Azure Active Directory-身份验证单一租户

Question

我正在尝试为我的Web应用程序配置Azure AD单一租户身份验证。我遵循了.NET的快速入门指南，但是我注意到我实际上可以使用任何Microsoft Office 365帐户登录我的应用程序，而不是只按我的租户身份登录。

有人可以指出我的错误吗？我希望它拒绝不在我的租户（@ mydomain.com电子邮件地址）中的登录名

Startup.cs

public class Startup
    {
        // The Client ID (a.k.a. Application ID) is used by the application to uniquely identify itself to Azure AD
        string clientId = System.Configuration.ConfigurationManager.AppSettings["ClientId"];

        // RedirectUri is the URL where the user will be redirected to after they sign in
        string redirectUrl = System.Configuration.ConfigurationManager.AppSettings["redirectUrl"];

        // Tenant is the tenant ID (e.g. contoso.onmicrosoft.com, or 'common' for multi-tenant)
        static readonly string tenant = System.Configuration.ConfigurationManager.AppSettings["Tenant"];

        // Authority is the URL for authority, composed by Azure Active Directory endpoint and the tenant name (e.g. https://login.microsoftonline.com/contoso.onmicrosoft.com)
        string authority = String.Format(System.Globalization.CultureInfo.InvariantCulture, System.Configuration.ConfigurationManager.AppSettings["Authority"], tenant);

        /// <summary>
        /// Configure OWIN to use OpenIdConnect 
        /// </summary>
        /// <param name="app"></param>
        /// 


        public void Configuration(IAppBuilder app)
        {
            app.UseKentorOwinCookieSaver();
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions {
                CookieName = "My Workspace",
                AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
                AuthenticationMode = AuthenticationMode.Active,
                CookieSecure = CookieSecureOption.Always,
                CookieManager = new SystemWebChunkingCookieManager(),
                CookieDomain = "mydomain.com",
                ExpireTimeSpan = new TimeSpan(4, 0, 0),
                SlidingExpiration = true
            });            
            app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {
                    // Sets the ClientId, authority, RedirectUri as obtained from web.config - as well as UseTokenLifetime
                    ClientId = clientId,
                    Authority = authority,
                    RedirectUri = redirectUrl,
                    UseTokenLifetime = false,                    

                    // PostLogoutRedirectUri is the page that users will be redirected to after sign-out. In this case, it is using the home page
                    PostLogoutRedirectUri = redirectUrl,

                    //Scope is the requested scope: OpenIdConnectScopes.OpenIdProfileis equivalent to the string 'openid profile': in the consent screen, this will result in 'Sign you in and read your profile'
                    Scope = OpenIdConnectScope.OpenIdProfile,

                    // ResponseType is set to request the id_token - which contains basic information about the signed-in user
                    ResponseType = OpenIdConnectResponseType.IdToken,                               

                    // ValidateIssuer set to false to allow work accounts from any organization to sign in to your application
                    // To only allow users from a single organizations, set ValidateIssuer to true and 'tenant' setting in web.config to the tenant name or Id (example: contoso.onmicrosoft.com)
                    // To allow users from only a list of specific organizations, set ValidateIssuer to true and use ValidIssuers parameter
                    TokenValidationParameters = new TokenValidationParameters()
                        {

                            ValidateIssuer = true,
                            ValidIssuers = new List<string>() {
                                "https://login.microsoftonline.com/my-client(application)-id-is-here"
                            }
                        },

                    // OpenIdConnectAuthenticationNotifications configures OWIN to send notification of failed authentications to OnAuthenticationFailed method
                    Notifications = new OpenIdConnectAuthenticationNotifications
                        {
                            AuthenticationFailed = OnAuthenticationFailed
                        }
                }
             );            
        }

        /// <summary>
        /// Handle failed authentication requests by redirecting the user to the home page with an error in the query string
        /// </summary>
        /// <param name="context"></param>
        /// <returns></returns>
        private Task OnAuthenticationFailed(AuthenticationFailedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> context)
        {
            if (context.Exception.Message.Contains("IDE21323")) {
                context.HandleResponse();
                context.OwinContext.Authentication.Challenge();
            } else {
                context.HandleResponse();
                context.Response.Redirect("/?errormessage=" + context.Exception.Message);
            }
            return Task.FromResult(0);            
        }

HomeController.cs中的我的SignIn / SignOut方法

 public void SignIn()
        {
            if (!Request.IsAuthenticated)
            {
                HttpContext.GetOwinContext().Authentication.Challenge(
                    new AuthenticationProperties { RedirectUri = "/" },
                    OpenIdConnectAuthenticationDefaults.AuthenticationType);
            }            
        }

        /// <summary>
        /// Send an OpenID Connect sign-out request.
        /// </summary>
        public void SignOut()
        {
            HttpContext.GetOwinContext().Authentication.SignOut(
                OpenIdConnectAuthenticationDefaults.AuthenticationType,
                CookieAuthenticationDefaults.AuthenticationType);
        }

我希望我的应用程序仅允许从活动目录（而不是任何office365帐户）登录。我还希望它能够检测用户是否已经在该计算机上拥有用于另一个帐户的cookie，并且像Microsoft那样在用户显示消息时说明“ ...您当前登录的帐户无权访问此应用程序。”

此外，在Azure门户内部，在Active Directory应用程序中我的应用程序下，我为“谁可以使用此应用程序或api”选项选择了“仅此组织目录中的帐户（mydomain.com）”。

Web.config

我的web.config中有以下键

<add key="ClientId" value="MY CLIENT ID FROM AZURE AD APP" />
<add key="Tenant" value="MY TENANT ID FROM AZURE AD APP" />    
<add key="Authority" value="https://login.microsoftonline.com/{0}/v2.0" />

我在做什么错了？

更新

尽管该应用程序仍允许从任何Office 365帐户登录，但我已经能够向IssuerValidator的{​​{1}}属性添加其他代码。我没有在JWT上检查期望的正确TID和IDP值。奇怪，即使我使用不在Active Directory中的帐户登录，TID也是一样的-但是，当使用“有效”帐户进行身份验证时，IDP值会显示在不存在的位置。