企业代理背后的asp.net core 3.1 azure ad SSO身份验证

如何解决企业代理背后的asp.net core 3.1 azure ad SSO身份验证

我正在尝试运行在 RHEL 7 上托管的 debian 10 容器上运行的 asp.net core 3.1 mvc Web 应用程序。该应用程序正在通过 Azure Ad OIDC SSO 进行身份验证。应用程序必须通过公司代理连接到 Azure AD。我正在尝试在 asp.net core 中设置代理，以便只有身份验证流量通过代理。我的启动文件如下所示：

using AutoMapper;
using CMM_MVP.Factories;
using CMM_MVP.Models;
using CMM_MVP.Services;
using CMM_MVP.Utils;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.DataProtection;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Mvc.Authorization;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Identity.Web;
using Microsoft.Identity.Web.UI;
using Microsoft.IdentityModel.Logging;
using System;
using System.Data;
using System.Data.sqlClient;
using System.Net;
using System.Net.Http;

namespace CMM_MVP
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        // For more information on how to configure your application,visit https://go.microsoft.com/fwlink/?LinkID=398940
        public void ConfigureServices(IServiceCollection services)
        {
            services.AddAutoMapper(typeof(Startup));
            services.AddCors();
            services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)   
                .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"));

            IdentityModelEventSource.ShowPII = true;

            services.AddControllersWithViews(options =>
            {
                var policy = new AuthorizationPolicyBuilder()
                .RequireAuthenticatedUser()
                .Build();
                options.Filters.Add(new Authorizefilter(policy));
            });

            services.AddRazorPages().AddMicrosoftIdentityUI();


            //allow the HTTP Context object to be passed as a service to the controllers.
            services.AddHttpContextAccessor();

            services.AddSingleton<IsqlServerConnectionUtil,sqlServerConnectionUtil>();
            services.AddSingleton<IRepository<CustomerModel>,MockCustomersRepository>();
            services.AddScoped<ICustomerService,CustomerService>();
            services.AddSingleton<IUserService,UserService>();
            services.AddScoped<ICaseService,CaseService>();
            services.AddScoped<IViewCaseService,ViewCaseService>();
            services.AddScoped(typeof(IModelFactory<>),typeof(ModelFactory<>));

            services.AddDataProtection()
                .SetApplicationName("xxx")
                .PersistKeysToFileSystem(new System.IO.DirectoryInfo(@"/var/dpkeys/"));

        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app,IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
                IdentityModelEventSource.ShowPII = true;
            }
            else {
                app.UseHsts();
            }
            // Add support for sessions before using routing 
            //app.UseSession();
            app.UseHttpsRedirection();
            app.UseStaticFiles();
            app.UseRouting();
            app.UseCors(builder =>
            {
                builder
                .AllowAnyOrigin()
                .AllowAnyMethod()
                .AllowAnyHeader();
            });

            app.UseAuthentication();
            app.UseAuthorization();
            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllerRoute(
                    name: "default",pattern: "{controller=Home}/{action=Index}/{id?}");
            });
        }
    }
}

我已经看到使用 OpenIDConnect 存在其他线程：Authenticate with Azure AD using .Net Core 3.00 from behind Corporate Proxy 但是，从那时起，Microsoft 引入并推荐了 Microsoft.Identity.Web 用于 Azure AD OIDC 身份验证，我正在使用它。我发现另一位同事使用了成功运行的以下设置（在 .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd")); ):

        var aadProxy = new WebProxy()
        {
            Address = new Uri("http://address:port"),UseDefaultCredentials = true
            
        };

        IdentityModelEventSource.ShowPII = true;

        services.AddHttpClient("proxiedClient")
            .ConfigurePrimaryHttpMessageHandler(() => new httpclienthandler()
            {
                UseProxy = true,Proxy = aadProxy,PreAuthenticate = true
            });
        services.Configure<AadissuerValidatorOptions>(options => { options.HttpClientName = "proxiedClient"; });

他还使用了以下代码，这不适用于我，因为我没有设置 JwtTokens：

services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme,options =>
        {
            options.TokenValidationParameters.RoleClaimType = "roles";
            options.BackchannelHttpHandler = new httpclienthandler()
            {
                UseProxy = true,PreAuthenticate = true,};
        });

我知道“BackchannelHttpHandler”是用来处理来自 Azure AD 的元数据的。我已经搜索了为我的用例设置 BackchannelHttpHandler 的方法，但找不到任何方法。

在我看来，设置 BackchannelHttpHandler 是我唯一缺少的东西，但我不确定？

我也不知道怎么配置？

解决方法

我现在已经可以正常工作几天了，没有任何问题。回答我的两个问题：

在我看来，设置 BackchannelHttpHandler 是我唯一缺少的东西，但我不确定？

答案：BackchannelHttpHandler 确实是我唯一缺少的东西。

我也不知道如何配置？

答案：使用选项模式： https://docs.microsoft.com/en-us/aspnet/core/fundamentals/configuration/options?view=aspnetcore-3.1 BackchannelHttpHandler 属性可以在行之后配置：https://docs.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnectoptions?view=aspnetcore-3.1： services.Configure(options => { options.HttpClientName = "proxiedClient"; });

在问题中。在上一行之后需要添加的代码如下：

    services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme,options =>
    {
        options.BackchannelHttpHandler = new HttpClientHandler()
        {
            UseProxy = true,Proxy = aadProxy,PreAuthenticate = true,};
    });

仅此而已。通过 Azure AD OpenID Connect 进行的 SSO 现已成功运行。