c# - Azure 广告重定向 Uri 获取 http 而不是 https

Question

我有需要 azure ad 单点登录的 asp.net 核心项目，但我的应用程序不断将重定向 uri 作为 http 而不是 https 我尝试在启动时添加以下内容

导致 http 而不是 https 的旧启动

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"))
            // Add the possibility of acquiring a token to call a protected web API
            .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)
            // Enables controllers and pages to get GraphServiceClient by dependency injection
            // And use an in memory token cache
            .AddMicrosoftGraph(Configuration.GetSection("DownstreamApi"))
            .AddInMemoryTokenCaches();

解决重定向 uri 添加之前的代码如下

services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApp(msIdentityOption =>
            {
                msIdentityOption.ClientId = Configuration["AzureAd:ClientId"];
                msIdentityOption.Scope.Add("user.read.all");

                
                msIdentityOption.Events.OnRedirectToIdentityProvider = context =>
                {
                    context.ProtocolMessage.RedirectUri = Configuration["RedirectUrl"];
                    return Task.CompletedTask;
                };

                msIdentityOption.Instance = Configuration["AzureAd:Instance"];
                msIdentityOption.TenantId = Configuration["AzureAd:TenantId"];
                msIdentityOption.ClientSecret = Configuration["AzureAd:clientSecret"];
            })
            // Add the possibility of acquiring a token to call a protected web API
            .EnableTokenAcquisitionToCallDownstreamApi(initialScopes)

            // Enables controllers and pages to get GraphServiceClient by dependency injection
            // And use an in memory token cache
            .AddMicrosoftGraph(Configuration.GetSection("DownstreamApi"))
            .AddInMemoryTokenCaches();

它在 login.microsoftonline.com 和我的应用程序之间创建了一个重定向循环，我最终在 Microsoft 的登录页面上收到消息，我们无法让您登录我检查了我的日志，它是以下内容

A configuration issue is preventing authentication - check the error message from the server for details. You can modify the configuration in the application registration portal. See https://aka.ms/msal-net-invalid-client for details.  Original exception: AADSTS500112: The reply address 'http://mysite/signin-oidc' does not match the reply address 'https://mysite/signin-oidc' provided when requesting Authorization code.

那么无论如何要覆盖重定向uri以使其成为https

标签： c#azureasp.net-coreazure-active-directory

Answer 1

重定向 URI 在 Azure Active Directory 的应用注册窗格中设置。

如果您在此处添加“https://mysite/signin-oidc”，则必须确保您的 ASP.NET 核心应用程序也在“https://mysite/signin-oidc”上侦听传入请求以获取返回的令牌。