实现Azure AD的协议

Question

我有一个遗留的ASP.NET Web Forms应用程序。它目前正在使用带有Cookie身份验证和WSFederation协议的预处理ADFS。

我们想将其移动到Azure AD。我想知道我是否需要更改WSFederation协议，或者它也适用于Azure AD。此外，是否需要更改Cookie身份验证？

Startup.CS的代码如下：

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
//interactive logon process
AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Active,
//name of the authentication type
AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
//TODO: Enable this to always send and receive cookies in SSL when in production
CookieSecure = CookieSecureOption.Always,
//enable sliding expiration
SlidingExpiration = true,
//Cookie expires in 4 hours
ExpireTimeSpan = TimeSpan.FromTicks(DateTime.Now.AddHours(4).Ticks)
});
app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions
{
MetadataAddress = adfsMetadata,
Wtrealm = realm
});

• 编辑*

代码修改如下：

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
//interactive logon process
AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Active,
//name of the authentication type
AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
//Login path should be below
// LoginPath = new PathString("login"),
//TODO: Enable this to always send and receive cookies in SSL when in production
CookieSecure = CookieSecureOption.Always,
//enable sliding expiration
SlidingExpiration = true,
//Cookie expires in 4 hours
ExpireTimeSpan = TimeSpan.FromTicks(DateTime.Now.AddHours(4).Ticks)
});
Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;
app.UseWindowsAzureActiveDirectoryBearerAuthentication(new WindowsAzureActiveDirectoryBearerAuthenticationOptions
{
MetadataAddress = AzureMetaData,
Tenant = Tenant,
Realm = Realm

});

现在它抛出错误：

System.ArgumentNullException:"值不能为null。参数名称：允许受众

Answer 1

是的，Azure AD支持WS-Fed。参考：使用WS-Federation 将web应用程序与Azure AD集成

对于allowedAudiences，此字段的值必须与"；观众"；正在发送到您的服务的令牌的字段。您可以前往Azure AD应用程序注册您的服务，并在"；identifierUris"；领域此处的值应与您在"允许的令牌受众"列表中输入的值相匹配。

你也可以去https://resources.azure.com/>深入到应用服务资源>配置>authsettings和正确的allowedAudiences值：

"allowedAudiences":[
"https://mysite.azurewebsites.net"
]