ASP.NET Web Forms中OpenIdConnect SaveTokens致Request.IsAuthenticated=false问题

问题背景 #

基于.NET Framework 4.7的ASP.NET Web Forms应用，采用CookieAuthentication与OpenIdConnect认证对接Azure Active Directory，需获取access_token调用下游API。已完成应用注册配置：客户端应用注册勾选了颁发Access Tokens和ID tokens，API应用注册的作用域已添加至客户端OpenIdConnectAuthentication配置中。

当前用户认证访问流程正常，即使添加RedeemToken = true也无问题，但一旦设置SaveTokens = true，Request.IsAuthenticated属性始终为false；移除SaveTokens = true后，Request.IsAuthenticated恢复正常，但无法获取token。

当前配置 #

OWIN中间件配置 #

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    CookieManager = new SystemWebCookieManager()
});

app.UseOpenIdConnectAuthentication(
    new OpenIdConnectAuthenticationOptions
    {
        ClientId = clientId,
        ClientSecret = "clientSecret",
        Authority = authority,
        PostLogoutRedirectUri = postLogoutRedirectUri,
        RedirectUri = postLogoutRedirectUri,

        ResponseType = OpenIdConnectResponseType.Code,                    
        SaveTokens = true,                    
        Scope = "openid offline_access api://<api>/api-access",
        RedeemCode = true
    });

验证请求认证状态及获取token的代码 #

protected void Page_Load(object sender, EventArgs e)
{
    if (Request.IsAuthenticated)
    {
        var result = Request.GetOwinContext().Authentication.AuthenticateAsync("Cookies").Result;
        string token = result.Properties.Dictionary["access_token"];
    } 
}

原因分析及解决办法 #

1. 认证类型不匹配（核心原因） #

OpenIdConnect中间件默认的AuthenticationType是OpenIdConnectAuthenticationDefaults.AuthenticationType，而Cookie认证中间件默认使用CookieAuthenticationDefaults.AuthenticationType（即字符串"Cookies"）。当设置SaveTokens = true时，中间件会自动将token保存到认证票据的Properties中，但如果未明确指定OpenIdConnect的SignInAsAuthenticationType，会导致认证票据存储的上下文与Cookie认证的上下文不匹配，最终让Request.IsAuthenticated无法识别已认证状态。

解决办法：在OpenIdConnectAuthenticationOptions中添加SignInAsAuthenticationType配置，确保与Cookie认证的AuthenticationType一致：

app.UseOpenIdConnectAuthentication(
    new OpenIdConnectAuthenticationOptions
    {
        // 其他原有配置...
        SignInAsAuthenticationType = CookieAuthenticationDefaults.AuthenticationType, // 或直接写"Cookies"
        SaveTokens = true,
        // 其他原有配置...
    });

2. SystemWebCookieManager兼容性问题 #

在ASP.NET Web Forms环境中，SystemWebCookieManager与OWIN的Cookie处理机制可能存在冲突。当SaveTokens = true时，token数据会被写入Cookie，可能导致Cookie格式或大小超出预期，进而影响认证票据的正常读取。

解决办法：尝试移除CookieManager = new SystemWebCookieManager()配置，使用OWIN默认的Cookie管理器；若必须保留该配置，需明确设置Cookie的名称、路径等参数，避免冲突：

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    CookieName = ".AspNet.Cookies",
    CookiePath = "/",
    CookieManager = new SystemWebCookieManager()
});

3. 手动处理Token存储替代自动SaveTokens #

如果上述方案无效，可以通过自定义OpenIdConnect的AuthorizationCodeReceived事件，手动兑换并存储token，替代SaveTokens = true的自动处理逻辑，既能保证token正常存储，又能避免认证状态异常。

解决办法：修改OpenIdConnect配置，添加Notifications并关闭SaveTokens：

app.UseOpenIdConnectAuthentication(
    new OpenIdConnectAuthenticationOptions
    {
        ClientId = clientId,
        ClientSecret = "clientSecret",
        Authority = authority,
        PostLogoutRedirectUri = postLogoutRedirectUri,
        RedirectUri = postLogoutRedirectUri,

        ResponseType = OpenIdConnectResponseType.Code,                    
        SaveTokens = false, // 关闭自动存储
        Scope = "openid offline_access api://<api>/api-access",
        RedeemCode = true,
        SignInAsAuthenticationType = CookieAuthenticationDefaults.AuthenticationType,
        Notifications = new OpenIdConnectAuthenticationNotifications
        {
            AuthorizationCodeReceived = async (context) =>
            {
                // 手动兑换Authorization Code获取token
                var credential = new ClientCredential(clientId, clientSecret);
                var authContext = new AuthenticationContext(authority, new TokenCache());
                var tokenResult = await authContext.AcquireTokenByAuthorizationCodeAsync(
                    context.Code, 
                    new Uri(context.RedirectUri), 
                    credential, 
                    "api://<api>/api-access");

                // 将token手动存入认证票据的Properties
                context.AuthenticationTicket.Properties.Dictionary["access_token"] = tokenResult.AccessToken;
                context.AuthenticationTicket.Properties.Dictionary["refresh_token"] = tokenResult.RefreshToken;
            }
        }
    });

验证代码优化 #

建议避免使用.Result同步调用异步方法，若页面支持异步，可修改为异步处理：

protected async void Page_Load(object sender, EventArgs e)
{
    if (Request.IsAuthenticated)
    {
        var result = await Request.GetOwinContext().Authentication.AuthenticateAsync("Cookies");
        string token = result.Properties.Dictionary["access_token"];
    } 
}

内容的提问来源于stack exchange，提问作者Serge