Question

我使用IdentityServer4登录用户。客户端和身份服务器运行在.net core 2.2上。

我有以下环境：

dev-在Visual Studio中使用调试功能

localhost-在我的计算机上使用IIS

登台-Azure

生产-Azure

在每个环境中，身份服务器是单独的实例。

当我运行客户端（dev）时，使用身份（dev），可以。

当我运行客户端（localhost / IIS）时，使用身份（dev），它没有用。

当我运行客户端（localhost / IIS）时，使用身份（localhost / IIS），可以。

当我运行客户端（dev）时，使用身份（localhost / IIS），它没有用。

在天蓝色时，它确实可以在暂存和生产中使用。看来身份服务器和客户端必须在同一用户下运行。

这是日志中的错误：

warn: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[15]
      '.AspNetCore.Correlation.OpenIdConnect.oaZfttaJrS8SNFK1sUNQ6PBDZ_32jcnjc-kXY8Fk5Dk' cookie not found.
info: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[4]
      Error from RemoteAuthentication: Correlation failed..
fail: Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware[1]
      An unhandled exception has occurred while executing the request.
System.Exception: An error was encountered while handling the remote login. ---> System.Exception: Correlation failed.
   --- End of inner exception stack trace ---
   at Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler`1.HandleRequestAsync()
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Localization.RequestLocalizationMiddleware.Invoke(HttpContext context)
   at Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware.Invoke(HttpContext context)

这是我的客户入门课程：

 public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {
            var logger = LogManager.GetLogger(Assembly.GetEntryAssembly(),
                Assembly.GetExecutingAssembly().GetName().Name);
            services.AddSingleton(logger);

            JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

            logger.Info($"authority set to {Configuration["AuthorityUrl"]}");

            services.AddAuthentication(options =>
                {
                    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
                    options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                    options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                })
                .AddCookie()
                .AddOpenIdConnect(options => {
                    options.Authority = Configuration["AuthorityUrl"];
                    options.ClientId = Configuration["ClientId"];
                    options.ClientSecret = Configuration["ClientSecret"];
                    options.SaveTokens = true;
                    options.TokenValidationParameters.NameClaimType = "name";
                    options.RequireHttpsMetadata = false;
                });
            IdentityModelEventSource.ShowPII = true;

            services.AddMvc();

            services.AddLocalization(options => options.ResourcesPath = "Translations");

            services.AddMvc()
                .AddViewLocalization(LanguageViewLocationExpanderFormat.Suffix)
                .AddDataAnnotationsLocalization();

            services.Configure<RequestLocalizationOptions>(options =>
            {
                var supportedCultures = new List<CultureInfo>
                {
                    new CultureInfo("en-US"),
                    new CultureInfo("sk")
                };

                options.DefaultRequestCulture = new RequestCulture("sk");
                options.SupportedCultures = supportedCultures;
                options.SupportedUICultures = supportedCultures;
            });
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
        {
            var log4NetFile = Configuration["log4netConfigFile"];
            loggerFactory.AddLog4Net(log4NetFile);

            if (!env.IsProduction())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                app.UseHsts();
                app.UseHttpsRedirection();
            }

            var supportedCultures = new[]
            {
                //new CultureInfo("en-US"),
                new CultureInfo("sk"),
            };

            app.UseRequestLocalization(new RequestLocalizationOptions
            {
                DefaultRequestCulture = new RequestCulture("sk"),
                // Formatting numbers, dates, etc.
                SupportedCultures = supportedCultures,
                // UI strings that we have localized.
                SupportedUICultures = supportedCultures
            });

            app.UseStaticFiles();
            app.UseCookiePolicy();

            app.UseAuthentication();
            //app.UseHttpsRedirection();

            app.UseMvc(routes =>
            {
                routes.MapRoute(
                    name: "default",
                    template: "{controller=Home}/{action=Index}/{id?}");
            });

            app.UseRequestLocalization();
        }
    }

编辑： 我忘了提到我在Azure的Linux环境上运行Identity Server。我认为问题出在证书上。您知道我该如何验证吗？我正在从文件加载证书。

编辑2

此代码解决了我的问题。我不确定安全性，因此不会将其标记为答案。就像现在的修补程序一样。

services.Configure<CookiePolicyOptions>(options =>
        {
            // This lambda determines whether user consent for non-essential cookies is needed for a given request.
            options.CheckConsentNeeded = context => true;
            options.MinimumSameSitePolicy = SameSiteMode.None;
        });

Identity Server 4重定向流关联失败

0 个答案: