MVC Core 中的混合用户身份

Question

我按照以下步骤创建了混合登录解决方案 Hybrid authentication in .net core with Open Id Connect and local database

运行应用程序然后单击 Azure Active Directory 登录按钮时，我收到以下错误：

An unhandled exception occurred while processing the request.
SecurityTokenInvalidIssuerException: IDX10205: Issuer validation failed. Issuer: '[PII is hidden]'. Did not match: validationParameters.ValidIssuer: '[PII is hidden]' or validationParameters.ValidIssuers: '[PII is hidden]'.
Microsoft.IdentityModel.Tokens.Validators.ValidateIssuer(string issuer, SecurityToken securityToken, TokenValidationParameters validationParameters)

Exception: An error was encountered while handling the remote login.
Microsoft.AspNetCore.Authentication.RemoteAuthenticationHandler<TOptions>.HandleRequestAsync()

appsettings.json

 "ConnectionStrings": {
        "DefaultConnection": "Server=(localdb)\\mssqllocaldb;Database=aspnet-Hybrid2-365BF50C-5C76-40EB-820E-59075FF471D7;Trusted_Connection=True;MultipleActiveResultSets=true"
    },
    "AzureAd": {
        "Instance": "https://login.microsoftonline.com/",
        "Domain": "[Enter the domain of your tenant, e.g. contoso.onmicrosoft.com]",
        "TenantId": "common",
        "ClientId": "9407cd54-e564-4e15-b9e0-aabd750037c0",
        "CallbackPath": "/signin-oidc",
        "CookieSchemeName": "Identity.External"
    },
    "Logging": {
        "LogLevel": {
            "Default": "Warning"
        }
    },
    "AllowedHosts": "*"

Answer 1

如果您的应用程序是多租户应用程序，因为您请求/common 端点，您需要禁用颁发者验证：

services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
        .AddAzureAD(options => Configuration.Bind("AzureAd", options));

services.Configure<OpenIdConnectOptions>(AzureADDefaults.OpenIdScheme, options =>
{

    options.TokenValidationParameters.ValidateIssuer = false;

});

/common 端点不是租户，也不是颁发者，它只是一个多路复用器。使用/common 时，应用程序中验证令牌的逻辑应决定哪些颁发者值有效，哪些不是基于颁发者值的租户 ID 部分。有关详细信息，请参阅文档 here。