Azure身份验证与OAuth身份验证

Question

我必须找到一个问题的解决方案。所以我正在开发网站，我被身份验证卡住了。首先，我们使用Azure Active Directory进行用户存储。所以我找到了WebApp-WebAPI-OpenIDConnect-DotNet，并让它满足了我的需求。到目前为止，它工作得很好。但现在我必须实现外部登录(facebook、twitter等)。因此，我注释掉了所有以前的工作，因为我正在处理这项任务。我不得不重写一些UserManager和UserStore类，但让它正常工作。我可以用facebook登录。但是现在，当我需要将这两个登录连接在一起时，它们都不起作用了。看起来，他们在框架内制造了冲突。Facebook的登录需要app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);，但是当我打开它的时候，azure的登录就停止了。如果我注释掉这一点，azure登录可以工作，而facebook不行。有人能帮我解决这个问题吗？我会提供我的Startup.Auth.cs

using System;
using Owin;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.OpenIdConnect;
using System.Configuration;
using System.Globalization;
using Microsoft.AspNet.Identity;
using Microsoft.Owin;
using Microsoft.AspNet.Identity.Owin;
using ClearRoadmapWeb.LoginProviderHelpers;
using Microsoft.Owin.Security.Facebook;
using System.Collections.Generic;

namespace ClearRoadmapWeb
{
    public partial class Startup
    {
        private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
        private static string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
        private static string tenant = ConfigurationManager.AppSettings["ida:Tenant"];
        private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];

        string authority = String.Format(CultureInfo.InvariantCulture, aadInstance, tenant);

        public void ConfigureAuth(IAppBuilder app)
        {
            app.SetDefaultSignInAsAuthenticationType(DefaultAuthenticationTypes.ExternalCookie);
            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {
                    ClientId = clientId,
                    Authority = authority,
                    PostLogoutRedirectUri = postLogoutRedirectUri
                }
            );

            app.CreatePerOwinContext<AzureIdentityUserManager>(AzureIdentityUserManager.Create); //For Faceook
            app.CreatePerOwinContext<AzureIdentitySignInManager>(AzureIdentitySignInManager.Create); //For Facebook

            #region FacebookOptions
            //app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

            FacebookAuthenticationOptions facebookOptions = new FacebookAuthenticationOptions()
            {
                AppId = "fb appId",
                AppSecret = "fb appSecret"
            };
            facebookOptions.Scope.Add("email");
            facebookOptions.Provider = new FacebookAuthenticationProvider()
            {
                OnAuthenticated = async context =>
                {
                    foreach (var x in context.User)
                    {
                        context.Identity.AddClaim(new System.Security.Claims.Claim(x.Key, x.Value.ToString()));
                    }
                    //Get the access token from FB and store it in the database and use FacebookC# SDK to get more information about the user
                    context.Identity.AddClaim(new System.Security.Claims.Claim("FacebookAccessToken", context.AccessToken));
                }
            };

            #endregion
            app.UseFacebookAuthentication(facebookOptions);
        }
    }
}

Answer 1

默认情况下，OpenIdConnect身份验证模式处于活动状态。这意味着oidc将始终尝试处理授权。对我有效的方法是在控制器方法中发出一个直接质询，如下所示：

HttpContext.GetOwinContext().Authentication.Challenge("FaceBook")；

这是在将Startup_Auth编码为：

    public void Configure(IAppBuilder app)
    {
        CookieAuthenticationExtensions.UseCookieAuthentication(
            app,
            new CookieAuthenticationOptions
            {
                AuthenticationType = "FaceBook",
            });

        FacebookAuthenticationExtensions.UseFacebookAuthentication(
            app,
            new Microsoft.Owin.Security.Facebook.FacebookAuthenticationOptions
            {
                AppId = "...",
                AppSecret = "...",
                AuthenticationType = "FaceBook",
                SignInAsAuthenticationType = "FaceBook",
            });

        CookieAuthenticationExtensions.UseCookieAuthentication(
        app,
        new CookieAuthenticationOptions
        {
            AuthenticationType = "OpenIdConnect",
        });

        OpenIdConnectAuthenticationExtensions.UseOpenIdConnectAuthentication(
            app,
            new Microsoft.Owin.Security.OpenIdConnect.OpenIdConnectAuthenticationOptions
            {
                AuthenticationType = "OpenIdConnect",
                AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,
                ClientId = "...",
                Authority = "...",
                SignInAsAuthenticationType = "OpenIdConnect"
            });

您需要确保当您想要在AAD和FB之间‘切换’身份时，您可以通过注销或清除当前cookie来清除现有身份。