asp.net-mvc - 失败的 OpenID Connect 中间件 - 如何调试？

Question

我设置了一个非常简单的 ASP.NET MVC 5 应用程序，它尝试在授权码模式下通过 OpenID 提供程序对用户进行身份验证。

我能够登录并且服务器在重定向 URL 查询字符串中返回一个代码和一个随机数 cookie。但是，在客户端应用程序上，用户没有经过身份验证（User.Identity.IsAuthenticated假），没有声明并且调用了具有Authorize属性的控制器操作永远不会执行。浏览器停留在作为主页的重定向 URL 页面上。

我认为在执行 OpenID Connect 中间件期间发生了一些事情，这使它中途停止，但无法弄清楚如何调试它。

• 即使在“中断所有 CLR 异常”模式下也不会引发异常。

• 将 EventListener 连接到Verbose 级别时，每次身份验证尝试一次，IdentityModelEventSource.Logger我只会收到一个记录的事件，显示“为 openIdConnect 消息生成随机数” 。

• 除了没有Notification钩子RedirectToIdentityProvider，所以看起来没有收到授权码或安全令牌，但身份验证也没有失败。

我怎样才能获得更多关于发生了什么的信息，以便我可以调试我的问题？

这是代码：

        public void Configuration(IAppBuilder app)
        {
            var clientSecret = "secret";
            var authenticationOptions = new OpenIdConnectAuthenticationOptions
            {
                ClientId = "id",
                ClientSecret = clientSecret,
                Authority = "https://theauthority",
                RedirectUri = "https://localhost/MyApp/",
            };

            authenticationOptions.ResponseType = OpenIdConnectResponseType.Code; // Authorization code
            authenticationOptions.TokenValidationParameters.IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes(clientSecret));
            authenticationOptions.TokenValidationParameters.RequireSignedTokens = true;
            authenticationOptions.TokenValidationParameters.ValidAudience = "katanaclient";
            authenticationOptions.SignInAsAuthenticationType = "Cookies";
            authenticationOptions.Configuration = new OpenIdConnectConfiguration
            {
                Issuer = "https://theissuer",
                AuthorizationEndpoint = "https://theendpoint",
                TokenEndpoint = "https://theendpoint/api/v1/token",
                UserInfoEndpoint = "https://theendpoint/api/v1/userinfo",
                EndSessionEndpoint = "https://theendpoint/api/v1/logout",
                ScopesSupported = { "openid", "profile"},
            };

            authenticationOptions.Notifications = new OpenIdConnectAuthenticationNotifications
            {
                RedirectToIdentityProvider = async n =>
                {
                    // here it goes
                    if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.Authentication)
                    {
                        n.ProtocolMessage.EnableTelemetryParameters = false;
                    }
                },
                AuthorizationCodeReceived = async notification =>
                {
                    // doesn't go through here
                    Debug.WriteLine($"{notification.Response.Body}");

                },
                SecurityTokenReceived = async notification =>
                {
                    // doesn't go through here
                    Debug.WriteLine($"{notification.Response.Body}");
                },
                AuthenticationFailed = async notification =>
                {
                    // doesn't go through here
                    Debug.WriteLine($"{notification.Response.Body}");
                },
                SecurityTokenValidated = async n =>
                {
                    // doesn't go through here
                    Debug.WriteLine($"{n.Response.Body}");
                },
                MessageReceived = async notification =>
                {
                    // doesn't go through here
                    Debug.WriteLine($"{notification.Response.Body}");
                }
            };

            app.UseCookieAuthentication(new CookieAuthenticationOptions()
            );
            app.UseOpenIdConnectAuthentication(authenticationOptions);

            Microsoft.IdentityModel.Logging.IdentityModelEventSource.Logger.LogLevel = EventLevel.Verbose;
            Microsoft.IdentityModel.Logging.IdentityModelEventSource.ShowPII = true;

            var listener = new EventListener();
            listener.EnableEvents(Microsoft.IdentityModel.Logging.IdentityModelEventSource.Logger, EventLevel.LogAlways);
            listener.EventWritten += Listener_EventWritten; // Only thing this ever logs is "generating nonce"
        }

[编辑]

我发现它在一个 ASP.NET Core项目中GetClaimsFromUserInfoEndpoint = true运行良好。但遗憾的是，旧Microsoft.Owin.Security.OpenIdConnect实现中缺少该属性......

标签： asp.net-mvcowinopenidopenid-connectkatana