.NET 8 Blazor Server集成Azure AD B2C遇IDX40001发行者匹配错误

补充说明 #

该问题出在.NET 8 Blazor应用上。

我使用CLI命令创建了基于net7.0的全新Blazor Server项目：dotnet new blazorserver -au IndividualB2C -o blazor.server.net7，集成B2C后运行正常 ✨。

切换到.NET 8后出现错误：

尝试用类似命令创建net8.0项目并自动配置身份验证（-au IndividualB2C），但该选项目前在.NET 8中不可用：

此外，Visual Studio 17.8.0 Preview 2.0也没有选择身份验证类型的窗口。

于是我在Mac上用Rider创建新的net8.0项目，添加必要NuGet包并从net7.0项目复制身份验证配置，但问题依旧。

原帖内容 #

我正尝试将.NET 8 Blazor Web App（服务器端）与Azure AD B2C集成，实现用户登录并调用受保护API。

Web应用启动后会跳转到登录页面，可正常输入凭据：

点击“登录”后，页面在以下URL持续加载：

https://munsonpickles3.b2clogin.com/munsonpickles3.onmicrosoft.com/b2c_1_signupsignin/oauth2/v2.0/authorize?client_id=171b3d8f-8ff1-48b7-a5be-31b0413929ee&redirect_uri=https%3A%2F%2Flocalhost%3A7032%2Fsignin-oidc&response_type=code&scope=openid%20profile%20offline_access%20https%3A%2F%2Fmunsonpickles3.onmicrosoft.com%2Fmunson-api%2Fread&code_challenge=abcDe8FGl6jNrCyWPls56yaKjYuohGtD6vUpSgJe6nA&code_challenge_method=S256&response_mode=form_post&nonce=638123410660191340.YjRmNjYkOTOtN2IkNi00YzgxLTg0ZGEtMTRjNTIxZjcxOWJhMzYwZDk1ZDItOGIxNy00NTRiLThiMzgtOWM2MmVkZTlhYjc1&client_info=1&x-client-brkrver=IDWeb.2.14.0.0&state=CfDJ8L8UGyfUjDBErg6qYS34nXD3E0mLxkSA-InrXSkiEcmt8_eHquvuIC-GnidwO47o_SdGzL58675xXvBYP49rsnKjKti0bUUM1FvXyK5N7-AnYGdzo9SqoahAP5Ps7ykpi93LFX-Uis3xf068-S61dmuEn-8FmIKR3TOxzYJrKxAbG6dbymelCxbJ8xpESofmPRBQ9yKCi4flT8yTOFBtOszKtg2GTmxy9MMeX3edKDxpuTniV4YNXzzw-NpSL7DRHRLYSpbrOasGhk_dUrY0WWL3CY_43FmiKUSLiO60JheXpqYL_D53MA6nf0InABDhmkBNroqZgo7Qnv2hpgXSefZOLNgWkdcyTY8Pe-ZvCPX0ncBfkgqFFmQCNjXip-j0PnjRDLgHlldx70qi9ecSKdXgqvuW8a17QjrrEDAHUSCU&x-client-SKU=ID_NET8_0&x-client-ver=7.0.0.0

最终重定向出现431错误（Cookie过多）：

IDE控制台报错：
Microsoft.IdentityModel.Tokens.SecurityTokenInvalidIssuerException: IDX40001: Issuer: 'https://munsonpickles3.b2clogin.com/f6c04159-d728-43cd-8ae1-c1f3793844d5/v2.0/', does not match any of the valid issuers provided for this application.

检查appsettings.json配置，与AADB2C应用注册信息一致：

"AzureAdB2C": {
    "Instance": "https://munsonpickles3.b2clogin.com/",
    "Domain": "munsonpickles3.onmicrosoft.com",
    "ClientId": "12345d8f-8ff1-48b7-a5be-31b041312345",
    "CallbackPath": "/signin-oidc",
    "ClientSecret": "12345~6MzNJ3yk.YTq9iP51R1niJFWuxaGx12345",
    "SignedOutCallbackPath": "/signout/B2C_1_SignUpSignIn",
    "SignUpSignInPolicyId": "B2C_1_SignUpSignIn",
    "ResetPasswordPolicyId": "",
    "EditProfilePolicyId": ""
  }

重定向URL已正确设置：

将重定向URL指向jwt.ms查看，发行者与报错信息一致：

Issuer: 'https://munsonpickles3.b2clogin.com/f6c04159-d728-43cd-8ae1-c1f3793844d5/v2.0/', does not match any of the valid issuers provided for this application.

