我在 Azure AD 用户登录时收到此错误(之后我能够获得用户的声明),我正在使用 OpenIdConnect 的组合,以及 net.core 2.0 上的 asp.net Identity core
An unhandled exception occurred while processing the request. Exception: Correlation failed. Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler+d__12.MoveNext()
痕迹:
Exception: Correlation failed. Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler+d__12.MoveNext() System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) System.Runtime.CompilerServices.TaskAwaiter.GetResult() Microsoft.AspNetCore.Authentication.AuthenticationMiddleware+d__6.MoveNext() System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) Microsoft.AspNetCore.Diagnostics.DeveloperExceptionPageMiddleware+d__7.MoveNext()
这是我的 Startup.cs:
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;
using BPT.PC.IdentityServer.Data;
using BPT.PC.IdentityServer.IdentityStore;
using BPT.PC.IdentityServer.Models;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Identity;
using Microsoft.EntityFrameworkCore;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
namespace BPT.PC.IdentityServer.Web
{
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
services.AddIdentity<User, Role>()
.AddUserStore<UserStore>()
.AddRoleStore<RoleStore>()
.AddDefaultTokenProviders();
services.AddMemoryCache();
services.AddDistributedMemoryCache();
services.AddDbContext<IdentityServerDb>(options => options.UseSqlServer(Configuration.GetConnectionString("IdentityServerDb")));
services.AddMvc();
services.AddAuthentication(auth =>
{
auth.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
auth.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
auth.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
})
.AddCookie()
.AddOpenIdConnect("AzureAD", opts =>
{
Configuration.GetSection("OpenIdConnect").Bind(opts);
opts.RemoteAuthenticationTimeout = TimeSpan.FromSeconds(120);
opts.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
opts.CorrelationCookie = new Microsoft.AspNetCore.Http.CookieBuilder
{
HttpOnly = false,
SameSite = Microsoft.AspNetCore.Http.SameSiteMode.None,
SecurePolicy = Microsoft.AspNetCore.Http.CookieSecurePolicy.None,
Expiration = TimeSpan.FromMinutes(10)
};
opts.Events = new OpenIdConnectEvents()
{
OnRedirectToIdentityProvider = OnRedirectToIdentityProvider,
OnRemoteFailure = OnRemoteFailure,
OnAuthorizationCodeReceived = OnAuthorizationCodeReceived
};
//opts.Events = new OpenIdConnectEvents
//{
// OnAuthorizationCodeReceived = ctx =>
// {
// return Task.CompletedTask;
// }
//};
});
//services.ConfigureApplicationCookie(options =>
//{
// // Cookie settings
// options.Cookie.HttpOnly = true;
// options.ExpireTimeSpan = TimeSpan.FromMinutes(30);
// options.SlidingExpiration = true;
//});
}
private Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedContext arg)
{
return Task.FromResult(0);
}
private Task OnRemoteFailure(RemoteFailureContext arg)
{
return Task.FromResult(0);
}
private Task OnRedirectToIdentityProvider(RedirectContext arg)
{
return Task.FromResult(0);
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IHostingEnvironment env)
{
if (env.IsDevelopment())
{
app.UseBrowserLink();
app.UseDeveloperExceptionPage();
}
else
{
app.UseExceptionHandler("/Home/Error");
}
app.UseStaticFiles();
app.UseAuthentication();
app.UseMvc(routes =>
{
routes.MapRoute(
name: "default",
template: "{controller=Account}/{action=Login}/{id?}");
});
}
}
}
我的 appsettings.json:
{
"Logging": {
"IncludeScopes": false,
"LogLevel": {
"Default": "Warning"
}
},
"ConnectionStrings": {
"IdentityServerDb": "Server=localhost;Database=IdentityServer;Trusted_Connection=True;MultipleActiveResultSets=true"
},
"OpenIdConnect": {
"ClientId": "xxxxx",
"Authority": "https://login.microsoftonline.com/xxxxx/",
"PostLogoutRedirectUri": "/Account/SignoutOidc",
"CallbackPath": "/Account/SigninOidc",
"UseTokenLifetime": true,
"RequireHttpsMetadata": false,
//"ResponseType": "code id_token",
"ClientSecret": "xxx",
"Resource": "https://graph.microsoft.com/"
}
}
和实现:
[HttpGet]
public IActionResult CorpLogin()
{
var authProperties = _signInManager
.ConfigureExternalAuthenticationProperties("AzureAD",
Url.Action("SigninOidc", "Account", null, Request.Scheme));
return Challenge(authProperties, "AzureAD");
}
[HttpPost]
public IActionResult SigninOidc([FromForm]object data)
{
//this never runs
return Ok();
}
最佳答案
如果您针对本地主机使用 Chrome,您可能会遇到 Chrome cookie 处理行为的变化。
要验证,导航到 chrome://flags/并将“没有 SameSite 的 Cookie 必须是安全的”更改为“已禁用”。
如果该更改解决了问题,并且您想永久修复它(即不依赖于 chrome 标志修复),this thinktecture post讨论了旧 iOS Safari 版本所需的基本问题和一些修复。
关于c# - net.core/asp.net identity/openid connect 关联失败,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/50262561/