asp.net核心3.1企业代理背后的azure广告SSO身份验证

Question

我正在尝试运行一个asp.net内核3.1 mvc web应用程序，该应用程序正在RHEL 7上托管的debian 10容器上运行。该应用程序正在通过Azure Ad OIDC SSO进行身份验证。应用程序必须通过公司代理连接到Azure AD。我正在尝试在asp.net核心中设置代理，以便只有身份验证流量通过代理。我的启动文件如下：

using AutoMapper;
using CMM_MVP.Factories;
using CMM_MVP.Models;
using CMM_MVP.Services;
using CMM_MVP.Utils;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.DataProtection;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.Mvc.Authorization;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Identity.Web;
using Microsoft.Identity.Web.UI;
using Microsoft.IdentityModel.Logging;
using System;
using System.Data;
using System.Data.SqlClient;
using System.Net;
using System.Net.Http;
namespace CMM_MVP
{
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
// This method gets called by the runtime. Use this method to add services to the container.
// For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=398940
public void ConfigureServices(IServiceCollection services)
{
services.AddAutoMapper(typeof(Startup));
services.AddCors();
services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)   
.AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"));
IdentityModelEventSource.ShowPII = true;
services.AddControllersWithViews(options =>
{
var policy = new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.Build();
options.Filters.Add(new AuthorizeFilter(policy));
});
services.AddRazorPages().AddMicrosoftIdentityUI();

//allow the HTTP Context object to be passed as a service to the controllers.
services.AddHttpContextAccessor();
services.AddSingleton<ISqlServerConnectionUtil, SqlServerConnectionUtil>();
services.AddSingleton<IRepository<CustomerModel>, MockCustomersRepository>();
services.AddScoped<ICustomerService, CustomerService>();
services.AddSingleton<IUserService, UserService>();
services.AddScoped<ICaseService, CaseService>();
services.AddScoped<IViewCaseService, ViewCaseService>();
services.AddScoped(typeof(IModelFactory<>), typeof(ModelFactory<>));
services.AddDataProtection()
.SetApplicationName("xxx")
.PersistKeysToFileSystem(new System.IO.DirectoryInfo(@"/var/dpkeys/"));
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
IdentityModelEventSource.ShowPII = true;
}
else {
app.UseHsts();
}
// Add support for sessions before using routing 
//app.UseSession();
app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();
app.UseCors(builder =>
{
builder
.AllowAnyOrigin()
.AllowAnyMethod()
.AllowAnyHeader();
});
app.UseAuthentication();
app.UseAuthorization();
app.UseEndpoints(endpoints =>
{
endpoints.MapControllerRoute(
name: "default",
pattern: "{controller=Home}/{action=Index}/{id?}");
});
}
}
}

我已经看到其他线程使用OpenIDConnect：从企业代理后面使用.Net Core 3.00与Azure AD进行身份验证然而，从那以后，微软推出并推荐了Microsoft.Identity.Web用于Azure AD OIDC身份验证，而我正在使用它。我找到了另一位同事，他成功地使用了以下设置(在.AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"((：

var aadProxy = new WebProxy()
{
Address = new Uri("http://address:port"),
UseDefaultCredentials = true

};
IdentityModelEventSource.ShowPII = true;
services.AddHttpClient("proxiedClient")
.ConfigurePrimaryHttpMessageHandler(() => new HttpClientHandler()
{
UseProxy = true,
Proxy = aadProxy,
PreAuthenticate = true
});
services.Configure<AadIssuerValidatorOptions>(options => { options.HttpClientName = "proxiedClient"; });

他还使用了以下代码，这不适用于我，因为我没有设置JwtTokens：

services.Configure<JwtBearerOptions>(JwtBearerDefaults.AuthenticationScheme, options =>
{
options.TokenValidationParameters.RoleClaimType = "roles";
options.BackchannelHttpHandler = new HttpClientHandler()
{
UseProxy = true,
Proxy = aadProxy,
PreAuthenticate = true,
};
});

我明白；BackchannelHttpHandler"；是处理Azure AD中的metadta的内容。我已经为我的用例搜索了设置BackchannelHttpHandler的方法，但找不到任何方法。

在我看来，设置BackchannelHttpHandler是我唯一缺少的atm，但我不确定？

我也不知道如何配置它？

Answer 1

我已经让它工作了几天，没有任何问题。回答我的两个问题：

1. 在我看来，设置BackchannelHttpHandler是我唯一缺少的东西，但我不确定

答案：BackchannelHttpHandler确实是我唯一缺少的东西。

2. 我也不知道如何配置它

答案：使用选项模式：https://learn.microsoft.com/en-us/aspnet/core/fundamentals/configuration/options?view=aspnetcore-3.1可以配置BackchannelHttpHandler属性：https://learn.microsoft.com/en-us/dotnet/api/microsoft.aspnetcore.authentication.openidconnect.openidconnectoptions?view=aspnetcore-3.1就在线路后面：服务。配置(options=>{options.HttpClientName="proxyedClient"}(；

在问题中。在OpenIDConnect选项中配置BackchannelHttpHandler属性时，需要在上面的行之后添加的代码如下：

services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, 
options =>
{
options.BackchannelHttpHandler = new HttpClientHandler()
{
UseProxy = true,
Proxy = aadProxy,
PreAuthenticate = true,
};
});

仅此而已。通过Azure AD OpenID Connect的SSO现在已成功工作。