已查阅所有相关文档并按步骤操作，耗时两天仍未解决问题。

异常信息 #

fail: Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter[0]
      IDX40001: Issuer: 'https://munsonpickles3.b2clogin.com/f6c04159-d728-43cd-8ae1-c1f3793844d5/v2.0/', does not match any of the valid issuers provided for this application. 
fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[17]
      Exception occurred while processing message.
      Microsoft.IdentityModel.Tokens.SecurityTokenInvalidIssuerException: IDX40001: Issuer: 'https://munsonpickles3.b2clogin.com/f6c04159-d728-43cd-8ae1-c1f3793844d5/v2.0/', does not match any of the valid issuers provided for this application. 
         at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.ValidateTokenUsingHandlerAsync(String idToken, AuthenticationProperties properties, TokenValidationParameters validationParameters)
         at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()

日志信息 #

开启PII日志后内容如下：

info: Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter[0]
      IDX10242: Security token: 'eyJhbGciOiJSUzI1NiIsImtpZCI6Ilg1ZVhrNHh5b2pORnVtMWtsMll0djhkbE5QNC1jNTdkTzZRR1RWQndhTmsiLCJ0eXAiOiJKV1QifQ.eyJ2ZXIiOiIxLjAiLCJpc3MiOiJodHRwczovL211bnNvbnBpY2ts12345mIyY2xvZ2luLmNvbS9mNmMwNDE1OS1kNzI4LTQzY2QtOGFlMS1jMWYzNzkzODQ0ZDUvdjIuMC8iLCJzdWIiOiJjMDg1NTY2My02NjBiLTQ0YTEtOTkwNC00MzM5ZjVlNWU5YTIiLCJhdWQiOiIxNzFiM2Q4Zi04ZmYxLTQ4YjctYTViZS0zMWIwNDEzOTU1ZWUiLCJleHAiOjE2OTYwMj12345sIm5vbmNlIjoiNjM4MzE2MTYxODUxNzIwNjIwLk9UUmtNR0V5WTJRdFlUazROQzAwTjJRMUxUZzVZalV0TnpobU5EZ3dZekZsTlRRM1pHRmpNbVkxT1RRdE9XWTJOaTAwTWpaaUxUaGxaREF0WVRnd1pUYzBNekk0TVdGbCIsImlhdCI6MTY5NjAxOTM4NSwiYXV0aF90aW1lIjoxNjk2MDE5Mzg1LCJjb3VudHJ5IjoiVW5pdGVkIFN0YXRlcyIsIm5hbWUiOiJBc2hpc2ggS2hhbmFsIiwidGZwIjoiQjJDXzFfU2lnblVwU2lnbkluIiwibmJmIjoxNjk2MDE5Mzg1fQ' has a valid signature.
info: Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter[0]
      IDX10239: Lifetime of the token is valid.
info: Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter[0]
      IDX10234: Audience Validated.Audience: '12345d8f-8ff1-48b7-a5be-31b041312345'
fail: Microsoft.IdentityModel.LoggingExtensions.IdentityLoggerAdapter[0]
      IDX40001: Issuer: 'https://munsonpickles3.b2clogin.com/f6c04159-d728-43cd-8ae1-c1f3793844d5/v2.0/', does not match any of the valid issuers provided for this application. 
fail: Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler[17]
      Exception occurred while processing message.
      Microsoft.IdentityModel.Tokens.SecurityTokenInvalidIssuerException: IDX40001: Issuer: 'https://munsonpickles3.b2clogin.com/f6c04159-d728-43cd-8ae1-c1f3793844d5/v2.0/', does not match any of the valid issuers provided for this application. 
         at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.ValidateTokenUsingHandlerAsync(String idToken, AuthenticationProperties properties, TokenValidationParameters validationParameters)
         at Microsoft.AspNetCore.Authentication.OpenIdConnect.OpenIdConnectHandler.HandleRemoteAuthenticateAsync()

.NET版本 #

8.0.100-preview.7.23376.3

其他信息 #

已在aspnetcore GitHub仓库提交该问题。

内容的提问来源于stack exchange，提问作者Ash K