.net-core - Identity Server 4 上的关联失败

Question

我有一个 Identity Server 4 配置了 OpenIdConnect 到 Azure AD。

当用户单击登录按钮时，IS4 重定向到 Azure AD 并在回调到 IS4 时显示此错误:

这是我向 postman 请求 token 的方式:

注意callback url为移动应用格式

这是我的配置:

services.AddAuthentication()
        .AddCookie(options => new CookieAuthenticationOptions
        {
            ExpireTimeSpan = TimeSpan.FromHours(12),
            SlidingExpiration = false,
            Cookie = new CookieBuilder
            {
                Path = "",
                Name = "MyCookie"
            }
        }).AddOpenIdConnect(options =>
        {
            options.ClientId = configuration["OpenIdConnect:ClientId"];
            options.Authority = configuration["OpenIdConnect:Authority"];
            options.SignedOutRedirectUri = configuration["OpenIdConnect:PostLogoutRedirectUri"];
            options.CallbackPath = configuration["OpenIdConnect:CallbackPath"];
            options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
            options.Resource = configuration["OpenIdConnect:Resource"];
            options.ClientSecret = configuration["OpenIdConnect:ClientSecret"];
            options.SaveTokens = true;
            options.RequireHttpsMetadata = false;

            options.TokenValidationParameters = new TokenValidationParameters
            {
                NameClaimType = "name",
                RoleClaimType = "role"
            };
            options.SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme;

        });

这是我的参数:

  "OpenIdConnect": {
    "ClientId": "xxxxxxxxxx",
    "Authority": "https://login.microsoftonline.com/xxxxxxxxxx/",
    "PostLogoutRedirectUri": "https://uri-of-my-identity-server.azurewebsites.net",
    "CallbackPath": "/signin-oidc",
    "ResponseType": "code id_token",
    "Resource": "https://graph.microsoft.com/",
    "ClientSecret": "my-secret"
  },

注意:此错误仅发生在Azure 环境(不是本地)

注意:在 Xamarin 应用程序上，当 Azure 返回到 IS4 同意屏幕时，它会显示此消息:

Answer 1

您的客户端和 Azure 之间的网络可能存在问题。某个端口尚未打开或负载平衡器介于两者之间。

When decryption fails, state is null, thus resulting in a Correlation failed: state not found error. In our case, decryption failed because different keys were used for encryption/decryption, a pretty common problem when deploying behind a load balancer.