如何使用 openid-Connect 通过 AD-B2C 发送值

Question

我目前正在开发一个使用 AD-B2C 作为身份提供者的应用程序。这已使用他们在 AD B2C graph 的指南集成到解决方案中，该指南使用 openid-connect（至少据我所知）。

我需要使用一种电子邮件激活形式（在他们的注册政策之外），因此我需要能够通过注册过程从电子邮件中的 URL 传递一个值在 B2C 并返回到重定向 URL。

我在某处读到一个名为 "state" 的参数可用于此：

State: A value included in the request that will also be returned in the token response. It can be a string of any content that you want. A randomly generated unique value is typically used for preventing cross-site request forgery attacks. The state is also used to encode information about the user's state in the app before the authentication request occurred, such as the page they were on or the policy being executed.

我曾尝试将值附加到将用户转移到 B2C 时发生的重定向，但我不知道如何。

if (!Request.IsAuthenticated)
        { // go to login page
            HttpContext.GetOwinContext().Authentication.Challenge(
                  new AuthenticationProperties() { RedirectUri = "/" }, Startup.SignUpSignInPolicyId);
        }

策略存储在 startup.auth.cs 文件中...

// B2C policy identifiers
    public static string SignUpPolicyId = ConfigurationManager.AppSettings["ida:SignUpPolicyId"];
    public static string SignInPolicyId = ConfigurationManager.AppSettings["ida:SignInPolicyId"];
    public static string SignUpSignInPolicyId = ConfigurationManager.AppSettings["ida:SignUpSignInPolicyId"];
    public static string ProfilePolicyId = ConfigurationManager.AppSettings["ida:UserProfilePolicyId"];
    public static string PasswordResetPolicyId = ConfigurationManager.AppSettings["ida:PasswordResetPolicyId"];

...并且在 ConfigureAuth 方法期间 运行：

public void ConfigureAuth(IAppBuilder app)
    {
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        app.UseCookieAuthentication(new CookieAuthenticationOptions()
        {
            CookieHttpOnly = true,
            ExpireTimeSpan = TimeSpan.FromHours(1),
        });

        // Configure OpenID Connect middleware for each policy
        app.UseOpenIdConnectAuthentication(CreateOptionsFromPolicy(SignUpPolicyId));
        app.UseOpenIdConnectAuthentication(CreateOptionsFromPolicy(ProfilePolicyId));
        app.UseOpenIdConnectAuthentication(CreateOptionsFromPolicy(SignInPolicyId));
        app.UseOpenIdConnectAuthentication(CreateOptionsFromPolicy(SignUpSignInPolicyId));
        app.UseOpenIdConnectAuthentication(CreateOptionsFromPolicy(PasswordResetPolicyId));
    }

调用：

private OpenIdConnectAuthenticationOptions CreateOptionsFromPolicy(string policy)
    {
        return new OpenIdConnectAuthenticationOptions
        {
            // For each policy, give OWIN the policy-specific metadata address, and
            // set the authentication type to the id of the policy
            MetadataAddress = String.Format(aadInstance, tenant, policy),
            AuthenticationType = policy,

            // These are standard OpenID Connect parameters, with values pulled from web.config
            ClientId = clientId,
            RedirectUri = redirectUri,
            PostLogoutRedirectUri = redirectUri,
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                AuthenticationFailed = AuthenticationFailed,
            },
            Scope = "openid",
            ResponseType = "id_token",
            //// This piece is optional - it is used for displaying the user's name in the navigation bar.
            //TokenValidationParameters = new TokenValidationParameters
            //{
            //    NameClaimType = "name",
            //},
        };

    }

如何传递如下值：（简化示例：）

if (!Request.IsAuthenticated)
        { // go to login page
            HttpContext.GetOwinContext().Authentication.Challenge(
                  new AuthenticationProperties() { RedirectUri = "/" }, Startup.SignUpSignInPolicyId, new { state = "value=uniquetoken&token=secrets" });
        } 

这些方法和策略是什么时候设置的运行时间？ 此外，如果我正朝着完全错误的方向前进，我应该从这里去哪里？

感谢任何帮助:)

此致

Answer 1

要在我们使用 OpenIdConnect 协议时传递值，我们可以将值添加到您提到的状态。

我们可以在使用 RedirectToIdentityProvider 将其重定向到身份数据提供程序 (Azure AD) 之前传递此值。之后，我们可以提取我们在首次收到协议消息时使用 MessageReceived 添加的自定义值。

下面是供您参考的代码示例：

new OpenIdConnectAuthenticationOptions
{
    // For each policy, give OWIN the policy-specific metadata address, and
    // set the authentication type to the id of the policy
    MetadataAddress = String.Format(aadInstance, tenant, policy),
    AuthenticationType = policy,

    // These are standard OpenID Connect parameters, with values pulled from web.config
    ClientId = clientId,
    RedirectUri = redirectUri,
    PostLogoutRedirectUri = redirectUri,
    Notifications = new OpenIdConnectAuthenticationNotifications
    {
        AuthenticationFailed = AuthenticationFailed,
        RedirectToIdentityProvider= OnRedirectToIdentityProvider,
        MessageReceived= OnMessageReceived
    },
    Scope = "openid",
    ResponseType = "id_token",

    // This piece is optional - it is used for displaying the user's name in the navigation bar.
    TokenValidationParameters = new TokenValidationParameters
    {
        NameClaimType = "name",
    },
};

private Task OnRedirectToIdentityProvider(RedirectToIdentityProviderNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification)
{
    var stateQueryString = notification.ProtocolMessage.State.Split('=');
    var protectedState = stateQueryString[1];
    var state = notification.Options.StateDataFormat.Unprotect(protectedState);
    state.Dictionary.Add("mycustomparameter", "myvalue");
    notification.ProtocolMessage.State = stateQueryString[0] + "=" + notification.Options.StateDataFormat.Protect(state);
    return Task.FromResult(0);
}

private Task OnMessageReceived(MessageReceivedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification)
{
    string mycustomparameter;
    var protectedState = notification.ProtocolMessage.State.Split('=')[1];
    var state = notification.Options.StateDataFormat.Unprotect(protectedState);
    state.Dictionary.TryGetValue("mycustomparameter", out mycustomparameter);
    return Task.FromResult(0);
}