Ajout des stratégies d'Azure AD au démarrage après la migration d'Auth 2.0

Question

J'ai récemment posé une question similaire, mais c'était avec AAD B2C en ce qui concerne. Maintenant, je me demande comment ajouter correctement les politiques à l'authentification Azure Active Directory dans mon application. À l'heure actuelle, ma classe de démarrage ressemble à ceci:

namespace Auth 
{ 
    public class Startup 
    { 
     public Startup(IHostingEnvironment env) 
     { 
      var builder = new ConfigurationBuilder() 
       .SetBasePath(env.ContentRootPath) 
       .AddJsonFile("appsettings.json", optional: false, reloadOnChange: true) 
       .AddEnvironmentVariables(); 

      Configuration = builder.Build(); 
     } 

     private IConfigurationRoot Configuration { get; } 


     public void ConfigureServices(IServiceCollection services) 
     { 
      services.AddMvc(opts => 
      { 
       opts.Filters.Add(typeof(AdalTokenAcquisitionExceptionFilter)); 
      }); 

      services.AddAuthorization(o => 
      { 

      }); 

      services.AddAuthentication(auth => 
      { 
       auth.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme; 
       auth.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme; 
       auth.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme; 
      })   

      .AddCookie() 
      .AddOpenIdConnect(opts => 
      { 
       Configuration.GetSection("Authentication").Bind(opts); 

       opts.Events = new OpenIdConnectEvents 
       { 
        OnAuthorizationCodeReceived = async ctx => 
        { 
         HttpRequest request = ctx.HttpContext.Request; 
         string currentUri = UriHelper.BuildAbsolute(request.Scheme, request.Host, request.PathBase, request.Path); 
         var credential = new ClientCredential(ctx.Options.ClientId, ctx.Options.ClientSecret); 

         IDistributedCache distributedCache = ctx.HttpContext.RequestServices.GetRequiredService<IDistributedCache>(); 

         string userId = ctx.Principal.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value; 

         var cache = new AdalDistributedTokenCache(distributedCache, userId); 

         var authContext = new AuthenticationContext(ctx.Options.Authority, cache); 

         AuthenticationResult result = await authContext.AcquireTokenByAuthorizationCodeAsync(
         ctx.ProtocolMessage.Code, new Uri(currentUri), credential, ctx.Options.Resource); 

         ctx.HandleCodeRedemption(result.AccessToken, result.IdToken); 
        } 
       }; 
      }); 
     } 

     public void Configure(IApplicationBuilder app, IHostingEnvironment env) 
     { 
      if (env.IsDevelopment()) 
      { 
       app.UseDeveloperExceptionPage(); 
      } 

      app.UseStaticFiles(); 

      app.UseAuthentication(); 

      app.UseMvcWithDefaultRoute(); 
     } 


    } 
} 

je parviens à acquérir tous les jetons nécessaires (pour Azure graphique) avec succès plus tard, mais en ce moment l'application utilise une sorte de stratégie par défaut de Microsoft et je suis obligé de utiliser l'authentification Microsoft, alors que je voudrais également authentifier les utilisateurs locataires locaux. J'ai une politique d'inscription chez mon locataire appelée B2C_1_SignInPolicy, mais je n'arrive pas à comprendre comment la transmettre à l'authentification de mon application. App utilise un modèle de type MVC et .Net Core 2.0.

Ma meilleure estimation a été l'ajout d'une ligne semblable à opts.AddPolicyUrl (» https://...policyName). Mais je ne peux pas trouver un moyen de le faire

Answer 1

Au lieu d'ajouter directement le AddOpenIdConnect, vous pouvez consulter le code ci-dessous pour le Asp.net Core 2.0 pour interagir avec Azure B2C AD:

public void ConfigureServices(IServiceCollection services) 
{ 
    services.AddSingleton<IHttpContextAccessor, HttpContextAccessor>(); 

    services.AddAuthentication(sharedOptions => 
    { 
     sharedOptions.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme; 
     sharedOptions.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme; 
    }) 
    .AddAzureAdB2C(options => Configuration.Bind("Authentication:AzureAdB2C", options)) 
    .AddCookie(); 

    // Add framework services. 
    services.AddMvc(); 

    // Adds a default in-memory implementation of IDistributedCache. 
    services.AddDistributedMemoryCache(); 
    services.AddSession(options => 
    { 
     options.IdleTimeout = TimeSpan.FromHours(1); 
     options.CookieHttpOnly = true; 
    }); 


