c# - 身份服务器 4 OpenId Connect 重定向到/Account/AccessDenied

Question

我在 Github 上提出了一个错误，但想看看是否有人也可以提供帮助。 Bug #1839

问题/重现问题的步骤

我尝试使用 openId Connect 对我们的 azure 广告进行身份验证，但在回调方法之后我被重定向到/Account/AccessDenied

身份验证完成后，azure 会重定向回回调方法。

    /// <summary>
    /// Post processing of external authentication. Callback from azure.
    /// </summary>
    [HttpGet]
    public async Task<IActionResult> TprUserLoginCallback(string returnUrl)
    {
        // read external identity from the temporary cookie
        var claimsPrincipal = await HttpContext.Authentication.AuthenticateAsync(IdentityServerConstants.ExternalCookieAuthenticationScheme);

        if (claimsPrincipal == null)
        {
            throw new Exception("External authentication error");
        }

        var claimResult = externalClaimsMapper.Map(claimsPrincipal);
        var claims = claimResult.Claims.ToArray();

        await HttpContext.Authentication.SignInAsync(claimResult.UserId, claimResult.UserName, claimResult.Provider, claims);

        return Redirect(interactionService.IsValidReturnUrl(returnUrl) ? returnUrl : "~/");
    }

然后重定向似乎进入了 asp 核心中间件(v1.1.3)，该中间件在日志中添加了一个条目，表示 cookie 被禁止。

2017-12-06 11:01:13,920 [40] INFO Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware.Log - AuthenticationScheme: idsrv.external was forbidden and after that the page redirects to /Account/AccessDenied.

2017-12-06 11:01:13,921 [40] INFO Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectMiddleware.Log - AuthenticationScheme: OpenIdConnect was forbidden.

启动 - cookie 身份验证和 openid 连接身份验证

app.UseIdentityServer();

        var appSettings = container.GetInstance<AppSettings>();

        app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            AuthenticationScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme,
            AutomaticAuthenticate = false,
            AutomaticChallenge = false,
            ExpireTimeSpan = TimeSpan.FromMinutes(appSettings.DefaultTokenLifetimeInMinutes)
        });

        app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions
        {
            ClientId = appSettings.AzureClientId,
            Authority = appSettings.AzureAuthority,
            PostLogoutRedirectUri = appSettings.AzurePostLogoutRedirectUri,
            DisplayName = "TPR Login",
            SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme,
            ResponseType = OpenIdConnectResponseType.IdToken,
            SaveTokens = true,
            RequireHttpsMetadata = false // F5's HTTPS handling so traffic will be HTTP
        });

        app.UseStaticFiles();
        app.UseCors("default");

        app.UseMvc(ConfigureRoutes.Configure);

