ASP.NET Core 3.1集成Azure AD认证遇登录加载异常求助

核心问题分析与修复步骤 #

1. 避免在ConfigureServices中提前构建服务容器 #

直接调用services.BuildServiceProvider()会创建临时服务容器，可能导致依赖服务未正确初始化。改用PostConfigure延迟加载Azure AD配置：

services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
    .AddAzureAD(options => Configuration.Bind("AzureAD", options));

// 延迟加载动态配置
services.PostConfigure<AzureADOptions>(AzureADDefaults.AuthenticationScheme, options =>
{
    var azureADSettingService = services.BuildServiceProvider().GetService<IAzureADSettingService>();
    var azure = azureADSettingService.GetBySubDomain(Subdomain);
    
    options.ClientId = azure.ClientId;
    options.ClientSecret = azure.ClientSecret;
    options.TenantId = azure.TenantId;
    options.Instance = azure.Instance;
    options.Domain = azure.Domain;
    options.CallbackPath = azure.CallbackPath;
});

2. 调整CookiePolicy配置，避免阻止认证Cookie #

CheckConsentNeeded = true会拦截非必要Cookie，而Azure AD认证Cookie属于必要范畴，需修改配置：

services.Configure<CookiePolicyOptions>(options =>
{
    // 仅对非认证路径要求Cookie同意
    options.CheckConsentNeeded = context => !context.Request.Path.StartsWithSegments(options.CallbackPath);
    options.MinimumSameSitePolicy = SameSiteMode.Lax;
    options.HttpOnly = Microsoft.AspNetCore.CookiePolicy.HttpOnlyPolicy.None;
    options.Secure = CookieSecurePolicy.Always;
    options.ConsentCookie.IsEssential = true;
});

如果业务不需要Cookie同意提示，可直接设置CheckConsentNeeded = false。

3. 修正中间件执行顺序 #

Session中间件必须在Authentication之前启用，CookiePolicy需放在最前面：

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // 静态文件等前置中间件...
    
    app.UseCookiePolicy();
    app.UseSession();
    
    app.UseRouting();
    app.UseAuthentication();
    app.UseAuthorization();
    
    // 端点路由配置
    app.UseEndpoints(endpoints =>
    {
        endpoints.MapControllerRoute(
            name: "default",
            pattern: "{controller=Home}/{action=Index}/{id?}");
    });
}

4. 正确处理回调路由与登录状态 #

确保回调Action存在并正确处理Azure AD返回的认证结果，同时传递原跳转路径：

[HttpGet]
[AllowAnonymous]
public IActionResult Login(string returnUrl = null)
{
    var redirectUrl = Url.Action("SigningMicrosoft", "Account", new { returnUrl }, Request.Scheme);
    return Challenge(
        new AuthenticationProperties { RedirectUri = redirectUrl }, AzureADDefaults.AuthenticationScheme);
}

// Azure AD回调处理Action
[HttpGet]
[AllowAnonymous]
public async Task<IActionResult> SigningMicrosoft(string returnUrl = null)
{
    var authResult = await HttpContext.AuthenticateAsync(AzureADDefaults.AuthenticationScheme);
    if (!authResult.Succeeded)
    {
        return RedirectToAction("Login");
    }

    // 关联Azure AD用户与本地Identity用户逻辑
    var claimsPrincipal = authResult.Principal;
    // ...用户创建/关联代码

    // 登录本地Identity系统
    await HttpContext.SignInAsync(IdentityConstants.ApplicationScheme, claimsPrincipal);
    
    return LocalRedirect(returnUrl ?? Url.Action("Index", "Home"));
}

5. 协调Identity与Azure AD认证方案 #

同时使用两种认证时，需明确默认方案优先级：

services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = IdentityConstants.ApplicationScheme;
    options.DefaultChallengeScheme = AzureADDefaults.AuthenticationScheme;
    options.DefaultSignInScheme = IdentityConstants.ExternalScheme;
})
.AddAzureAD(options =>
{
    // Azure AD基础配置
})
.AddIdentity<IdentityUser, IdentityRole>(options =>
{
    // Identity相关配置
})
.AddEntityFrameworkStores<ApplicationDbContext>()
.AddDefaultTokenProviders();

额外排查点 #

• 确认Azure AD应用注册的重定向URI与代码中CallbackPath完全一致（注意HTTPS协议和路径大小写）。
• 检查Azure AD应用是否已授予User.Read等必要API权限。
• 查看浏览器控制台网络请求，排查是否存在重定向循环或Cookie被拦截的错误。
• 启用认证日志查看详细错误：

  // appsettings.json
  {
    "Logging": {
      "LogLevel": {
        "Microsoft.AspNetCore.Authentication": "Debug",
        "Microsoft.AspNetCore.Authentication.AzureAD": "Debug"
      }
    }
  }
  

内容的提问来源于stack exchange，提问作者Lucas