如果身份服务器发现文档无法访问，则处理错误

Question

我有一个使用两种身份验证方案的 .NET 核心 WebAPI，第一个是 AAD，第二个是 identityserver4

    services.AddAuthentication(authOptions =>
    {
        authOptions.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        authOptions.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
        authOptions.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    })
    .AddJwtBearer()//configured below for id4
    .AddAzureADBearer(options => Configuration.Bind("AzureAd", options)); 
    //AAD options
    services.Configure<JwtBearerOptions>(
        AzureADDefaults.JwtBearerAuthenticationScheme, options =>
        {
            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
            };
        });

    //id4 options
    services.Configure<JwtBearerOptions>(
        JwtBearerDefaults.AuthenticationScheme, options =>
        {

            options.Authority = "https://****/identity";
            options.Audience = Constants.Audience;
            options.MetadataAddress = "https://****/identity/.well-known/openid-configuration";

            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = true,
                ValidateLifetime = true,
                ClockSkew = TimeSpan.Zero
            };
        });


    services.AddAuthorization(options =>
    {
        options.DefaultPolicy = new AuthorizationPolicyBuilder()
            .RequireAuthenticatedUser()
            .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme,AzureADDefaults.BearerAuthenticationScheme) //added both
            .Build();
    });

我目前在我的 startup.cs 中使用此配置，当 identityserver4 主机关闭时，我无法授权 Azure Active Directory 发出的令牌（整个令牌验证失败）&这是我在日志中看到的

System.InvalidOperationException: IDX20803: Unable to obtain configuration from: 'https://****/identity/.well-known/openid-configuration'.
 ---> System.IO.IOException: IDX20804: Unable to retrieve document from: 'https://****/identity/.well-known/openid-configuration'.
 ---> System.Net.Http.HttpRequestException: nodename nor servname provided, or not known
 ---> System.Net.Sockets.SocketException (0xFFFDFFFF): nodename nor servname provided, or not known
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   --- End of inner exception stack trace ---
   at System.Net.Http.ConnectHelper.ConnectAsync(String host, Int32 port, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.ConnectAsync(HttpRequestMessage request, Boolean allowHttp2, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.CreateHttp11ConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.GetHttpConnectionAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpConnectionPool.SendWithRetryAsync(HttpRequestMessage request, Boolean doRequestAuth, CancellationToken cancellationToken)
   at System.Net.Http.RedirectHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.DiagnosticsHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   --- End of inner exception stack trace ---
   at Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(String address, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.OpenIdConnect.OpenIdConnectConfigurationRetriever.GetAsync(String address, IDocumentRetriever retriever, CancellationToken cancel)
   at Microsoft.IdentityModel.Protocols.ConfigurationManager`1.GetConfigurationAsync(CancellationToken cancel)

如何处理此类异常，我看到一个问题here，但我认为会有解决方法。

Answer 1

首先，AddJWtBearer，如果在第一个令牌到达时无法到达发现端点，则会抱怨。我在我的系统中实现的一个选项是添加一个中间件，该中间件阻止传入的请求到达它，直到它可以确保 IdentityServer 是可访问的。实现起来并不难。

它可能看起来像这样：

如果 AddJwtBearer（通过 ConfigurationManager）之后无法到达发现端点，它将重用现有配置。默认情况下，它将每 24 小时刷新一次。如果失败，则重试周期为 30 秒。

或者，如果该中间件无法访问 IdentitySerer，则可以直接从请求中“删除”不记名令牌。这样请求就不会触发 AddJwtBearer。

或者，您可以从 GitHub 下载 AddJwtBearer 的源代码，然后手动修补身份验证方法。..