c# - 使用 Authentication.AzureAD.UI 库时实现 OpenIdConnectOptions 事件

Question

我一直在使用我从示例创建的库，该库允许我使用 Azure Active Directory 对 .NET 核心 Web 应用程序进行身份验证，并利用各种 OpenIdConnectOptions 事件(例如 OnTokenValidated) 向主体添加某些声明，并将该数据添加到类似身份的数据库中，以便 API 可以根据调用者的 token 对调用者进行基于策略的确定。

但我宁愿使用 Microsoft.AspNetCore.Authentication.AzureAD.UI NuGet 包而不是我的自定义变体，我只是不确定如何进入并访问 上的事件>OpenIdConnectOptions。

我不知道这是不是可以做的事情，或者我只是对依赖注入(inject)没有足够的了解来弄清楚如何去做。

或者我应该考虑在流程的不同部分添加声明等吗？

public static AuthenticationBuilder AddAzureAD(
    this AuthenticationBuilder builder,
    string scheme,
    string openIdConnectScheme,
    string cookieScheme,
    string displayName,
    Action<AzureADOptions> configureOptions) {

    AddAdditionalMvcApplicationParts(builder.Services);
    builder.AddPolicyScheme(scheme, displayName, o => {
        o.ForwardDefault = cookieScheme;
        o.ForwardChallenge = openIdConnectScheme;
    });

    builder.Services.Configure(
        TryAddOpenIDCookieSchemeMappings(scheme, openIdConnectScheme, cookieScheme));

    builder.Services.TryAddSingleton<IConfigureOptions<AzureADOptions>, AzureADOptionsConfiguration>();

    // They put in their custom OpenIdConnect configuration, but I can't see how to get at the events.
    builder.Services.TryAddSingleton<IConfigureOptions<OpenIdConnectOptions>, OpenIdConnectOptionsConfiguration>();

    builder.Services.TryAddSingleton<IConfigureOptions<CookieAuthenticationOptions>, CookieOptionsConfiguration>();

    builder.Services.Configure(scheme, configureOptions);

    builder.AddOpenIdConnect(openIdConnectScheme, null, o => { });
    builder.AddCookie(cookieScheme, null, o => { });

    return builder;
}

Answer 1

我可能来晚了一点，但我遇到了同样的问题，发现 AzureAD 身份验证中间件的文档非常稀少。在此处为遇到同样问题的其他人添加解决方案。

正如您在问题代码片段底部看到的那样，AzureAD 提供程序实际上依赖于 OpenIdConnect和 Cookie引擎盖下的身份验证提供程序，并且本身不实现任何身份验证逻辑。

为此，添加了两个额外的身份验证方案，使用定义为 AzureADDefaults.OpenIdScheme 的名称和 AzureADDefaults.CookieScheme , 分别。

(尽管在使用 AddAzureAD(this Microsoft.AspNetCore.Authentication.AuthenticationBuilder builder, string scheme, string openIdConnectScheme, string cookieScheme, string displayName, Action<Microsoft.AspNetCore.Authentication.AzureAD.UI.AzureADOptions> configureOptions) 重载时也可以自定义名称)。

反过来，允许配置有效的 OpenIdConnectOptions和 CookieAuthenticationOptions通过使用上面的方案名称，包括访问 OpenIdConnectEvents .

请看这个完整的例子:

        services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
            .AddAzureAD(options => Configuration.Bind("AzureAd", options));

        services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =>
        {
            options.Events = new OpenIdConnectEvents
            {
                OnRedirectToIdentityProvider = async ctxt =>
                {
                    // Invoked before redirecting to the identity provider to authenticate. This can be used to set ProtocolMessage.State
                    // that will be persisted through the authentication process. The ProtocolMessage can also be used to add or customize
                    // parameters sent to the identity provider.
                    await Task.Yield();
                },
                OnMessageReceived = async ctxt =>
                {
                    // Invoked when a protocol message is first received.
                    await Task.Yield();
                },
                OnTicketReceived = async ctxt =>
                {
                    // Invoked after the remote ticket has been received.
                    // Can be used to modify the Principal before it is passed to the Cookie scheme for sign-in.
                    // This example removes all 'groups' claims from the Principal (assuming the AAD app has been configured
                    // with "groupMembershipClaims": "SecurityGroup"). Group memberships can be checked here and turned into
                    // roles, to be persisted in the cookie.
                    if (ctxt.Principal.Identity is ClaimsIdentity identity)
                    {
                        ctxt.Principal.FindAll(x => x.Type == "groups")
                            .ToList()
                            .ForEach(identity.RemoveClaim);
                    }                        
                    await Task.Yield();
                },
            };
        });

        services.Configure<CookieAuthenticationOptions>(AzureADDefaults.CookieScheme, options =>
        {
            options.Events = new CookieAuthenticationEvents
            {
                // ...
            };
        });