身份验证单个租户"Live.com“

Question

我实现了AD身份验证，其中我将客户机Id、redirectUri和租户作为“公共”传递。由于我使用租户作为“公共”用户来自live.com，outlook.com，microsoft.com以及学校和办公室。我希望它仅限于Live.com用户。

public class Startup
{
    // The Client ID is used by the application to uniquely identify itself to Azure AD.
    string clientId = System.Configuration.ConfigurationManager.AppSettings["ClientId"];

    // RedirectUri is the URL where the user will be redirected to after they sign in.
    string redirectUri = System.Configuration.ConfigurationManager.AppSettings["RedirectUri"];

    // Tenant is the tenant ID (e.g. contoso.onmicrosoft.com, or 'common' for multi-tenant)
    static string tenant = System.Configuration.ConfigurationManager.AppSettings["Tenant"];

    // Authority is the URL for authority, composed by Azure Active Directory v2 endpoint and the tenant name (e.g. https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0)
    string authority = "https://login.microsoftonline.com/common/v2.0" ;

    /// <summary>
    /// Configure OWIN to use OpenIdConnect 
    /// </summary>
    /// <param name="app"></param>
    public void Configuration(IAppBuilder app)
    {
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        app.UseCookieAuthentication(new CookieAuthenticationOptions());
        app.UseOpenIdConnectAuthentication(

        new OpenIdConnectAuthenticationOptions
        {
            // Sets the ClientId, authority, RedirectUri as obtained from web.config
            ClientId = clientId,
            Authority = authority,
            RedirectUri = redirectUri,
            // PostLogoutRedirectUri is the page that users will be redirected to after sign-out. In this case, it is using the home page
            PostLogoutRedirectUri = "https://localhost:44368/Claims/Register",
            Scope = OpenIdConnectScopes.OpenIdProfile,
            // ResponseType is set to request the id_token - which contains basic information about the signed-in user
            ResponseType = OpenIdConnectResponseTypes.IdToken,
            // ValidateIssuer set to false to allow personal and work accounts from any organization to sign in to your application
            // To only allow users from a single organizations, set ValidateIssuer to true and 'tenant' setting in web.config to the tenant name
            // To allow users from only a list of specific organizations, set ValidateIssuer to true and use ValidIssuers parameter 
            TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters() { ValidateIssuer = false },

            // OpenIdConnectAuthenticationNotifications configures OWIN to send notification of failed authentications to OnAuthenticationFailed method
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                AuthenticationFailed = OnAuthenticationFailed,
                AuthorizationCodeReceived = (c) => {
                    var code = c.Code;
                    return Task.FromResult(0);
                }
            }
        }
    );
    }

    /// <summary>
    /// Handle failed authentication requests by redirecting the user to the home page with an error in the query string
    /// </summary>
    /// <param name="context"></param>
    /// <returns></returns>
    private Task OnAuthenticationFailed(AuthenticationFailedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> context)
    {
        context.HandleResponse();
        context.Response.Redirect("/?errormessage=" + context.Exception.Message);
        return Task.FromResult(0);
    }
}
}

Answer 1

来自Azure AD的v2.0端点文档

注册后，应用程序通过向v2.0端点发送请求与Azure AD通信：

https://login.microsoftonline.com/{tenant}/oauth2/v2.0/authorize https://login.microsoftonline.com/{tenant}/oauth2/v2.0/token

其中，{tenant}可以接受四个不同的值中的一个：

• common -允许拥有微软个人帐户和来自Azure Active Directory的工作/学校帐户的用户登录应用程序。
• organizations -只允许在Azure Active Directory中拥有工作/学校帐户的用户登录应用程序
• consumers -只允许使用个人Microsoft帐户的用户登录应用程序.
• 8eaef023-2b34-4da1-9baa-8bc8c9d6a490或contoso.onmicrosoft.com -只允许来自特定Azure Active Directory租户的工作/学校帐户的用户登录应用程序。可以使用Azure AD租户的友好域名或租户的guid标识符。

如果您想进一步限制在消费者领域( email vs @outlook.com)，您需要在应用程序级别(查看声明)实现这一点。注意到，通常这种过滤级别没有多大意义，因为live.com帐户和outlook.com帐户之间没有功能/实际上的区别，它们只是有一个不同的虚荣域。