重定向后，用户已登录，并且如果您手动导航到该网址，则可以访问应用

日志文件的相关部分

2017-12-06 11:01:13,899 [40] INFO Microsoft.AspNetCore.Hosting.Internal.WebHost.Log - Request starting HTTP/1.1 GET http://localhost:44362/ 2017-12-06 11:01:13,900 [40] DEBUG Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Log - Performing unprotect operation to key {144dcece-5570-4965-a74c-0ec3aed546e8} with purposes ('C:\code\tfs03\Single Sign On\Login\ReleaseSSO-Dev\WebUI\Login.IdentityServer', 'Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware', 'idsrv', 'v2'). 2017-12-06 11:01:13,902 [40] INFO Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware.Log - HttpContext.User merged via AutomaticAuthentication from authenticationScheme: idsrv. 2017-12-06 11:01:13,904 [40] INFO Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware.Log - AuthenticationScheme: idsrv was successfully authenticated. 2017-12-06 11:01:13,905 [40] DEBUG IdentityServer4.Hosting.EndpointRouter.Log - No endpoint entry found for request path: / 2017-12-06 11:01:13,906 [40] DEBUG Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Log - The request path / does not match a supported file type 2017-12-06 11:01:13,909 [40] DEBUG Microsoft.AspNetCore.Routing.RouteBase.Log - Request successfully matched the route with name 'default' and template '{controller=Login}/{action=Login}'. 2017-12-06 11:01:13,910 [40] DEBUG Microsoft.AspNetCore.Mvc.Internal.ActionSelector.Log - Action 'Login.IdentityServer.Controllers.LoginController.Login (Login.IdentityServer)' with id 'cba23692-b89e-4fe7-bf59-ccc14c18352a' did not match the constraint 'Microsoft.AspNetCore.Mvc.Internal.HttpMethodActionConstraint' 2017-12-06 11:01:13,911 [40] DEBUG Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Log - Executing action Login.IdentityServer.Controllers.LoginController.Login (Login.IdentityServer) 2017-12-06 11:01:13,913 [40] INFO Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Log - Executing action method Login.IdentityServer.Controllers.LoginController.Login (Login.IdentityServer) with arguments () - ModelState is Valid 2017-12-06 11:01:13,914 [40] DEBUG Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Log - Executed action method Login.IdentityServer.Controllers.LoginController.Login (Login.IdentityServer), returned result Microsoft.AspNetCore.Mvc.ChallengeResult. 2017-12-06 11:01:13,915 [40] INFO Microsoft.AspNetCore.Mvc.ChallengeResult.Log - Executing ChallengeResult with authentication schemes (OpenIdConnect). 2017-12-06 11:01:13,917 [40] DEBUG Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Log - Performing unprotect operation to key {144dcece-5570-4965-a74c-0ec3aed546e8} with purposes ('C:\code\tfs03\Single Sign On\Login\ReleaseSSO-Dev\WebUI\Login.IdentityServer', 'Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware', 'idsrv.external', 'v2'). 2017-12-06 11:01:13,918 [40] INFO Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware.Log - AuthenticationScheme: idsrv.external was successfully authenticated. 2017-12-06 11:01:13,920 [40] INFO Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware.Log - AuthenticationScheme: idsrv.external was forbidden. 2017-12-06 11:01:13,921 [40] INFO Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectMiddleware.Log - AuthenticationScheme: OpenIdConnect was forbidden. 2017-12-06 11:01:13,922 [40] INFO Microsoft.AspNetCore.Mvc.Internal.ControllerActionInvoker.Log - Executed action Login.IdentityServer.Controllers.LoginController.Login (Login.IdentityServer) in 10.0229ms 2017-12-06 11:01:13,924 [40] DEBUG Microsoft.AspNetCore.Server.Kestrel.Log - Connection id "0HL9SILL2SM7P" completed keep alive response. 2017-12-06 11:01:13,926 [40] INFO Microsoft.AspNetCore.Hosting.Internal.WebHost.Log - Request finished in 26.936ms 302 2017-12-06 11:01:13,930 [24] INFO Microsoft.AspNetCore.Hosting.Internal.WebHost.Log - Request starting HTTP/1.1 GET http://localhost:44362/Account/AccessDenied?ReturnUrl=%2Flogin%2Ftpruserlogincallback 2017-12-06 11:01:13,932 [24] DEBUG Microsoft.AspNetCore.DataProtection.KeyManagement.KeyRingBasedDataProtector.Log - Performing unprotect operation to key {144dcece-5570-4965-a74c-0ec3aed546e8} with purposes ('C:\code\tfs03\Single Sign On\Login\ReleaseSSO-Dev\WebUI\Login.IdentityServer', 'Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware', 'idsrv', 'v2'). 2017-12-06 11:01:13,934 [24] INFO Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware.Log - HttpContext.User merged via AutomaticAuthentication from authenticationScheme: idsrv. 2017-12-06 11:01:13,935 [24] INFO Microsoft.AspNetCore.Authentication.Cookies.CookieAuthenticationMiddleware.Log - AuthenticationScheme: idsrv was successfully authenticated. 2017-12-06 11:01:13,936 [24] DEBUG IdentityServer4.Hosting.EndpointRouter.Log - No endpoint entry found for request path: /Account/AccessDenied 2017-12-06 11:01:13,938 [24] DEBUG Microsoft.AspNetCore.StaticFiles.StaticFileMiddleware.Log - The request path /Account/AccessDenied does not match a supported file type 2017-12-06 11:01:13,940 [24] DEBUG Microsoft.AspNetCore.Routing.RouteBase.Log - Request successfully matched the route with name 'default' and template '{controller=Login}/{action=Login}'. 2017-12-06 11:01:13,941 [24] DEBUG Microsoft.AspNetCore.Mvc.Internal.MvcRouteHandler.Log - No actions matched the current request 2017-12-06 11:01:13,943 [24] DEBUG Microsoft.AspNetCore.Builder.RouterMiddleware.Log - Request did not match any routes. 2017-12-06 11:01:13,945 [24] DEBUG Microsoft.AspNetCore.Server.Kestrel.Log - Connection id "0HL9SILL2SM7P" completed keep alive response. 2017-12-06 11:01:13,946 [24] INFO Microsoft.AspNetCore.Hosting.Internal.WebHost.Log - Request finished in 15.7755ms 404

Answer 1

我最近遇到了同样的问题，原因是注销期间未删除 cookie。就我而言，我发现我在 StartUp.cs 的 CookieAuthenticationOptions 中设置的 CookieName 属性导致了问题。

在调查浏览器中的问题时，我注意到 cookie 不是使用此名称创建的，而是使用“idsvr.external”创建的。删除 cookie 名称设置解决了我的问题。

app.UseCookieAuthentication(new CookieAuthenticationOptions)
{
    ...
    CookieName = "...",
    ...
}