Azure Active Directory 中 AuthenticationMode 为 Passive 时如何获取/设置 userIdentity

Question

我已将 AuthenticationMode 设置为被动并使用显式质询重定向到 azure 登录页面。

这很好用，但我需要一种编程方式来确定用户是否经过身份验证。我也想使用用户名，但在 HttpContext.User.Identity.IsAuthenticated 中不可用。

请告诉我从哪里可以得到这些信息？

        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                AuthenticationType="a",
                AuthenticationMode = AuthenticationMode.Passive,
                MetadataAddress = String.Format(aadInstance2, tenant2, SignUpSignInPolicyId),
                ClientId = clientId2,
                RedirectUri = redirectUri2,
                PostLogoutRedirectUri = postLogoutRedirectUri,
                CallbackPath= new PathString("/Home/index"),
            });

        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                AuthenticationType = "b",
                AuthenticationMode = AuthenticationMode.Passive,
                ClientId = clientId,
                Authority = authority,
                PostLogoutRedirectUri = postLogoutRedirectUri,
                CallbackPath = new PathString("/Home/contact"),
            });


    public void Redirect1()
    {
        HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties { RedirectUri = "/" }, "b");
    }

    public void Redirect2()
    {
        HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties { RedirectUri = "/" }, "a");
    }

Answer 1

此问题不是由AuthenticationMode 引起的，您不应指定CallbackPath。如果设置此参数，则 Microsoft.Owin.Security.OpenIdConnect.OpenIdConnectAuthenticationHandler 将仅侦听此地址的帖子。因此，您无法成功处理来自 Azure AD 的重定向。

这里是使用多个OpenId连接OWIN cmets的代码供大家参考：

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    ClientId = clientId,
    Authority = authority,
    AuthenticationType = "aad1",
    RedirectUri = "http://localhost:2803/",
    AuthenticationMode = AuthenticationMode.Passive,
    PostLogoutRedirectUri= "http://localhost:2803/"
});

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    ClientId = "5efa8abc-13dc-4681-83f5-c6fde071xxxx",
    Authority = authority2,
    AuthenticationType = "aad2",
    RedirectUri = "http://localhost:2803/",
    AuthenticationMode = AuthenticationMode.Passive,
    PostLogoutRedirectUri= "http://localhost:2803/"
});

然后我们可以使用HttpContext.User.Identity.IsAuthenticated检查用户是否登录。

更新

AccountController.cs：

public class AccountController : Controller
{
    public void SignIn(string provider,string ReturnUrl = "/default")
    {
        // Send an OpenID Connect sign-in request.
        if (!Request.IsAuthenticated)
        {
            HttpContext.GetOwinContext().Authentication.Challenge(new AuthenticationProperties { RedirectUri = ReturnUrl }, provider);
            HttpContext.Response.Cookies["provider"].Value = provider;
        }
    }
    public void SignOut()
    {
        var provider = HttpContext.Request.Cookies["provider"].Value;
        Request.Cookies.Clear();
        HttpContext.GetOwinContext().Authentication.SignOut(
            provider, CookieAuthenticationDefaults.AuthenticationType);

    }

    public void EndSession()
    {
        // If AAD sends a single sign-out message to the app, end the user's session, but don't redirect to AAD for sign out.
        HttpContext.GetOwinContext().Authentication.SignOut(CookieAuthenticationDefaults.AuthenticationType);
    }
}

登录页面上的登录按钮：

    <input type="button" value="AzureAD-aad1" onclick="location.href='@Url.Action("SignIn", "Account",new { provider="aad1"} )'" />
    <input type="button" value="AzureAD-aad2" onclick="location.href='@Url.Action("SignIn", "Account",new { provider="aad2"} )'" />

这是使用 Fiddler 捕获请求的图：