connection id "0HLK7ARJEPT98", Request id "0HLK7DAJEPT98:00000005": An unhandled exception was thrown by the application.
System.Exception: An error was encountered while handling the remote login. ---> System.Exception: OAuth token endpoint failure: Status: BadRequest;Headers: Cache-Control: no-cache, no-store
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
x-ms-request-id: 759b3046-cbad-489d-98c1-6e83bb390b00
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Set-Cookie: fpc=AZFdz4kBW-ZHi5twlc6DCrARHQUSAQDQZKAdWIfWCA; expires=Sat, 02-Mar-2019 08:43:04 GMT; path=/; secure; HttpOnly, x-ms-gateway-slice=prod; path=/; secure; HttpOnly, stsservicecookie=ests; path=/; secure; HttpOnly
Date: Thu, 31 Jan 2019 08:43:04 GMT
;Body: {"error":"unauthorized_client","error_description":"AADSTS700016: Application with identifier '000000005D256100' was not found in the directory '9188040d-6c67-4c5b-b112-36a304b66dad'. This can happen if the application has not been installed by the administrator of the tenant or consented to by any user in the tenant. You may have sent your authentication request to the wrong tenant\r\nTrace ID: 759b3046-cbad-489d-98c1-6e83bb390b00\r\nCorrelation ID: 858c340d-7c0c-4fa9-86c2-f8417e5915f1\r\nTimestamp: 2019-01-31 08:43:04Z","error_codes":[700016],"timestamp":"2019-01-31 08:43:04Z","trace_id":"759b3046-cbad-489d-98c1-6e83bb390b00","correlation_id":"858c340d-7c0c-4fa9-86c2-f8417e5915f1"};
   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
   at IdentityServer4.Hosting.FederatedSignOut.AuthenticationRequestHandlerWrapper.HandleRequestAsync() in C:\local\identity\server4\IdentityServer4\src\Hosting\FederatedSignOut\AuthenticationRequestHandlerWrapper.cs:line 38
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at IdentityServer4.Hosting.BaseUrlMiddleware.Invoke(HttpContext context) in C:\local\identity\server4\IdentityServer4\src\Hosting\BaseUrlMiddleware.cs:line 36
   at Microsoft.AspNetCore.Builder.RouterMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http.HttpProtocol.ProcessRequests[TContext](IHttpApplication`1 application)
info: Microsoft.AspNetCore.Hosting.Internal.WebHost[2]
      Request finished in 476.3734ms 500

我应该使用IdentityServer4的AddMicrosoftAccount实现吗？

Answer 1

感谢Jim＆Mackie向我指出正确的方向（我认为这是由于我这一边的自定义商店实施问题）

当我在https://apps.dev.microsoft.com/#/appList页面上确认自己具有正确的clientid和密码时，我注意到一个链接，该链接可转到azure门户来管理我的应用程序。（https://portal.azure.com/#blade/Microsoft_AAD_RegisteredApps/applicationsListBlade）当我转到该链接时，以前的应用程序没有显示，因此我创建了一个新应用程序并获得了一个新的ApplicationId（现在是GUID，而不是通过门户进入）。秘密，将其插入.AddMicrosoftAccount调用中，然后我可以通过Microsoft登录进行身份验证过程，并获得令牌以完成服务器上的身份验证。

我的猜测是，完成身份验证过程时，通过apps.dev.microsoft.com网站添加的某些应用程序不在Microsoft的后备存储中，这些应用程序可能在前端查询中，并允许身份验证页面以找到您的应用程序并提供同意页面，但是随后在发行令牌时，Microsoft端正在其他存储区中查找，而没有通过apps.dev.microsoft.com页面提供的ApplicationId查找该应用程序。因此，至少在我看来，解决方案是改为在azure门户中创建应用程序。

为什么使用Microsoft帐户外部登录名时在IdentityServer4日志中看到“无效的客户端”？

1 个答案: