OpenIDConnectAuthentication 不适用于 Azure Active Directory 中的某些用户

Question

我在 azure K100User 和 K100Admin 中有两个 AD 组。下面的代码运行良好，但此代码不适用于超过 200 个 AD 组的用户。

private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
private static string aadInstance = EnsureTrailingSlash(ConfigurationManager.AppSettings["ida:AADInstance"]);
private static string tenantId = ConfigurationManager.AppSettings["ida:TenantId"];
private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];
private static string authority = aadInstance + tenantId;
private static string k100User = ConfigurationManager.AppSettings["K100User"];
private static string k100Admin = ConfigurationManager.AppSettings["K100Admin"];

public void ConfigureAuth(IAppBuilder app)
{
    ClaimsIdentity claimsIdentity1 = ClaimsPrincipal.Current.Identity as ClaimsIdentity;
    app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
    app.UseCookieAuthentication(new CookieAuthenticationOptions());
    app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
    {
        ClientId = clientId,
        Authority = authority,
        PostLogoutRedirectUri = postLogoutRedirectUri,
        TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters
        {
            ValidateIssuer = true
        },
        Notifications = new OpenIdConnectAuthenticationNotifications
        {
            SecurityTokenValidated = (ctx) =>
            {
                ClaimsIdentity claimsIdentity = ClaimsPrincipal.Current.Identity as ClaimsIdentity;
                var claims = ctx.AuthenticationTicket.Identity.FindAll("groups");
                var appRoles = new List<Claim>();
                foreach (var item in claims)
                {
                    var groupStringValue = item.Value;
                    if (groupStringValue == k100Admin)
                    {
                        appRoles.Add(new Claim(ClaimTypes.Role, "K100Admin", ClaimValueTypes.String));
                    }
                    else if (groupStringValue == k100User)
                    {
                        appRoles.Add(new Claim(ClaimTypes.Role, "K100User", ClaimValueTypes.String));
                    }

                }
                if (appRoles.Count > 0)
                {
                    ctx.AuthenticationTicket.Identity.AddClaim(appRoles[0]);
                }
                return Task.FromResult(0);
            }
        }
    });
}

Answer 1

看看Groups overage claim：

在您的场景中，用户是 200 多个组的成员，因此您需要检查声明 _claim_names，其中一个值为组。如果找到，请调用_claim_sources 中指定的端点以获取用户组。

您也可以选择直接调用 Microsoft Graph List memberOf 获取群组。

一个类似的thread供你参考。