使用IdentityServer3进行Azure AD身份验证的本地帐户和选项

我是IdentityServer的新手。我们要求应用程序允许访问多个Web API。截至目前，身份验证是通过数据库在本地完成的，并且有另一种方式可以通过Azure AD进行身份验证。使用IdentityServer3进行Azure AD身份验证的本地帐户和选项

我希望我的仪表板应用程序使用IdentityServer3进行身份验证（目前工作正常），或者使用外部提供程序（本例中为Azure AD）。

不过，我不断收到

有一个错误决定你登录到哪个应用程序。返回到应用程序，然后再试一次

对服务器的配置，我使用CustomViewService found at here

我加入Azure的AD给外部供应商的名单：

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions 
{ 

    ClientId = "xxxxxx-xxx-xxx-xx-04ec8dbxxxx", 
    Authority = "https://login.windows.net/[domain name]", 
    RedirectUri = "https://localhost:44333/core", 
    PostLogoutRedirectUri = "http://localhost:36336/", 
    AuthenticationType = "Azure AD", 
    Caption = "Azure AD", 
    TokenValidationParameters = new TokenValidationParameters 
    { 
    NameClaimType = "name", 
    RoleClaimType = "role" 
    }, 
    SignInAsAuthenticationType = "Cookies", 

    Notifications = new OpenIdConnectAuthenticationNotifications 
    { 
    MessageReceived = m => 
    { 
     var split = m.ProtocolMessage.AccessToken; 
     return Task.FromResult(0); 
    }, 
    AuthenticationFailed = context => 
    { 
     context.HandleResponse(); 
     context.Response.Redirect("/Error?message=" + context.Exception.Message); 
     return Task.FromResult(0); 
    }, 
    RedirectToIdentityProvider = (context) => 
    { 
     context.ProtocolMessage.DomainHint = "[domain name here]"; 
     return Task.FromResult(0); 
    } 
    } 
});

我m出现在Azure AD登录屏幕中，之后应用程序被转回到IdentityServ3的https://localhost:44333/core/callback

我的客户端在http://localhost:36336/

客户端配置为：

public void Configuration(IAppBuilder app) 
{ 
    // For more information on how to configure your application, visit http://go.microsoft.com/fwlink/?LinkID=316888 
    JwtSecurityTokenHandler.InboundClaimTypeMap = new Dictionary<string, string>(); 

    app.UseCookieAuthentication(new CookieAuthenticationOptions 
    { 
    AuthenticationType = "Cookies" 
    }); 

    app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions 
    { 
    ClientId = "mvc.owin.hybrid.2", 
    Authority = "https://localhost:44333/core", 
    RedirectUri = "http://localhost:36336/", 
    PostLogoutRedirectUri = "http://localhost:36336/", 
    ResponseType = "code id_token", 
    Scope = "openid profile read write offline_access", 

    TokenValidationParameters = new TokenValidationParameters 
    { 
     NameClaimType = "name", 
     RoleClaimType = "role" 
    }, 

    SignInAsAuthenticationType = "Cookies", 

    Notifications = new OpenIdConnectAuthenticationNotifications 
    { 
     AuthorizationCodeReceived = async n => 
     { 
     // use the code to get the access and refresh token 
     var tokenClient = new TokenClient(
     "https://localhost:44333/core/connect/token", 
     "mvc.owin.hybrid.2", 
     "secret"); 

     var tokenResponse = await tokenClient.RequestAuthorizationCodeAsync(
     n.Code, n.RedirectUri); 

     if (tokenResponse.IsError) 
     { 
      throw new Exception(tokenResponse.Error); 
     } 

     // use the access token to retrieve claims from userinfo 
     var userInfoClient = new UserInfoClient(
     new Uri(n.Options.Authority + "/connect/userinfo"), 
     tokenResponse.AccessToken); 

     var userInfoResponse = await userInfoClient.GetAsync(); 

     // create new identity 
     var id = new ClaimsIdentity(n.AuthenticationTicket.Identity.AuthenticationType); 
     id.AddClaims(userInfoResponse.GetClaimsIdentity().Claims); 

     id.AddClaim(new Claim("access_token", tokenResponse.AccessToken)); 
     id.AddClaim(new Claim("expires_at", DateTime.Now.AddSeconds(tokenResponse.ExpiresIn).ToLocalTime().ToString())); 
     id.AddClaim(new Claim("refresh_token", tokenResponse.RefreshToken)); 
     id.AddClaim(new Claim("id_token", n.ProtocolMessage.IdToken)); 
     id.AddClaim(new Claim("sid", n.AuthenticationTicket.Identity.FindFirst("sid").Value)); 

     n.AuthenticationTicket = new AuthenticationTicket(
     new ClaimsIdentity(id.Claims, n.AuthenticationTicket.Identity.AuthenticationType, "name", "role"), 
     n.AuthenticationTicket.Properties); 
     }, 

     RedirectToIdentityProvider = n => 
     { 
     // if signing out, add the id_token_hint 
     if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.LogoutRequest) 
     { 
      var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token"); 

      if (idTokenHint != null) 
      { 
      n.ProtocolMessage.IdTokenHint = idTokenHint.Value; 
      } 
     } 

     return Task.FromResult(0); 
     } 
    } 
    }); 
}

来源

2017-09-14 siddhant Kumar

你可以做一个提琴手跟踪或使用开发工具（ F12）查看Azure AD是如何响应IdentityServer的？ Azure AD发送令牌还是错误消息？ – Saca

azure广告工作正常，我检查了天青abt用户身份验证日志 –

管理去解决它。

我忘了执行AspNetIdentityUserService特别的方法AuthenticateExternalAsync

有一次，我映射到用户并要求于天青它工作的本地用户。

此外，如果你需要隐藏本地登录屏幕，想你的客户直接到Azure的AD登录屏幕一定要设置EnableLocalLogin为false客户端性能

来源

2017-10-03 12:16:10

使用IdentityServer3进行Azure AD身份验证的本地帐户和选项

回答

相关问题