将 IdentityServer4 与 Azure Active Directory 连接

Question

作为我的要求之一，我应该将 IdentitySever 与具有现有用户和声明的 Active Directory 连接起来。到目前为止，我设法在 Azure 门户中创建了应用程序注册。所以我有一个 Appication ID 并且还配置了一个 API Key。此外，我有一个端点列表：

https://login.windows.net/{ad_guid}/federationmetadata/2007-06/federationmetadata.xml
https://login.windows.net/{ad_guid}/wsfed
https://login.windows.net/{ad_guid}/saml2
https://login.windows.net/{ad_guid}/saml2
https://graph.windows.net/{ad_guid}
https://login.windows.net/{ad_guid}/oauth2/token
https://login.windows.net/{ad_guid}/oauth2/authorize

我可以通过

获取 OpenID 配置

https://login.windows.net/{ad_guid}/.well-known/openid-configuration

根据 documentation from Microsoft 我现在应该这样配置端点：

app.SetDefaultSignInAsAuthenticationType(
    CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions());

var uri = "https://login.windows.net/{0}";
var instance = configuration["AzureAD:Instance"];
var authority = string.Format(CultureInfo.InvariantCulture, uri, instance);

app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
{
    DisplayName = "Azure Active Directory",
    AuthenticationScheme = "AzureAD",
    SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme,
    ClientId = configuration["AzureAD:AppId"],
    Authority = authority, 
    Scope = {"openid", "email"}
});

出于某种原因，这不起作用。有什么我可能错过的想法吗？

Answer 1

显然，我几乎是正确的。这是我的解决方案：

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationScheme = 
        IdentityServerConstants.DefaultCookieAuthenticationScheme,
    AutomaticAuthenticate = true,
    AutomaticChallenge = true
});

    public static OpenIdConnectOptions CreateAzureAdOptions(X509Certificate2 certificate2, IConfiguration configuration)
    {
        return new OpenIdConnectOptions
        {
            DisplayName = "Azure Active Directory",
            AuthenticationScheme = "Azure",
            ClientId = configuration["OpenId:AzureAD:AppId"],
            Authority = string.Format(CultureInfo.InvariantCulture, "https://login.windows.net/{0}", configuration["OpenId:AzureAD:Instance"]),
            TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = false
            },
            // https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-token-and-claims
            Scope = {"openid", "email", "roles", "groups"},
            Events = new OpenIdConnectEvents
            {
                OnRemoteFailure = context => HandleRemoteFailure(context)
            },
            SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme
        };
    }

    private static Task HandleRemoteFailure(FailureContext context)
    {
        Log.Error(context.Failure, "Azure AD Remote Failure");
        context.Response.Redirect("/accessdenied");
        context.HandleResponse();
        return Task.FromResult(0);
    }

将 IdentityServer4 与 Azure Active Directory 连接

Connecting IdentityServer4 with Azure Active Directory

azure-active-directory

identityserver4