ASP.NET MVC中Azure AD(Entra ID)授权失效问题求助

问题描述 #

我正在基于Azure AD（Entra ID）实现ASP.NET MVC的授权过滤器，已在Azure中创建三个角色并为用户分配对应角色。应用已成功通过Azure完成身份验证，但授权功能异常：所有已认证用户均可访问https://localhost:sslport/和https://localhost:sslport/Dashboard，但访问https://localhost:sslport/Dashboard/Settings、https://localhost:sslport/Dashboard/Administrator、https://localhost:sslport/Dashboard/Poweruser时均被拒绝访问。

相关配置代码 #

appsettings.json 配置 #

"AzureAd": {
  "Instance": "https://login.microsoftonline.com/",
  "Domain": "qualified.domain.name",
  "TenantId": "d1d5fe91-a895-45d7-964a-8ae51ff19d03",
  "ClientId": "ac748c0f-f4f1-4351-b317-977d2edb81e1",
  "CallbackPath": "/Signin-oidc",
  "SignoutcallbackUrl": "/Signout-oidc"
}

Startup.cs 代码 #

using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Builder;
using Microsoft.AspNetCore.Hosting;
using Microsoft.AspNetCore.HttpsPolicy;
using Microsoft.AspNetCore.Identity;
using Microsoft.AspNetCore.Mvc.Authorization;
using Microsoft.Extensions.Configuration;
using Microsoft.Extensions.DependencyInjection;
using Microsoft.Extensions.Hosting;
using Microsoft.Identity.Web;
using Microsoft.Identity.Web.UI;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Threading.Tasks;

namespace AzureADRoles
{
    public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        public void ConfigureServices(IServiceCollection services)
        {
            services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
                .AddMicrosoftIdentityWebApp(Configuration.GetSection("AzureAd"));

            services.AddAuthorization(options =>
            {
                options.AddPolicy("RequireAdminRole", policy => policy.RequireRole("Administrator"));
                options.AddPolicy("RequirePoweruserRole", policy => policy.RequireRole("Poweruser"));
                options.AddPolicy("RequireUserRole", policy => policy.RequireRole("User"));
            });

            services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
            {
                // Set RoleClaimType to "groups" to use Azure AD groups as roles
                options.TokenValidationParameters.RoleClaimType = "groups";
            });

            services.AddControllersWithViews(options =>
            {
                var policy = new AuthorizationPolicyBuilder()
                    .RequireAuthenticatedUser()
                    .Build();
                options.Filters.Add(new AuthorizeFilter(policy));
            });

            services.AddRazorPages()
                    .AddMicrosoftIdentityUI();
        }

        public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler("/Home/Error");
                app.UseHsts();
            }
            app.UseHttpsRedirection();
            app.UseStaticFiles();

            app.UseRouting();

            app.UseAuthentication();
            app.UseAuthorization();

            app.UseEndpoints(endpoints =>
            {
                endpoints.MapControllerRoute(
                    name: "default",
                    pattern: "{controller=Home}/{action=Index}/{id?}");
                endpoints.MapRazorPages();
            });
        }
    }
}

DashboardController.cs 代码 #

using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;
using System.Linq;

namespace AzureADRoles.Controllers
{
    //[Authorize(Roles = "Administrator,Poweruser,User")]
    public class DashboardController : Controller
    {
        public IActionResult Index()
        {
            return View();
        }

        [Authorize(Policy = "RequireUserRole")]
        public IActionResult Settings()
        {
            return View();
        }

        [Authorize(Policy = "RequireAdminRole")]
        public IActionResult Administrator()
        {
            return View();
        }

        [Authorize(Policy = "RequirePoweruserRole")]
        public IActionResult Poweruser()
        {
            return View();
        }
    }
}

问题根源与修复步骤 #

1. 修正角色声明类型配置 #

当前代码将RoleClaimType设置为"groups"，这是针对Azure AD安全组的配置，但你实际使用的是应用角色，应改为"roles"：

services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
    // 应用角色对应的声明类型为"roles"
    options.TokenValidationParameters.RoleClaimType = "roles";
});

2. 确认Azure AD应用角色配置与分配 #

• 登录Azure门户，进入应用注册的应用角色页面，确认Administrator、Poweruser、User三个角色已正确创建。
• 进入企业应用找到该应用，在用户和组中验证目标用户已被分配对应角色。

3. 验证令牌中的角色声明 #

在Dashboard的Index方法中添加调试代码，检查用户的声明集合是否包含roles类型的声明：

public IActionResult Index()
{
    var userClaims = User.Claims.Select(c => $"{c.Type}: {c.Value}");
    // 可将userClaims输出到日志或View中查看
    return View(userClaims);
}

如果令牌中没有roles声明，需检查应用注册的令牌配置，确保ID Token已启用并包含角色声明。

4. 简化授权逻辑（可选） #

若无需复杂策略，可直接在Action上使用角色名称授权，省略自定义策略：

[Authorize(Roles = "User")]
public IActionResult Settings()
{
    return View();
}

[Authorize(Roles = "Administrator")]
public IActionResult Administrator()
{
    return View();
}

内容的提问来源于stack exchange，提问作者StudentQuant