} 

public static class AzureAdB2CAuthenticationBuilderExtensions 
{ 
    public static AuthenticationBuilder AddAzureAdB2C(this AuthenticationBuilder builder) 
     => builder.AddAzureAdB2C(_ => 
     { 
     }); 

    public static AuthenticationBuilder AddAzureAdB2C(this AuthenticationBuilder builder, Action<AzureAdB2COptions> configureOptions) 
    { 
     builder.Services.Configure(configureOptions); 
     builder.Services.AddSingleton<IConfigureOptions<OpenIdConnectOptions>, OpenIdConnectOptionsSetup>(); 
     builder.AddOpenIdConnect(); 
     return builder; 
    } 

    public class OpenIdConnectOptionsSetup : IConfigureNamedOptions<OpenIdConnectOptions> 
    { 

     public OpenIdConnectOptionsSetup(IOptions<AzureAdB2COptions> b2cOptions) 
     { 
      AzureAdB2COptions = b2cOptions.Value; 
     } 

     public AzureAdB2COptions AzureAdB2COptions { get; set; } 

     public void Configure(string name, OpenIdConnectOptions options) 
     { 
      options.ClientId = AzureAdB2COptions.ClientId; 
      options.Authority = AzureAdB2COptions.Authority; 
      options.UseTokenLifetime = true; 
      options.TokenValidationParameters = new TokenValidationParameters() { NameClaimType = "name" }; 

      options.Events = new OpenIdConnectEvents() 
      { 
       OnRedirectToIdentityProvider = OnRedirectToIdentityProvider, 
       OnRemoteFailure = OnRemoteFailure, 
       OnAuthorizationCodeReceived = OnAuthorizationCodeReceived 
      }; 
     } 

     public void Configure(OpenIdConnectOptions options) 
     { 
      Configure(Options.DefaultName, options); 
     } 

     public Task OnRedirectToIdentityProvider(RedirectContext context) 
     { 
      var defaultPolicy = AzureAdB2COptions.DefaultPolicy; 
      if (context.Properties.Items.TryGetValue(AzureAdB2COptions.PolicyAuthenticationProperty, out var policy) && 
       !policy.Equals(defaultPolicy)) 
      { 
       context.ProtocolMessage.Scope = OpenIdConnectScope.OpenIdProfile; 
       context.ProtocolMessage.ResponseType = OpenIdConnectResponseType.IdToken; 
       context.ProtocolMessage.IssuerAddress = context.ProtocolMessage.IssuerAddress.ToLower().Replace(defaultPolicy.ToLower(), policy.ToLower()); 
       context.Properties.Items.Remove(AzureAdB2COptions.PolicyAuthenticationProperty); 
      } 
      else if (!string.IsNullOrEmpty(AzureAdB2COptions.ApiUrl)) 
      { 
       context.ProtocolMessage.Scope += $" offline_access {AzureAdB2COptions.ApiScopes}"; 
       context.ProtocolMessage.ResponseType = OpenIdConnectResponseType.CodeIdToken; 
      } 
      return Task.FromResult(0); 
     } 

     public Task OnRemoteFailure(RemoteFailureContext context) 
     { 
      context.HandleResponse(); 
      // Handle the error code that Azure AD B2C throws when trying to reset a password from the login page 
      // because password reset is not supported by a "sign-up or sign-in policy" 
      if (context.Failure is OpenIdConnectProtocolException && context.Failure.Message.Contains("AADB2C90118")) 
      { 
       // If the user clicked the reset password link, redirect to the reset password route 
       context.Response.Redirect("/Session/ResetPassword"); 
      } 
      else if (context.Failure is OpenIdConnectProtocolException && context.Failure.Message.Contains("access_denied")) 
      { 
       context.Response.Redirect("/"); 
      } 
      else 
      { 
       context.Response.Redirect("/Home/Error?message=" + context.Failure.Message); 
      } 
      return Task.FromResult(0); 
     } 

     public async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedContext context) 
     { 
      // Use MSAL to swap the code for an access token 
      // Extract the code from the response notification 
      var code = context.ProtocolMessage.Code; 

      string signedInUserID = context.Principal.FindFirst(ClaimTypes.NameIdentifier).Value; 
      TokenCache userTokenCache = new MSALSessionCache(signedInUserID, context.HttpContext).GetMsalCacheInstance(); 
      ConfidentialClientApplication cca = new ConfidentialClientApplication(AzureAdB2COptions.ClientId, AzureAdB2COptions.Authority, AzureAdB2COptions.RedirectUri, new ClientCredential(AzureAdB2COptions.ClientSecret), userTokenCache, null); 
      try 
      { 
       AuthenticationResult result = await cca.AcquireTokenByAuthorizationCodeAsync(code, AzureAdB2COptions.ApiScopes.Split(' ')); 


       context.HandleCodeRedemption(result.AccessToken, result.IdToken); 
      } 
      catch (Exception ex) 
      { 
       //TODO: Handle 
       throw; 
      } 
     } 
    } 
} 

Et pour l'échantillon complet de code, vous pouvez consulter le core2.0 branch of active-directory-b2c-dotnetcore-webapp