asp.net-core - 如何在 .Net Core 3.1 中的 OpenId 连接时禁用 ssl 证书验证？

Question

我正在尝试在开发环境中使用其 ip 地址连接到开放 id 授权。显然，在这种情况下，ssl 验证将失败。我想绕过它，到目前为止没有任何运气。我找到了有关此主题的以下答案:

在 OpenIdConnectOptions 类中将 RequireHttpsMetadata 设置为 false。

使用以下代码:

ServicePointManager.ServerCertificateValidationCallback +=(sender, cert, chain, sslPolicyErrors) => true;

当我的应用程序尝试访问 oidc 权限时，我收到相同的错误:

An unhandled exception occurred while processing the request.AuthenticationException: The remote certificate is invalid accordingto the validation procedure.System.Net.Security.SslStream.StartSendAuthResetSignal(ProtocolTokenmessage, AsyncProtocolRequest asyncRequest, ExceptionDispatchInfoexception)

HttpRequestException: The SSL connection could not be established, seeinner exception.System.Net.Http.ConnectHelper.EstablishSslConnectionAsyncCore(Streamstream, SslClientAuthenticationOptions sslOptions, CancellationTokencancellationToken)

IOException: IDX20804: Unable to retrieve document from:'https://172.11.0.11:1111/MY_APP/.well-known/openid-configuration'.Microsoft.IdentityModel.Protocols.HttpDocumentRetriever.GetDocumentAsync(stringaddress, CancellationToken cancel)

InvalidOperationException: IDX20803: Unable to obtain configurationfrom:'https://172.11.0.11:1111/MY_APP/.well-known/openid-configuration'.Microsoft.IdentityModel.Protocols.ConfigurationManager.GetConfigurationAsync(CancellationTokencancel)

Answer 1

警告:仅在开发过程中使用它。如果合适，您需要为您的生产平台定制证书验证例程。
您可能覆盖了错误的 HttpClientHandler。 OpenId Connect 的反向 channel HttpClient 可以在此处被覆盖:

services
    .AddAuthentication(options =>
    {
        ...
    })
    .AddCookie()
    .AddOpenIdConnect(options =>
    {
        ...
        HttpClientHandler handler = new HttpClientHandler();
        handler.ServerCertificateCustomValidationCallback = HttpClientHandler.DangerousAcceptAnyServerCertificateValidator;
        options.BackchannelHttpHandler = handler;
    });