Azure AD 多租户身份验证如何工作？

Question

我想启用多租户身份验证。我的代码在 ASP.Net Webforms 中，这是 StartUp.cs 文件代码。

  public partial class Startup
{

    const string MSATenantId = "XXXXXXXXXXXXXXX";
    private static string clientId = ConfigurationManager.AppSettings["ida:ClientID"];
    private static string aadInstance = EnsureTrailingSlash(ConfigurationManager.AppSettings["ida:AADInstance"]);
    private static string authority = aadInstance + "common";

    public void ConfigureAuth(IAppBuilder app)
    {
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        app.UseCookieAuthentication(new CookieAuthenticationOptions { });

        // instead of using the default validation (validating against a single issuer value, as we do in line of business apps), 
        // we inject our own multitenant validation logic
        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = clientId,
                Authority = authority,
                TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                {
                    ValidateIssuer = true,
                     ValidIssuers = new List<string>()
                     {
                         "https://sts/windows.net/XXXXXXXXXXXX"
                     }
                    // If the app needs access to the entire organization, then add the logic
                    // of validating the Issuer here.
                    // IssuerValidator
                },
                Notifications = new OpenIdConnectAuthenticationNotifications()
                {   
                    SecurityTokenValidated = (context) =>
                    {

                        //if (context.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value != MSATenantId)
                        //{
                        //     context.HandleResponse();
                        //    context.Response.Redirect("InvalidUser.aspx");
                        //}
                        // If your authentication logic is based on users
                        return Task.FromResult(0);
                    },
                    AuthenticationFailed = (context) =>
                    {
                        // Pass in the context back to the app
                        context.HandleResponse();
                        // Suppress the exception
                        return Task.FromResult(0);
                    }
                },  
            });

        // This makes any middleware defined above this line run before the Authorization rule is applied in web.config
        app.UseStageMarker(PipelineStage.Authenticate);
    }
    //private Task OnSecurityTokenValidatedAsync(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification)
    //{
    //    // Make sure that the user didn't sign in with a personal Microsoft account
    //    if (notification.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value == MSATenantId)
    //    {
    //        notification.HandleResponse();
    //        notification.Response.Redirect("/Account/UserMismatch");
    //    }

    //    return Task.FromResult(0);
    //}
   }

我只希望具有 MSATenantId 的用户能够访问我已阅读的应用程序，我尝试了以下两种方法，但都不起作用：

在此应用程序不会重定向到主页

     TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
             {
                ValidateIssuer = true,
                 ValidIssuers = new List<string>()
                 {
                     "https://sts/windows.net/XXXXXXXXXX"
                 }
                // If the app needs access to the entire organization, then add the logic
                // of validating the Issuer here.
                // IssuerValidator
            },

    In this it doesn't redirect to invalid page.
          SecurityTokenValidated = (context) =>
                 {

                     if (context.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value != MSATenantId)
                     {
                         context.HandleResponse();
                         context.Response.Redirect("InvalidUser.aspx");
                     }
                     If your authentication logic is based on users
                     return Task.FromResult(0);
                 },

在上述场景中我是否遗漏了什么或者我需要添加一些东西。我只想先测试一个租户，然后再添加更多租户。

此外，1 和 2 有何不同？

如果我不使用上述任何选项，这将有效。我可以使用 Azure 帐户登录。

Answer 1

您的问题已解决，请将其作为答案添加到问题末尾。

您的issuer设置不正确，您应该将其更改为：https://sts.windows.net/XXXXXXXXXXXX/。

Answer 2

我能够解决这个问题。问题是 url 不正确 https://sts/windows.net/XXXXXXXXXXXX

正确的 URL 是 - https://sts.windows.net/XXXXXXXXXXXX/

     TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
            {
               ValidateIssuer = true,
                ValidIssuers = new List<string>()
                {
                 "https://sts.windows.net/XXXXXXXXXX/"
             }
            // If the app needs access to the entire organization, then add the logic
            // of validating the Issuer here.
            // IssuerValidator
        },

Azure AD 多租户身份验证如何工作？

How does Azure AD MutiTenant authentication works?

active-directory

azure

multi-tenant

azure-active-directory