如何使用子域将客户端 ID 委托给 Azure B2C 进行身份验证

Question

我正在尝试建立一个 dot net core 2.2 Web 应用程序，该应用程序将使用子域来确定我应该使用什么客户端 ID 来对 Azure B2C 中的用户进行身份验证。我有一个正在调用的 API，它将为子域提供客户端 ID。

是否可以在运行时换出客户端 ID，还是必须在启动时进行配置？

Startup.cs

services.AddAuthentication(sharedOptions =>
{
    sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    sharedOptions.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddAzureAdB2C(options => Configuration.Bind("Authentication:AzureAdB2C", options))
.AddCookie();

OnRedirectToIdentityProvider 事件

public async Task OnRedirectToIdentityProvider(RedirectContext context)
{
    var defaultClientId = AzureAdB2COptions.ClientId;

    var fullAddress = context.HttpContext?.Request?.Headers?["Host"].ToString()?.Split(':');
    var subdomain = fullAddress[0];
    var tenant = await _api.GetConfig(subdomain);

    if (tenant != null &&
        !tenant.ClientId.Equals(defaultClientId))
    {
       context.Options.ClientId = tenant.ClientId;
    }

    var defaultPolicy = AzureAdB2COptions.DefaultPolicy;
    if (context.Properties.Items.TryGetValue(AzureAdB2COptions.PolicyAuthenticationProperty,
            out var policy) &&
        !policy.Equals(defaultPolicy))
    {
        context.ProtocolMessage.Scope = AzureAdB2COptions.ApiScopes;
        context.ProtocolMessage.ResponseType = OpenIdConnectResponseType.IdToken;
        context.ProtocolMessage.IssuerAddress = context.ProtocolMessage.IssuerAddress
            .ToLower().Replace(defaultPolicy.ToLower(), policy.ToLower());
        context.Properties.Items.Remove(AzureAdB2COptions.PolicyAuthenticationProperty);
    }
    else
    {
        context.ProtocolMessage.Scope = AzureAdB2COptions.ApiScopes;
    }

    return;
}

当应用程序加载时，初始配置有效：client1.domain.com 映射到启动时配置的客户端 ID，并且登录正常。如果我更改子域，我会在 OnRedirectToIdentityProvider 事件中换出客户端 ID，但会返回 IDX10214: Audience validation failed error。

Answer 1

这很糟糕，但我必须在我的 open-id 配置中的令牌验证参数上指定有效的受众。

public void Configure(string name, OpenIdConnectOptions options)
{
    options.ClientId = AzureAdB2COptions.ClientId;
    options.Authority = AzureAdB2COptions.Authority;
    options.UseTokenLifetime = true;
    options.TokenValidationParameters = new TokenValidationParameters()
    {
        NameClaimType = "name",
        ValidAudiences = new[] { "clientid1", "clientid2", "etca" }
    };

    options.Events = new OpenIdConnectEvents()
    {
        OnRedirectToIdentityProvider = OnRedirectToIdentityProvider,
        OnRemoteFailure = OnRemoteFailure,
        OnAuthorizationCodeReceived = OnAuthorizationCodeReceived
    };
}