asp.net-mvc - WsFederation 和本地用户混合认证

Question

我正在尝试使用 Azure AD 凭据(使用 OWIN WsFederation 插件)或在 MVC 5.1 Web 应用程序中使用具有 microsoft asp.net 身份的本地用户帐户登录我的用户。

使用本地用户登录工作正常，使用联合帐户登录只能工作一次，我需要重新启动我的应用程序才能使其再次工作。

我想问题在于 Microsoft 登录页面的响应未正确处理

事实上，在私有(private)模式和 Fiddler 下使用两个不同的浏览器(chrome+ie)，我可以看到我的 cookie 是在第一个请求时设置的，但不是在从不同浏览器发出的后续请求时设置的

第一个请求


第二个请求


这是我的配置身份验证

     public void ConfigureAuth(IAppBuilder app)
    {
        AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;

        app.CreatePerOwinContext(ApplicationDbContext.Create);
        app.CreatePerOwinContext<ApplicationUserManager>(ApplicationUserManager.Create);

        app.SetDefaultSignInAsAuthenticationType("ExternalCookie");

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Account/Login"),
            AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Active,
        });


        // these two lines of code are needed if you are using any of the external authentication middleware
        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationType = "ExternalCookie",
            AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,
        });


        app.UseWsFederationAuthentication(new Microsoft.Owin.Security.WsFederation.WsFederationAuthenticationOptions()
        {
            MetadataAddress = "https://login.windows.net/XXXXXXX.onmicrosoft.com/federationmetadata/2007-06/federationmetadata.xml",
            Wtrealm = "https://MYREALM",

            AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,
        });

    }

这是帐户 Controller 的一部分

    //
    // POST: /Account/ExternalLogin
    [HttpPost]
    [AllowAnonymous]
    [ValidateAntiForgeryToken]
    public ActionResult ExternalLogin(string provider, string returnUrl)
    {
        // Request a redirect to the external login provider
        return new ChallengeResult(provider, Url.Action("ExternalLoginCallback", "Account", new { ReturnUrl = returnUrl }));
    }


    // GET: /Account/ExternalLoginCallback
    [AllowAnonymous]
    public ActionResult ExternalLoginCallback(string returnUrl)
    {

        var ctx = Request.GetOwinContext();
        var result = ctx.Authentication.AuthenticateAsync("ExternalCookie").Result;

        if (result != null) //null on request other than the first (!!!)
        {
            ctx.Authentication.SignOut("ExternalCookie");

            var claims = result.Identity.Claims.ToList();
            claims.Add(new Claim(ClaimTypes.AuthenticationMethod, "External Account"));
            var email = claims.Where(x => x.Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name").SingleOrDefault().Value;
            var ci = new ClaimsIdentity(claims, DefaultAuthenticationTypes.ApplicationCookie);
            ctx.Authentication.SignIn(ci);
        }

        return RedirectToLocal(returnUrl);
    }

Answer 1

在 ConfgureAuth 中将 AuthenticationMode 设置为 Passive。它适用于我的工作流程，看起来与您的工作流程非常相似。

app.UseWsFederationAuthentication(new Microsoft.Owin.Security.WsFederation.WsFederationAuthenticationOptions()
    {
        MetadataAddress = "https://login.windows.net/XXXXXXX.onmicrosoft.com/federationmetadata/2007-06/federationmetadata.xml",
        Wtrealm = "https://MYREALM",

        AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,
        AuthenticationMode = AuthenticationMode.Passive
    });

http://msdn.microsoft.com/en-us/library/microsoft.owin.security.authenticationmode%28v=vs.113%29.aspx