如何将SAML2 Shibboleth集成至基于ASP.NET Identity的Blazor Server应用

1. 确认Shibboleth的用户属性传递 #

由于你的服务器已配置/Secure路径重定向到IDP，Shibboleth会在用户认证完成后，通过HTTP请求头将用户核心属性传递给Blazor应用。需确保服务器已启用以下常用属性的头传递：

• eppn：用户唯一标识符（通常是邮箱格式）
• mail：用户邮箱
• givenName/sn：用户的名/姓
• Shib-Identity-Provider：用户登录的IDP地址

2. 编写自定义中间件提取SAML数据并关联Identity #

创建中间件拦截/Secure回调请求，提取头信息后创建或匹配ASP.NET Identity用户，完成登录：

public class ShibbolethAuthMiddleware
{
    private readonly RequestDelegate _next;

    public ShibbolethAuthMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    public async Task InvokeAsync(HttpContext context, UserManager<IdentityUser> userManager, SignInManager<IdentityUser> signInManager)
    {
        if (context.Request.Path.StartsWithSegments("/Secure"))
        {
            // 提取Shibboleth传递的用户属性
            var eppn = context.Request.Headers["eppn"].FirstOrDefault();
            var email = context.Request.Headers["mail"].FirstOrDefault() ?? eppn;
            var firstName = context.Request.Headers["givenName"].FirstOrDefault();
            var lastName = context.Request.Headers["sn"].FirstOrDefault();

            if (string.IsNullOrEmpty(eppn))
            {
                context.Response.StatusCode = StatusCodes.Status401Unauthorized;
                await context.Response.WriteAsync("无法获取SAML用户标识");
                return;
            }

            // 查找或创建Identity用户
            var user = await userManager.FindByEmailAsync(email);
            if (user == null)
            {
                user = new IdentityUser
                {
                    UserName = eppn,
                    Email = email,
                    EmailConfirmed = true // Shibboleth认证用户默认邮箱已验证
                };
                var createResult = await userManager.CreateAsync(user);
                if (!createResult.Succeeded)
                {
                    context.Response.StatusCode = StatusCodes.Status500InternalServerError;
                    await context.Response.WriteAsync($"创建用户失败: {string.Join(", ", createResult.Errors.Select(e => e.Description))}");
                    return;
                }
            }

            // 执行Identity登录
            await signInManager.SignInAsync(user, isPersistent: false);
            // 登录成功后重定向到Blazor主页
            context.Response.Redirect("/");
            return;
        }

        await _next(context);
    }
}

// 扩展方法注册中间件
public static class ShibbolethAuthMiddlewareExtensions
{
    public static IApplicationBuilder UseShibbolethAuthentication(this IApplicationBuilder builder)
    {
        return builder.UseMiddleware<ShibbolethAuthMiddleware>();
    }
}

3. 配置中间件管道 #

在Program.cs中，将自定义中间件添加到认证授权流程之后：

var builder = WebApplication.CreateBuilder(args);

// 注册ASP.NET Identity服务
builder.Services.AddDefaultIdentity<IdentityUser>(options => options.SignIn.RequireConfirmedAccount = false)
    .AddEntityFrameworkStores<ApplicationDbContext>();

// 其他服务注册...

var app = builder.Build();

// 中间件管道配置
if (app.Environment.IsDevelopment())
{
    app.UseDeveloperExceptionPage();
}
else
{
    app.UseExceptionHandler("/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();
app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();

// 添加Shibboleth认证中间件
app.UseShibbolethAuthentication();

app.MapBlazorHub();
app.MapFallbackToPage("/_Host");

app.Run();

4. 实现Blazor端登录/退出逻辑 #

在Blazor组件中添加登录入口和退出功能：

<AuthorizeView>
    <Authorized>
        <p>欢迎, @context.User.Identity.Name!</p>
        <button @onclick="Logout">退出登录</button>
    </Authorized>
    <NotAuthorized>
        <a href="/Secure">使用Shibboleth登录</a>
    </NotAuthorized>
</AuthorizeView>

@code {
    [Inject]
    private SignInManager<IdentityUser> SignInManager { get; set; }
    [Inject]
    private NavigationManager NavigationManager { get; set; }

    private async Task Logout()
    {
        await SignInManager.SignOutAsync();
        // 可选：重定向到Shibboleth全局退出页面
        NavigationManager.NavigateTo("/Shibboleth.sso/Logout?return=https://your-app-domain.com");
    }
}

5. 关键注意事项 #

• 确保Shibboleth SP配置中已正确映射用户属性到HTTP头，避免属性缺失
• Blazor Server依赖SignalR，需确保Shibboleth会话与ASP.NET Core会话兼容，防止认证状态丢失
• 敏感属性传递需确保服务器端加密，避免数据泄露
• 可扩展IdentityUser添加自定义字段，存储更多SAML返回的用户属性

内容的提问来源于stack exchange，提问作者Bruno Silva