azure - 突然出现 'No valid key mapping found for securityToken'错误

Question

TL;DR

我们的网站突然出现以下错误，没有代码或 web.config 更改。 Azure 会改变吗？

我有一个网站，它已经在 Azure 上运行了几个月，没有出现任何问题。然后有一天，我们现在遇到了这个错误:

WIF10201: No valid key mapping found for securityToken: 'System.IdentityModel.Tokens.X509SecurityToken' and issuer: 'https://sts.windows.net/<guid>/'.

我们没有对 web.config 或 Tenants 和 IssuingAuthorityKeys 中的值进行任何更改。

搜索 SO 和网络给出了很多基于代码的答案，但我们没有更改任何代码。

web.config 是这样的:

<system.identityModel>
  <identityConfiguration>
    <issuerNameRegistry type="DatabaseIssuerNameRegistry, Site.Web" />
    <audienceUris>
      <add value="https://localhost:44301" />
      <add value="https://<other urls...>" />
    </audienceUris>
    <securityTokenHandlers>
      <add type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
      <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
    </securityTokenHandlers>
    <certificateValidation certificateValidationMode="None" />
  </identityConfiguration>
</system.identityModel>

issuerNameRegistry 类如下:

public class DatabaseIssuerNameRegistry : ValidatingIssuerNameRegistry
{
    public static bool ContainsTenant(string tenantId)
    {
        using (DBEntities context = new DBEntities())
        {
            return context.Tenants
                .Where(tenant => tenant.Id == tenantId)
                .Any();
        }
    }

    public static bool ContainsKey(string thumbprint)
    {
        using (DBEntities context = new DBEntities())
        {
            return context.IssuingAuthorityKeys
                .Where(key => key.Id == thumbprint)
                .Any();
        }
    }

    public static void RefreshKeys(string metadataLocation)
    {
        IssuingAuthority issuingAuthority = ValidatingIssuerNameRegistry.GetIssuingAuthority(metadataLocation);

        bool newKeys = false;
        bool refreshTenant = false;
        foreach (string thumbprint in issuingAuthority.Thumbprints)
        {
            if (!ContainsKey(thumbprint))
            {
                newKeys = true;
                refreshTenant = true;
                break;
            }
        }

        foreach (string issuer in issuingAuthority.Issuers)
        {
            if (!ContainsTenant(GetIssuerId(issuer)))
            {
                refreshTenant = true;
                break;
            }
        }

        if (newKeys || refreshTenant)
        {
            using (DBEntities context = new DBEntities())
            {
                if (newKeys)
                {
                  context.IssuingAuthorityKeys.RemoveRange(context.IssuingAuthorityKeys);
                  foreach (string thumbprint in issuingAuthority.Thumbprints)
                  {
                      context.IssuingAuthorityKeys.Add(new IssuingAuthorityKey { Id = thumbprint });
                  }
                }

                if (refreshTenant)
                {
                    foreach (string issuer in issuingAuthority.Issuers)
                    {
                        string issuerId = GetIssuerId(issuer);
                        if (!ContainsTenant(issuerId))
                        {
                            context.Tenants.Add(new Tenant { Id = issuerId });
                        }
                    }
                }
                context.SaveChanges();
            }
        }
    }

    private static string GetIssuerId(string issuer)
    {
        return issuer.TrimEnd('/').Split('/').Last();
    }

    protected override bool IsThumbprintValid(string thumbprint, string issuer)
    {
        return ContainsTenant(GetIssuerId(issuer))
            && ContainsKey(thumbprint);
    }
}

Answer 1

从this来看Technet 文章，看来 Microsoft 可能已经更新了他们处理 Tenant key 的方式。

我必须将以下代码添加到我的 Global.asax.cs 文件中:

protected void Application_Start()
{
    AreaRegistration.RegisterAllAreas();

    // ....

    string configPath = AppDomain.CurrentDomain.BaseDirectory + "\\" + "Web.config";
    string metadataAddress =
                    ConfigurationManager.AppSettings["ida:FederationMetadataLocation"];
    ValidatingIssuerNameRegistry.WriteToConfig(metadataAddress, configPath); 
}