我正在构建一个多租户Web应用程序,该应用程序在此示例之后使用Microsoft.Owin.Security.OpenIdConnect,版本= 3.0.0.0和Azure Active Directory与Microsoft.IdentityModel.Clients.ActiveDirectory,版本= 2.19.0.0连接Office 365服务。
我们的Web应用程序客户端(用户代理)使用asp.NET cookie验证到我们的服务器,而我们的服务器和授权服务器(此处为Azure AD)之间的验证是使用OpenID授权代码流进行的。
我们为Asp.NET Cookie设置了30天的滑动到期期限。但是,即使将UseTokenLifetime = true设置为True(这应该与两种身份验证机制的生存期匹配),我们仍然无法从Authority Server获得AuthenticationTicket 。
我们面临的问题是:我们的最终用户必须频繁地重新登录(少于一小时)。然后的问题是,我们如何在这种owin openidconnect中间件中增加/更改身份验证票证的寿命?
备注:我还发布了有关ADAL使用刷新令牌的问题。据我们了解,该问题仅与身份验证有关。由ActiveDirectory客户端管理的授权问题access_token和refresh_token的生存期与此问题无关。如果我错了,请纠正我。
Startup.Auth.cs
public partial class Startup
{
public const string CookieName = ".AspNet.MyName";
public const int DayExpireCookie = 30;
public void ConfigureAuth(IAppBuilder app)
{
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
var cookieAuthenticationOptions = new CookieAuthenticationOptions()
{
CookieName = CookieName,
ExpireTimeSpan = TimeSpan.FromDays(DayExpireCookie),
AuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
SlidingExpiration = true,
};
app.UseCookieAuthentication(cookieAuthenticationOptions);
app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions
{
ClientId = SettingsHelper.ClientId,
Authority = SettingsHelper.Authority,
ClientSecret = SettingsHelper.AppKey,
UseTokenLifetime = true,
TokenValidationParameters = new System.IdentityModel.Tokens.TokenValidationParameters
{
ValidateIssuer = false
},
Notifications = new OpenIdConnectAuthenticationNotifications()
{
// If there is a code in the OpenID Connect response, redeem it for an access token and refresh token, and store those away.
AuthorizationCodeReceived = (context) =>
{
var code = context.Code;
string tenantID = context.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/tenantid").Value;
string signInUserId = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;
AuthenticationContext authContext = new AuthenticationContext(string.Format("{0}/{1}", SettingsHelper.AuthorizationUri, tenantID), new ADALTokenCache(signInUserId));
ClientCredential credential = new ClientCredential(SettingsHelper.ClientId, SettingsHelper.AppKey);
// Get the access token for AAD Graph. Doing this will also initialize the token cache associated with the authentication context
// In theory, you could acquire token for any service your application has access to here so that you can initialize the token cache
Uri redirectUri = new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path));
AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode(code, redirectUri, credential, SettingsHelper.AADGraphResourceId);
return Task.FromResult(0);
},
RedirectToIdentityProvider = (RedirectToIdentityProviderNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> context) =>
{
string appBaseUrl = context.Request.Scheme + "://" + context.Request.Host + context.Request.PathBase;
context.ProtocolMessage.RedirectUri = appBaseUrl + SettingsHelper.LoginRedirectRelativeUri;
context.ProtocolMessage.PostLogoutRedirectUri = appBaseUrl + SettingsHelper.LogoutRedirectRelativeUri;
return Task.FromResult(0);
},
AuthenticationFailed = (context) =>
{
context.HandleResponse();
return Task.FromResult(0);
}
}
});
}
}
客户总监
public class AccountController : Controller
{
public void SignIn()
{
var dateTimeOffset = DateTimeOffset.UtcNow;
var authenticationProperties = new AuthenticationProperties
{
AllowRefresh = true,
IssuedUtc = dateTimeOffset,
ExpiresUtc = dateTimeOffset.AddDays(Startup.DayExpireCookie -1),
RedirectUri = SettingsHelper.LoginRedirectRelativeUri, IsPersistent = true
};
HttpContext.GetOwinContext()
.Authentication.Challenge(authenticationProperties,OpenIdConnectAuthenticationDefaults.AuthenticationType, CookieAuthenticationDefaults.AuthenticationType);
}
public void SignOut()
{
HttpContext.GetOwinContext().Authentication.SignOut(
new AuthenticationProperties { RedirectUri = SettingsHelper.LogoutRedirectRelativeUri, },
OpenIdConnectAuthenticationDefaults.AuthenticationType, CookieAuthenticationDefaults.AuthenticationType);
}
}
实际上,我需要设置UseTokenLifetime = false
。确实,UseTokenLifetime = true
将Asp.NET Cookie中的内部票证更改为默认的生存期access_token
为一小时。@Tratcher的评论是真实的,但误导了我...是的,access_token
生命周期受Azure AD控制,对此我无能为力。但是,我们refresh_token
使用ADAL.NET实施了管理,因此可以将Microsoft Identity Server的身份验证/授权保留一个多小时。现在,设置UseTokenLifetTime = false
和使用cookie身份验证以及在客户端应用程序和服务器之间的有效期有15天的有效期滑动,现在就像一个魅力。
本文收集自互联网,转载请注明来源。
如有侵权,请联系 [email protected] 删除。
我来说两句