asp.net-core - 当用户未分配给客户端应用程序时,使用 ASP.Net Core 的 OKTA 身份验证会引发未处理的异常
问题描述
我已通过以下教程将 OKTA 集成到我的 ASP.Net Core 应用程序中: https ://developer.okta.com/quickstart/#/okta-sign-in-page/dotnet/aspnetcore
如果将用户分配给我的 OKTA 应用程序,它可以正常工作,但如果没有,我会在授权回调中收到未处理的异常:
OpenIdConnectProtocolException:消息包含错误:'access_denied',error_description:'用户未分配给客户端应用程序。',error_uri:'error_uri 为空'。
我想捕捉这个异常并优雅地处理它。
使用 OpenId,您可以创建一个 OnRemoteFailure 事件来处理此问题,但我不知道如何使用 Okta.AspNetCore 库来执行此操作。
解决方案
Okta.AspNetCore 的默认架构是OpenIdConnectDefaults.AuthenticationScheme
:
using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
namespace Okta.AspNetCore
{
public static class OktaDefaults
{
public const string MvcAuthenticationScheme = OpenIdConnectDefaults.AuthenticationScheme;
public const string ApiAuthenticationScheme = JwtBearerDefaults.AuthenticationScheme;
public const string CallbackPath = "/authorization-code/callback";
public const string SignOutCallbackPath = "/signout/callback";
public static readonly string[] Scope = new string[] { "openid", "profile" };
}
}
因此,您可以OpenIdConnectOptions
使用上面的方案名称进行配置,包括访问OpenIdConnectEvents
:
services.AddAuthentication(options =>
{
options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
options.DefaultChallengeScheme = OktaDefaults.MvcAuthenticationScheme;
})
.AddCookie()
.AddOktaMvc(new OktaMvcOptions
{
// Replace these values with your Okta configuration
OktaDomain = Configuration.GetValue<string>("Okta:OktaDomain"),
ClientId = Configuration.GetValue<string>("Okta:ClientId"),
ClientSecret = Configuration.GetValue<string>("Okta:ClientSecret"),
});
services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
options.Events = new OpenIdConnectEvents
{
OnRedirectToIdentityProvider = async ctxt =>
{
// Invoked before redirecting to the identity provider to authenticate. This can be used to set ProtocolMessage.State
// that will be persisted through the authentication process. The ProtocolMessage can also be used to add or customize
// parameters sent to the identity provider.
await Task.Yield();
},
OnMessageReceived = async ctxt =>
{
// Invoked when a protocol message is first received.
await Task.Yield();
},
OnTicketReceived = async ctxt =>
{
// Invoked after the remote ticket has been received.
// Can be used to modify the Principal before it is passed to the Cookie scheme for sign-in.
// This example removes all 'groups' claims from the Principal (assuming the AAD app has been configured
// with "groupMembershipClaims": "SecurityGroup"). Group memberships can be checked here and turned into
// roles, to be persisted in the cookie.
await Task.Yield();
},
OnRemoteFailure = context =>
{
..........
context.HandleResponse();
context.Response.Redirect("AccessDenied?error=" + context.Failure.Message);
return Task.FromResult(0);
},
};
});
推荐阅读
- java - 通过交换染色体进行重组以产生新的基因型
- java - Android Studio - 选择高度的哪个视图元素?
- php - 名称验证问题 - 页面不使用更新的输入
- javascript - 将整数数组解码为 PNG(JavaScript、node.js)
- arrays - 按字母顺序排序上部,然后是其各自的下部,所有内容都应按排序方式
- javascript - Angular Servicer Worker 错误,Driver.onPush 出现意外标记(ngsw-worker.js:2023)
- botframework - 尝试在新的 BotframeWork Composer 中连接 QnA 知识库
- c# - 无法获取任何内容来更新页面上的 html
- javascript - 用javascript中的其他路径覆盖cookie
- haskell - 为什么在 Haskell 中最大值 (8,1) = 1?