Aspnet Core 3.1 MVC Razor 页面在使用 Identity Server 4 OpenIdConnect 进行身份验证后获得 302

Question

我有一个 MVC Razor 页面应用程序，我想将其连接到我们的身份服务器实现中。我们已经按照他们快速入门中的教程进行操作 https://identityserver4.readthedocs.io/en/latest/quickstarts/2_interactive_aspnetcore.html 并在一个全新的项目中使用它，因此我们假设客户端和 IDS 配置没问题。

但是，当我们将它移植到我们的 RazorPages 应用程序时，我们进入了一个循环。我们被发送到 IDS，我们登录，然后我们被发送回 signin-oidc 页面。此页面似乎生成了 302。

请查看此网络跟踪。每次请求都会请求一个新的“code_challenge”参数

我的创业公司在这里（很抱歉）：

public void ConfigureServices( IServiceCollection services )
    {
        services.AddIdentity<ApplicationUser, IdentityRole>( options =>
                {
                    options.SignIn.RequireConfirmedEmail = true;
                } )
            .AddEntityFrameworkStores<CourseRegContext>()
            .AddDefaultTokenProviders();


        var cs = Configuration.GetConnectionString( "DefaultConnection" );
        var skipHTTPS = Configuration.GetValue<bool>( "LocalTest:skipHTTPS" );
        services.Configure<MvcOptions>( options =>
        {
            if ( /*Environment.IsDevelopment() && */!skipHTTPS )
            {
                options.Filters.Add( new RequireHttpsAttribute() );
                options.EnableEndpointRouting = false;
            }
        } );

        services.AddMvc()
            .SetCompatibilityVersion( CompatibilityVersion.Version_2_1 )
            .AddNewtonsoftJson(
                options => options.SerializerSettings.ReferenceLoopHandling = Newtonsoft.Json.ReferenceLoopHandling.Ignore
            );

        services.AddMvc( config =>
        {
            var policy = new AuthorizationPolicyBuilder()
                .RequireAuthenticatedUser()
                .Build();
            config.Filters.Add( new AuthorizeFilter( policy ) );
            config.EnableEndpointRouting = false;

        } ).AddRazorPagesOptions( options =>
        {
            options.Conventions.AllowAnonymousToFolder( "/Oops" );
            options.Conventions.AuthorizeFolder( "/Test" );
        } );

        services.AddMemoryCache();

        services.AddHttpsRedirection( options =>
        {
            options.RedirectStatusCode = StatusCodes.Status307TemporaryRedirect;
            if ( Environment.IsDevelopment() )
            {
                options.HttpsPort = 44311;
            }
            else
            {
                options.HttpsPort = 443;
            }
        } );

        services.AddHsts( options =>
        {
            options.Preload = true;
            options.IncludeSubDomains = true;
            options.MaxAge = TimeSpan.FromHours( 1 );
        } );

        AddAuthorisation( services );
    }

    private void AddAuthorisation( IServiceCollection services )
    {
        JwtSecurityTokenHandler.DefaultMapInboundClaims = false;

        services.AddAuthentication( options =>
        {
            options.DefaultScheme = "Cookies";
            options.DefaultChallengeScheme = "oidc";
        } )
        .AddCookie( "Cookies" )
        .AddOpenIdConnect( "oidc", options =>
        {
            options.Authority = "https://localhost:41012";

            options.ClientId = "validId";
            options.ClientSecret = "somesecret";
            options.ResponseType = "code";
            options.Scope.Add( "roles" );
            options.GetClaimsFromUserInfoEndpoint = true;
            options.SaveTokens = true;
            //options.UsePkce = true;
        } );

        //services.AddAuthorization();

        services.AddAuthorization( options =>
        {
            options.AddPolicy( AuthPolicies.GlobalAdmin, policy =>
                policy.RequireRole( ApplicationRoles.Administrator ) );
            options.AddPolicy( AuthPolicies.CourseAdmin, policy =>
                policy.RequireRole(
                    ApplicationRoles.Administrator,
                    ApplicationRoles.CourseAdmin ) );
            options.AddPolicy( AuthPolicies.Presenter, policy =>
                policy.RequireRole( ApplicationRoles.CourseViewer ) );
            options.AddPolicy( AuthPolicies.UserAdmin, policy =>
                policy.RequireRole( ApplicationRoles.UserAdmin, ApplicationRoles.Administrator ) );
        } );
     }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure( IApplicationBuilder app, IHostingEnvironment env )
    {
        if ( env.IsDevelopment() )
        {
            app.UseDeveloperExceptionPage();
            app.UseDatabaseErrorPage();
            app.UseBrowserLink();
        }
        else
        {
            app.UseExceptionHandler( "/Oops/C500" );
            app.UseHsts( options => options.MaxAge( hours: 1 ).IncludeSubdomains() ); //todo when confident it is working, use 180 days
        }

        app.UseStatusCodePagesWithRedirects( "/Oops/C{0}" );

        app.UseXXssProtection( options => options.EnabledWithBlockMode() );
        app.UseXContentTypeOptions();

        app.UseHttpsRedirection();
        app.UseStaticFiles();
        app.UseCookiePolicy();

        app.UseRouting();
        app.UseAuthentication();
        app.UseAuthorization();

        app.UseEndpoints( endpoints =>
        {
            //endpoints.MapDefaultControllerRoute()
                //.RequireAuthorization();
        } );

        app.UseMvc();
    }

我想知道它是否与 MVC 和端点有关，作为升级到 .NET Core 3.1 的一部分，但我不确定如何让项目的其余部分正常工作，同时仍然获得 IDS 集成。

Answer 1

我启动了一个空白项目并在没有附加任何其他代码的情况下对其进行了身份验证并且它有效。所以我把每一行都放回去修复每个 DI 错误，直到我再次看到错误。它与 services.AddIdentity<ApplicationUser, IdentityRole> 有关，我想这是有道理的，因为它添加了登录身份验证内容以及管理器。因此，这一行需要删除，但也需要删除对 usermanager 等的所有引用。

后来进行了一次大规模重构，现在已经破坏了到 IDS 的重定向，但希望能实现重定向。（现在就像根本没有认证一样）

Aspnet Core 3.1 MVC Razor 页面在使用 Identity Server 4 OpenIdConnect 进行身份验证后获得 302

Aspnet Core 3.1 MVC Razor pages gets 302 after authenticating with Identity Server 4 OpenIdConnect

openid-connect

.net-core