asp.net - 使用 Asp.Net 中的两个按钮登录到不同的 Azure 租户

Question

在 Asp.Net 页面上，我需要支持两个 Azure 租户的登录。这个想法是有两个单独的按钮，每个按钮都会触发第一个或第二个租户中自己的应用程序注册的登录。

我知道可以进行 Multi-Tenancy 应用程序注册，但客户端不会有单独的租户。

有很多关于如何登录单个租户的示例，但我找不到任何适合上述场景的示例。

您能给我一个如何在运行时选择tenant1或tenant2的示例吗？

谢谢

Answer 1

我自己解决了这个问题。诀窍是使用不同的 authenticationType 值注册两个 OpenIdConnectAuthenticationOptions，这些值在后面的代码中用于调用 OpenIdConnectAuthenticationOptions。

Startup.cs

using System;
using System.Threading.Tasks;
using System.Web.Hosting;
using Microsoft.AspNet.Identity;
using Microsoft.Owin.Extensions;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.OpenIdConnect;
using Owin;
using TwoSSOProviders.App_Start;

namespace TwoSSOProviders
{
    public partial class Startup
    {
        // IdentityProvider are project classes 
        public static IdentityProvider TwoSSO1Poc => new IdentityProvider
        {
            AuthenticationType="SSO1",
            ClientId = "cid1",
            AadInstance = "https://login.microsoftonline.com/",
            Domain = "intactconsult.onmicrosoft.com",
            TenantId = "tid1",
            PostLogoutRedirectUri = "https://localhost:44323/About"
        };

        public static IdentityProvider TwoSSO2Poc => new IdentityProvider
        {
            AuthenticationType = "SSO2",
            ClientId = "cid2",
            AadInstance = "https://login.microsoftonline.com/",
            Domain = "intactconsult.onmicrosoft.com",
            TenantId = "tid2",
            PostLogoutRedirectUri = "https://localhost:44323/About"
        };

        public void Configuration(IAppBuilder app)
        {         
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationType = DefaultAuthenticationTypes.ExternalCookie,
                AuthenticationMode = AuthenticationMode.Passive,
                CookiePath = HostingEnvironment.ApplicationVirtualPath,
                CookieHttpOnly = true,
                ExpireTimeSpan = TimeSpan.FromMinutes(5),
            });

            ConfigureOpenIdConnectProvider(app, TwoSSO1Poc);
            ConfigureOpenIdConnectProvider(app, TwoSSO2Poc);
            app.UseStageMarker(PipelineStage.Authenticate);

        }

        private void ConfigureOpenIdConnectProvider(
            IAppBuilder app,
            IdentityProvider idp)
        {
            var options = new OpenIdConnectAuthenticationOptions(idp.AuthenticationType)
            {
                RedirectUri = idp.PostLogoutRedirectUri,

                 ClientId = idp.ClientId,
                Authority =  $"{idp.AadInstance}{idp.TenantId}",
                
                ResponseType = "code",
                Scope = "openid email profile",
                SignInAsAuthenticationType = "Cookies",

                RequireHttpsMetadata = false,
                Notifications = new OpenIdConnectAuthenticationNotifications()
                {
                    SecurityTokenValidated = (notification) =>
                    {
                        return Task.FromResult(0);
                    },
                    AuthenticationFailed = (notification) =>
                    {
                        return Task.FromResult(0);
                    },
                },
            };
            app.UseOpenIdConnectAuthentication(options);
        }
    }
}

登录.aspx.cs

using System.Web;
using Microsoft.Owin.Security;
using System;

namespace TwoSSOProviders
{
    public partial class Login : System.Web.UI.Page
    {
        protected void Page_Load(object sender, EventArgs e)
        {
            var owinContext = Context.GetOwinContext();

            if (!IsPostBack)
            {
                return;
            }
            var redirectUri = "https://localhost:44323/About";
            if (Request.Form[btnLoginA.UniqueID] != null)
            {
               Context.GetOwinContext().Authentication.Challenge(
                   new AuthenticationProperties { RedirectUri = redirectUri },
                    Startup.TwoSSO1Poc.AuthenticationType); //Note the AuthenticationType
            }

            if (Request.Form[btnLoginB.UniqueID] != null)
            {
                Context.GetOwinContext().Authentication.Challenge(
                    new AuthenticationProperties { RedirectUri = redirectUri },
                     Startup.TwoSSO2Poc.AuthenticationType); //Note the AuthenticationType
            }

            if (Request.Form[btnLogOut.UniqueID] != null)
            {                
                var prop = new AuthenticationProperties()
                {
                    RedirectUri = "https://localhost:44323/Login"
                };
                Request.GetOwinContext().Authentication.SignOut(prop);
            }
        }
    }
}