VS2015中ASP.Net4.5遗留应用迁移Azure AD认证失败求助

1. 修正OWIN启动方式（核心问题） #

你错误地让MvcApplication继承IOwinContext并手动实例化AppBuilder，这不符合ASP.NET 4.x中OWIN的托管规范，会导致中间件无法被正确加载。正确做法是创建独立的Startup类，由OWIN运行时自动初始化：

操作步骤： #

• 删除MvcApplication中所有IOwinContext相关的实现代码（包括_app字段、App属性及所有未实现的方法），还原MvcApplication为默认的System.Web.HttpApplication继承结构。
• 新建Startup.cs文件，代码如下：

using System;
using System.Configuration;
using System.Security.Claims;
using System.Web.Helpers;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using Microsoft.IdentityModel.Tokens;
using Microsoft.Owin;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.OpenIdConnect;
using Owin;

[assembly: OwinStartup(typeof(CCPOS_Staff_Interface123.Startup))]
namespace CCPOS_Staff_Interface123
{
    public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            ConfigureAuth(app);
        }

        private void ConfigureAuth(IAppBuilder app)
        {
            AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.NameIdentifier;

            var clientId = ConfigurationManager.AppSettings["ida:ClientId"];
            var authority = ConfigurationManager.AppSettings["ida:AADInstance"] + ConfigurationManager.AppSettings["ida:Tenant"];
            var postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];

            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
            {
                ClientId = clientId,
                Authority = authority,
                RedirectUri = "http://localhost:56026/",
                PostLogoutRedirectUri = postLogoutRedirectUri,
                ResponseType = OpenIdConnectResponseType.IdToken,
                Scope = OpenIdConnectScope.OpenIdProfile,
                TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidIssuer = authority
                },
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    RedirectToIdentityProvider = n =>
                    {
                        if (n.ProtocolMessage.RequestType == OpenIdConnectRequestType.Logout)
                        {
                            var idTokenHint = n.OwinContext.Authentication.User.FindFirst("id_token");
                            if (idTokenHint != null)
                            {
                                n.ProtocolMessage.IdTokenHint = idTokenHint.Value;
                            }
                        }
                        return System.Threading.Tasks.Task.FromResult(0);
                    },
                    AuthenticationFailed = n =>
                    {
                        n.HandleResponse();
                        n.Response.Redirect("/Error?message=" + n.Exception.Message);
                        return System.Threading.Tasks.Task.FromResult(0);
                    }
                }
            });
        }
    }
}

2. 配置授权触发规则 #

在需要强制认证的控制器或Action上添加[Authorize]特性，示例：

[Authorize]
public class HomeController : Controller
{
    public ActionResult Index()
    {
        return View();
    }
}

没有该特性，系统不会自动触发登录跳转逻辑。

3. 验证Web.config配置 #

确保配置项完整且OWIN模块正确注册：

<appSettings>
  <add key="ida:AADInstance" value="https://login.microsoftonline.com/" />
  <add key="ida:Tenant" value="你的租户ID或域名" />
  <add key="ida:ClientId" value="你的Azure AD应用客户端ID" />
  <add key="ida:PostLogoutRedirectUri" value="http://localhost:56026/" />
</appSettings>

<system.webServer>
  <modules>
    <remove name="FormsAuthentication" />
    <add name="Owin" type="Microsoft.Owin.Host.SystemWeb.OwinHttpModule, Microsoft.Owin.Host.SystemWeb" />
  </modules>
</system.webServer>

4. 解决身份认证方式冲突 #

在项目属性中关闭Windows Authentication，启用Anonymous Authentication，避免多种认证方式冲突导致逻辑异常。

5. 兼容依赖包版本 #

确保安装的OWIN相关NuGet包版本适配.NET 4.5，推荐版本：

• Microsoft.Owin ~= 3.1.0
• Microsoft.Owin.Security.Cookies ~= 3.1.0
• Microsoft.Owin.Security.OpenIdConnect ~= 3.1.0
• Microsoft.IdentityModel.Protocols.OpenIdConnect ~= 2.1.1

6. 启用日志排查问题 #

在Startup.cs的Configuration方法开头添加日志代码，便于定位异常：

app.UseErrorPage();
app.Use(async (context, next) =>
{
    var logger = context.Get<ILogger>("Microsoft.Owin.Logger");
    logger?.WriteInformation("OWIN请求启动");
    await next();
});

内容的提问来源于stack exchange，提问作者Developer