net.core / asp.net identity / openid connect

Question

我在 Azure AD 用户登录时收到此错误（我能够在之后获得用户的声明），我使用 OpenIdConnect 与 net.core 2.0 上的 asp.net Identity 核心的组合

处理请求时发生未处理的异常。例外：关联失败。Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler+d__12.MoveNext()

踪迹：

例外：关联失败。Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler+d__12.MoveNext() System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) System.Runtime.CompilerServices.TaskAwaiter.GetResult() Microsoft. AspNetCore.Authentication.AuthenticationMiddleware+d__6.MoveNext() System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware+d__7.MoveNext()

Answer 1

如果您针对本地主机使用 Chrome，您可能会遇到 Chrome cookie 处理行为的变化。要进行验证，请导航到 chrome://flags/ 并将“没有 SameSite 的 Cookies 必须是安全的”更改为“已禁用”。如果该更改修复了问题，并且您想永久修复它（即不依赖于 chrome 标志修复），则该 thinktecture 帖子将讨论潜在问题以及旧 iOS Safari 版本所需的一些修复。

Answer 2

我终于找到了解决方案，我会在这里发布以防万一有人遇到类似的问题。看起来主要问题是我的重定向 URI 与 CallBackPath 相同："CallbackPath": "/Account/SigninOidc"var authProperties = _signInManager .ConfigureExternalAuthenticationProperties("AzureAD", Url.Action("SigninOidc", "Account", null, Request.Scheme));好吧，这是我更正的 Startup.cs：using System;using System.Collections.Generic;using System.Linq;using System.Threading.Tasks;using BPT.PC.IdentityServer.Data;using BPT.PC.IdentityServer.IdentityStore;using BPT.PC.IdentityServer.Models;using BPT.PC.IdentityServer.Web.Models;using Microsoft.AspNetCore.Authentication;using Microsoft.AspNetCore.Authentication.Cookies;using Microsoft.AspNetCore.Authentication.OpenIdConnect;using Microsoft.AspNetCore.Builder;using Microsoft.AspNetCore.Hosting;using Microsoft.AspNetCore.Http;using Microsoft.AspNetCore.Identity;using Microsoft.EntityFrameworkCore;using Microsoft.Extensions.Configuration;using Microsoft.Extensions.DependencyInjection;using Microsoft.IdentityModel.Protocols.OpenIdConnect;namespace BPT.PC.IdentityServer.Web{&nbsp; &nbsp; public class Startup&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; public Startup(IConfiguration configuration)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Configuration = configuration;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; public IConfiguration Configuration { get; }&nbsp; &nbsp; &nbsp; &nbsp; // This method gets called by the runtime. Use this method to add services to the container.&nbsp; &nbsp; &nbsp; &nbsp; public void ConfigureServices(IServiceCollection services)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; services.AddIdentity<User, Role>()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .AddUserStore<UserStore>()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .AddRoleStore<RoleStore>()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .AddDefaultTokenProviders();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; services.AddMemoryCache();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; services.AddDistributedMemoryCache();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; services.AddDbContext<IdentityServerDb>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; (options => options.UseSqlServer(Configuration.GetConnectionString("IdentityServerDb")));&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; services&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .AddMvc();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; services&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .AddAuthentication(auth =>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; auth.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; auth.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; auth.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; })&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .AddCookie()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .AddOpenIdConnect("AzureAD", "AzureAD", options =>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Configuration.GetSection("AzureAD").Bind(options); ;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; options.ResponseType = OpenIdConnectResponseType.CodeIdToken;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; options.RemoteAuthenticationTimeout = TimeSpan.FromSeconds(120);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; options.RequireHttpsMetadata = false;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; options.SaveTokens = true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; });&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; services.AddSingleton(Configuration.GetSection("OpenIdConnectProviderConfiguration").Get<OpenIdConnectProviderConfiguration>());&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.&nbsp; &nbsp; &nbsp; &nbsp; public void Configure(IApplicationBuilder app, IHostingEnvironment env)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (env.IsDevelopment())&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; app.UseBrowserLink();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; app.UseDeveloperExceptionPage();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; app.UseExceptionHandler("/Home/Error");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; app.UseStaticFiles();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; app.UseAuthentication();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; app.UseMvc(routes =>&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; routes.MapRoute(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; name: "default",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; template: "{controller=Account}/{action=Login}/{id?}");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; });&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}最后的实现：[HttpGet]public IActionResult CorpLogin()&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; var authProperties = _signInManager&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; .ConfigureExternalAuthenticationProperties("AzureAD",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Url.Action("LoggingIn", "Account", null, Request.Scheme));&nbsp; &nbsp; &nbsp; &nbsp; return Challenge(authProperties, "AzureAD");&nbsp; &nbsp; }appsettings.json 是相同的。

Answer 3

仅供参考：我遇到了同样的问题，我花了将近 1 天的时间来调查这个问题。最后我发现从我的 startup.cs 中删除以下代码后，一切正常：&nbsp;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CookiePolicyOptions cookiePolicy = new CookiePolicyOptions()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Secure = CookieSecurePolicy.Always,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; };我正在与 Microsoft 支持团队跟进此事，如果得到任何回应，我会将其更新回来。