.NET 5 Blazor 服务器 OKTA 身份验证显示 HTTP 错误 400

Question

将 ASP.NET Core (.NET 5) Blazor 服务器与 OKTA 结合使用。 OKTA 日志页面已提示。我在提交 OKTA uid/pwd 时收到错误消息

HTTP Error 400. The size of the request headers is too long.

我的中间件如下所示，使用 OpenId Connect。

services.AddAuthentication(options =>
                           {
                                  options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                                  options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
                                  options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                           })
                           .AddOpenIdConnect(options =>
                           {
                                  options.RemoteAuthenticationTimeout = TimeSpan.FromMinutes(30);
                                  options.AuthenticationMethod = OpenIdConnectRedirectBehavior.RedirectGet;
                                  options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                                  options.Authority = configuration["Okta:Domain"] + "/oauth2/default";
                                  options.RequireHttpsMetadata = true;
                                  options.ClientId = configuration["Okta:ClientId"];
                                  options.ClientSecret = configuration["Okta:ClientSecret"];
                                  options.ResponseMode = OpenIdConnectResponseMode.FormPost;
                                  options.ResponseType = OpenIdConnectResponseType.Code;
                                  options.Scope.Add("offline_access");
                                  options.UseTokenLifetime = true;
                                  options.GetClaimsFromUserInfoEndpoint = true;
                                  options.AccessDeniedPath = "/Public/AccessDenied";
                                  options.Scope.Add("openid");
                                  options.Scope.Add("profile");
                                  options.Scope.Add("email");

                                  // Describe how to map the user info we receive to user claims
                                  options.ClaimActions.MapJsonKey(ClaimTypes.NameIdentifier, "sub", "string");
                                  options.ClaimActions.MapJsonKey(ClaimTypes.GivenName, "given_name", "string");
                                  options.ClaimActions.MapJsonKey(ClaimTypes.Name, "given_name", "string");
                                  options.ClaimActions.MapJsonKey("LastName", "lastname", "string");
                                  options.ClaimActions.MapJsonKey("FirstName", "firstname", "string");
                                  options.ClaimActions.MapJsonKey(ClaimTypes.Email, "email", "string");
                                  options.ClaimActions.MapJsonKey("Groups", "Groups", "string");
                                  options.ClaimActions.MapJsonKey("membership_roles", "membership_roles", "string");

                                  options.SaveTokens = true;
                                  options.NonceCookie.SameSite = SameSiteMode.Unspecified;
                                  options.CorrelationCookie.SameSite = SameSiteMode.Unspecified;

                                  options.TokenValidationParameters = new TokenValidationParameters
                                  {
                                         NameClaimType = "name",
                                         RoleClaimType = "groups",
                                         RequireSignedTokens = true,
                                         ValidateIssuer = false
                                  };
                           })
                           .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, displayName: $"EPDOne_{GlobalVariables.LocalEnv.EnvironmentName}",
                        options =>
                        {

                              options.Cookie.Name = $"EPDOne_{ GlobalVariables.LocalEnv.EnvironmentName}";
                              options.Cookie.HttpOnly = false;
                               options.Cookie.SecurePolicy = CookieSecurePolicy.SameAsRequest;
                              options.Cookie.IsEssential = true;


                              options.Events = new CookieAuthenticationEvents
                              {
                                     // this event is fired everytime the cookie has been validated by the cookie middleware,
                                     // so basically during every authenticated request
                                     // the decryption of the cookie has already happened so we have access to the user claims
                                     // and cookie properties - expiration, etc..
                                     OnValidatePrincipal = context =>
                                     {
                                            // since our cookie lifetime is based on the access token one,
                                            // check if we're more than halfway of the cookie lifetime

                                            var now = DateTimeOffset.UtcNow;
                                            TimeSpan timeElapsed = now.Subtract(DateTime.Now.AddDays(1));
                                            TimeSpan timeRemaining = now.Subtract(DateTime.Now.AddDays(2));
                                            if (context is not null)
                                            {
                                                   if (context.Properties is not null && context.Properties.IssuedUtc is not null)
                                                   {
                                                          timeElapsed = now.Subtract(context.Properties.IssuedUtc.Value);
                                                   }
                                                   else
                                                   {
                                                          context.ShouldRenew = true;
                                                   }
                                                   if (context.Properties is not null && context.Properties.ExpiresUtc is not null)
                                                   {
                                                          timeRemaining = context.Properties.ExpiresUtc.Value.Subtract(now);
                                                   }
                                                   else
                                                   {
                                                          context.ShouldRenew = true;
                                                   }
                                            }


                                            if (timeElapsed > timeRemaining || context?.ShouldRenew == true)
                                            {
                                                   context.ShouldRenew = true;

                                                   var identity = (ClaimsIdentity)context?.Principal?.Identity;
                                                   if (identity is not null && identity.IsAuthenticated)
                                                   {
                                                          string CurrentBaseAddress = CurrentURL(context.HttpContext);
                                                          string returnUrl = "";
                                                          if (string.IsNullOrEmpty(CurrentBaseAddress) == false)
                                                          {
                                                                 returnUrl = "?returnUrl=" + CurrentBaseAddress;
                                                          }
                                                          context.Response.Redirect(GlobalVariables.OKTACallBackURI + $"/refresh{returnUrl}");
                                                   }
                                            }

                                            return Task.CompletedTask;
                                     }
                              };
                        });


                           services.AddRazorPages(options =>
                           {
                                  options.Conventions.AuthorizeFolder("/");
                                  //options.Conventions.AllowAnonymousToFolder("/Public");
                           }
                           );

正如您在上面看到的，我在 Startup.cs 中使用了 OpenId，应用程序通过 OKTA 凭据对话框进行提示，在提交 uid/pwd 后，页面的行为就像在循环中，然后显示 HTTP 错误 400 消息。这里有什么线索吗？

Answer 1

Philipp Grigoryev - 感谢您的宝贵时间。我后来在我的 .NET Core Startup.cs 文件中发现了下面的代码。

app.UseAuthorization();

app.UseAuthorization();

正确的行应该是

app.UseAuthentication();
app.UseAuthorization();

所以实际上身份验证中间件本身没有启用，我匆忙使用了两行启用授权本身。在提到的更正之后，它可以工作。对不起任何花时间在这上面的人。我正在关闭此查询。