WindowsAzureActiveDirectoryBearerAuthenticationOptions 身份验证重定向失败答案

【问题标题】：WindowsAzureActiveDirectoryBearerAuthenticationOptions redirect on authentication failedWindowsAzureActiveDirectoryBearerAuthenticationOptions 身份验证重定向失败
【发布时间】：2017-07-12 18:21:37
【问题描述】：

我有一个 MVC 应用程序，它也为 alexa 技能提供服务。 alexa 技能的身份验证是使用 WindowsAzureActiveDirectoryBearerAuthentication 完成的，如下所示：

 app.Use(typeof(AlexaJWTMiddleware));
        app.UseWindowsAzureActiveDirectoryBearerAuthentication(
            new WindowsAzureActiveDirectoryBearerAuthenticationOptions
            {
                Tenant = domain,
                TokenValidationParameters = new TokenValidationParameters
                {
                    ValidAudience = ConfigurationManager.AppSettings["ida:AppIdUri"]
                },
                AuthenticationType = "OAuth2Bearer",
            });

然后是 MVC 部分的身份验证，如下所示：

   app.UseCookieAuthentication(new CookieAuthenticationOptions
        {
            // This is NOT ASP.NET Session Timeout (that should be set to same value in web.config)
            // This is the expiration on the cookie that holds the Azure AD token
            ExpireTimeSpan = TimeSpan.FromMinutes(Convert.ToDouble(expirationTimeSpan)),

            // Set SlidingExpiration=true to instruct the middleware to re-issue a new cookie
            // with a new expiration time any time it processes a request which is more than
            // halfway through the expiration window.
            SlidingExpiration = true,

            Provider = new CookieAuthenticationProvider
            {
                // This method is called every time the cookie is authenticated, which
                // is every time a request is made to the web app
                OnValidateIdentity = CookieAuthNotification.OnValidateIdentity
            }
        });

        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = clientId,
                Authority = authority,
                UseTokenLifetime = false,
                /*
                * Skipping the Home Realm Discovery Page in Azure AD
                * http://www.cloudidentity.com/blog/2014/11/17/skipping-the-home-realm-discovery-page-in-azure-ad/
                */
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    RedirectToIdentityProvider = OpenIdConnectNotification.RedirectToIdentityProvider,
                    MessageReceived = OpenIdConnectNotification.MessageReceived,
                    SecurityTokenReceived = OpenIdConnectNotification.SecurityTokenReceived,
                    SecurityTokenValidated = OpenIdConnectNotification.SecurityTokenValidated,
                    AuthorizationCodeReceived = OpenIdConnectNotification.AuthorizationCodeReceived,
                    AuthenticationFailed = OpenIdConnectNotification.AuthenticationFailed
                },

            });

一切正常，但对于 Alexa 身份验证，我无法执行自定义操作以防身份验证失败。发生这种情况时，我需要向 alexa 返回响应，并且 WindowsAzureActiveDirectoryBearerAuthenticationOptions 没有类似于 OpenIdConnectAuthenticationNotifications.AuthenticationFailed 方法的任何内容。如何将自定义响应发送回 alexa？

【问题讨论】：

标签： azure-active-directory alexa bearer-token

【解决方案1】：

要自定义对 Web API 的未授权请求，我们可以创建一个自定义授权属性，如下所示：

public class CustomAuthorization : AuthorizeAttribute
{
    protected override void HandleUnauthorizedRequest(HttpActionContext actionContext)
    {
        actionContext.Response = new HttpResponseMessage
        {
            StatusCode = HttpStatusCode.Unauthorized,
            Content = new StringContent("You are unauthorized to access this resource!")
        };
    }
}

[CustomAuthorization]
public class ValuesController : ApiController
{
    public ValuesController()
    {
    }

    // GET api/values
    public IEnumerable<string> Get()
    {       
        return new string[] { "value1", "value2" };
    }    

}

【讨论】：