Microsoft.Identity.Web OpenIdConnect 未通过身份验证。失败消息：未通过身份验证

Question

在过去的几年里，我的应用程序一直在使用 Microsoft.Identity，但发生了一些变化，导致用户必须清除缓存才能进行身份验证。我已经验证了回复 url、租户 ID、客户端 ID 和客户端密码，它们都没有更改并且设置正确。我更新到最新的 nuget 包。清除浏览器缓存后，身份验证工作完美。这可能是什么原因造成的？

public void ConfigureServices(IServiceCollection services)
{
    services.Configure<CookiePolicyOptions>(options =>
    {
        options.CheckConsentNeeded = context => false;
        options.MinimumSameSitePolicy = SameSiteMode.Unspecified;
        options.HandleSameSiteCookieCompatibility();
    });

    services.AddMicrosoftIdentityWebAppAuthentication(Configuration, "AzureAd");
    //services.AddSignIn(Configuration);
    // Token acquisition service based on MSAL.NET 

    app.UseHttpsRedirection();
    app.UseStaticFiles();
    app.UseCookiePolicy();
    app.UseRouting();
    app.UseCors(MyAllowSpecificOrigins);
    app.UseAuthentication();
    app.UseSession();
    app.UseMiddleware<UserClaims>();
    app.UseAuthorization();

Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request starting HTTP/2.0 POST https://localhost:44326/signin-oidc application/x-www-form-urlencoded 3217
Microsoft.AspNetCore.Cors.Infrastructure.CorsService: Information: CORS policy execution successful.
Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationHandler: Information: AuthenticationScheme: Cookies signed in.
Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request finished in 626.0063ms 302 
Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request starting HTTP/2.0 GET https://localhost:44326/  
Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler: Information: OpenIdConnect was not authenticated. Failure message: Not authenticated
Microsoft.AspNetCore.Authorization.DefaultAuthorizationService: Information: Authorization failed.
Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler: Information: AuthenticationScheme: OpenIdConnect was challenged.
Microsoft.AspNetCore.Hosting.Diagnostics: Information: Request finished in 225.1113ms 302

Answer 1

请确保添加身份验证中间件，以便 app.UseAuthentication();在 app.UseMvc(); 之前出现

app.UseAuthentication();
app.UseAuthorization();

注意 AddMicrosoftIdentityWebApp 正在使用自己的 cookie (auth) 提供程序 而是使用现有的（可能在升级后）。

通过将cookiescheme设为null来尝试使用

services.AddAuthentication() .AddMicrosoftIdentityWebApp(Configuration,"AzureAd", "AzureAD", cookieScheme: null);

或 尝试明确添加方案，以便方案能够处理 401 等挑战错误的异常。

为此，您可能需要调用 AddAuthentication() 并配置默认质询方案，例如 this。

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"))

注意： AddAuthentication() 方法实际上将服务配置为添加基于 cookie 的身份验证。此 cookie 用于浏览器场景，也用于将质询设置为 OpenID Connect。

并注册 Microsoft Identity 路由，最少调用一次 endpoints.MapControllerRoute() 或调用 endpoints.MapControllers()。

或

services.Configure<CookiePolicyOptions>(options =>
    {
        options.CheckConsentNeeded = context => true;
        options.MinimumSameSitePolicy = SameSiteMode.None;
    });

services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
    .AddAzureAD(options => Configuration.Bind("AzureAd", options));

services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =>
    {
        options.Authority = options.Authority + "/v2.0/";
        options.TokenValidationParameters.ValidateIssuer = false;
    });

请查看microsoft-identity-web issues in github

参考资料：

1. aspnetcore-webapp-openidconnect-v2 (github.com)
2. asp.net mvc - IdentityServer4 - Stack Overflow
3. Stack Overflow reference