c# - AspNet 核心标识 GetExternalLoginInfoAsync 始终为空

Question

我结合使用 IdentityServer4 和 ASP .NET Core Identity 来创建联合登录页面。我正在使用的外部提供商之一是通过 Open ID Connect 协议(protocol)的 Azure Active Directory。我还为所有数据存储集成了 EntityFrameworkCore。

在我使用身份验证构建我的初始网站后，我将适当的服务添加到我的 Startup.cs 文件中。

services.AddOidcStateDataFormatterCache();
// Some DI registrations
services.Configure<CookiePolicyOptions>(options =>
{
    options.CheckConsentNeeded = context => true;
    options.MinimumSameSitePolicy = SameSiteMode.None;
});
services.AddDbContext<MyDbContext>();
services.AddMvc().AddRazorPages(options => /* Some options */);
services.AddIdentityServer(options =>
    options.Events.RaiseErrorEvents = true;
    options.Events.RaiseFailureEvents = true;
    options.Events.RaiseInformationEvents = true;
    options.Events.RaiseSuccessEvents = true;
)
.AddConfigurationStore(options => /* Set up DbContext */)
.AddOperationStore(options => /* Set up DbContext */)
.AddAspNetIdentity<MyAppUser>();
services.AddAuthentication().AddOpenIdConnect(options =>
{
    // Does not bind itself for mysterious reasons
    Configuration.GetSection("OpenIdConect").Bind(options)
});

我决定如果我在我的 appsettings.json 文件中完成大部分身份验证设置，它会看起来更好。

{
    "OpenIdConnect": {
        "ClientId": "<my_client_id>",
        "Authority:" "https://login.microsoft.com/<my_tenant_id>",
        "PostLogoutRedirectUri": "http://localhost:5000/MyApp/Account",
        "CallbackPath": "/signin-oidc",
        "ResponseType": "code id_token",
        "Scope": "openid profile email",
        "SignInScheme": "idsrv.external",
        "AutomaticAuthenticate": "false",
        "AutomaticChallenge": "false",
        "RequireHttpsMetadata": "true"
     }
}

一切都在运行，我的 Open ID Connect 登录提供程序自动出现在登录页面上。粉碎!在尝试使用它时，我遇到了一个错误:Error loading external login information. Ends up that on the scaffolded Razor pageAreas/Identity/Pages/Account/ExternalLogin.cshtml.cs:72 有这段代码:

var info = await _signInManager.GetExternalLoginInfoAsync();
if (info == null)
{
    ErrorMessage = "Error loading external login information.";
    return RedirectToPage("./Login", new { ReturnUrl = returnUrl });
}

info 始终解析为 null。我怀疑这是我的 Startup.cs 某处的配置问题，或者是一些没有文档提及的神奇之处。

Answer 1

脑洞大开，决定重读the IdentityServer4 documentation about external identity providers.

这引起了我(疲倦的)的注意:

Given that this is such a common practise, IdentityServer registers a cookie handler specifically for this external provider workflow. The scheme is represented via the IdentityServerConstants.ExternalCookieAuthenticationScheme constant.

If you were to use our external cookie handler, then for the SignInScheme [in your OpenIdConnect service setup] you’d assign the value to be the IdentityServerConstants.ExternalCookieAuthenticationScheme constant

好吧，我想我没有使用他们的外部 cookie 处理程序。很确定我让 ASP .NET Core Identity 这样做。我决定在我的 appsettings.json 中取消这一行:

"SignInScheme": "idsrv.external"

瞧，我可以使用我的 Active Directory 凭据登录。阅读 GetExternalLoginInfoAsync 的实际源代码，我发现他们正在寻找一个非常具体的 cookie，而不是 “idsrc.external”。将其保留为默认值正是我所需要的。