Blazor Server 7.0 Azure AD认证：登出重定向致登录流程异常

1. 修正登出重定向逻辑 #

你当前的登出事件处理直接中断了Azure AD的登出流程，虽然实现了跳转，但可能导致SSO会话状态异常，进而影响登录行为。正确的做法是让Azure AD完成登出后自动跳转回首页：

builder.Services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
    // 配置登出完成后的跳转目标
    options.SignedOutRedirectUri = "/";
    options.SignedOutCallbackPath = "/signout-callback-oidc";

    options.Events.OnRedirectToIdentityProviderForSignOut = async context =>
    {
        // 保留Azure AD的原生登出流程，完成后自动跳转到配置好的URI
        await Task.CompletedTask;
    };
});

2. 强制登录时显示账户选择弹窗 #

通过登录触发的OnRedirectToIdentityProvider事件，添加prompt=select_account参数，强制Azure AD忽略当前SSO会话，显示账户选择界面：

builder.Services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
    // 保留上述登出配置...

    options.Events.OnRedirectToIdentityProvider = async context =>
    {
        // 强制弹出账户选择窗口
        context.ProtocolMessage.Prompt = "select_account";
        await Task.CompletedTask;
    };
});

完整Program.cs配置示例 #

整合后的认证相关配置如下（假设你已完成Azure AD的基础注册配置）：

var builder = WebApplication.CreateBuilder(args);

builder.Services.AddRazorPages();
builder.Services.AddServerSideBlazor();
builder.Services.AddSingleton<WeatherForecastService>();

// 集成Azure AD认证
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

// 配置OpenID Connect选项
builder.Services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
    // 登出配置
    options.SignedOutRedirectUri = "/";
    options.SignedOutCallbackPath = "/signout-callback-oidc";

    options.Events.OnRedirectToIdentityProviderForSignOut = async context =>
    {
        await Task.CompletedTask;
    };

    // 登录时强制显示账户选择
    options.Events.OnRedirectToIdentityProvider = async context =>
    {
        context.ProtocolMessage.Prompt = "select_account";
        await Task.CompletedTask;
    };
});

builder.Services.AddAuthorization(options =>
{
    options.FallbackPolicy = options.DefaultPolicy;
});

var app = builder.Build();

if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();

app.MapBlazorHub();
app.MapFallbackToPage("/_Host");

app.Run();

关键说明 #

• 登出流程：依赖Azure AD原生的登出回调机制，确保身份提供商端的会话完全终止后再跳转，避免SSO残留状态影响后续登录。
• 登录行为：prompt=select_account参数会覆盖默认的SSO自动登录逻辑，强制显示账户选择界面，恢复你需要的登录体验。

内容的提问来源于stack exchange，提问作者timetrips