QA服务器部署后ASP.NET MVC应用AzureAD认证跳转URL异常

问题现象 #

本地测试ASP.NET MVC应用的Azure AD认证功能正常，但部署到QA服务器后，认证请求跳转的URL未指向Azure AD的权威地址https://login.microsoftonline.com/，而是错误拼接了QA服务器域名与租户ID：

• 实际生成的跳转URL：https://qa1eu.keepapp.com/XXXXXXXXX-XXXX-0000-a89c-35XXXXXXXXcXX/oauth2/v2.0/authorize
• 期望的跳转URL：https://login.microsoftonline.com/XXXXXXXXX-XXXX-0000-a89c-35XXXXXXXXcXX/oauth2/v2.0/authorize

现有代码与配置 #

Startup.cs #

private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
private static string aadInstance = EnsureTrailingSlash(ConfigurationManager.AppSettings["ida:AADInstance"]);
private static string tenantId = ConfigurationManager.AppSettings["ida:TenantId"];
private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];
private static string authority = aadInstance + tenantId + "/v2.0";

public void Configuration(IAppBuilder app)
{
    var timeoutInMinutes = int.Parse(ConfigurationManager.AppSettings["Authentication.Timeout"]);
    string BaseUri = ConfigurationManager.AppSettings["BaseURL"];

    app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

    IdentityModelEventSource.ShowPII = true;
    System.Net.ServicePointManager.SecurityProtocol = System.Net.SecurityProtocolType.Tls12;

    var expireTimeSpan = TimeSpan.FromMinutes(timeoutInMinutes);
    app.UseCookieAuthentication(new CookieAuthenticationOptions()
    {
        SlidingExpiration = true,
        ExpireTimeSpan = expireTimeSpan,
        CookieName = "AuthCookie",
        CookieSecure = CookieSecureOption.SameAsRequest,
        AuthenticationMode = AuthenticationMode.Active
    });
    app.UseOpenIdConnectAuthentication(
    new OpenIdConnectAuthenticationOptions
    {
        ClientId = clientId,
        Authority = authority,
        RedirectUri = BaseUri,
        AuthenticationMode = AuthenticationMode.Passive,
        PostLogoutRedirectUri = postLogoutRedirectUri,
        Scope = OpenIdConnectScope.OpenIdProfile,
        ResponseType = OpenIdConnectResponseType.IdToken,
        TokenValidationParameters = new TokenValidationParameters()
        {
            ValidateIssuer = false
        },
        Notifications = new OpenIdConnectAuthenticationNotifications
        {
            AuthenticationFailed = OnAuthenticationFailed,
            SecurityTokenValidated = (context) =>
            {
                string name = context.AuthenticationTicket.Identity.FindFirst("preferred_username").Value;
                context.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Name, name, string.Empty));
                context.AuthenticationTicket.Properties.RedirectUri = BaseUri;
                context.AuthenticationTicket.Properties.IsPersistent = true;
                context.AuthenticationTicket.Properties.AllowRefresh = true;
                context.AuthenticationTicket.Properties.ExpiresUtc = new DateTimeOffset(DateTime.UtcNow.AddMinutes(timeoutInMinutes));

                return Task.FromResult(0);
            }
        }
    });
}

web.config配置 #

<add key="ida:ClientId" value="XXXXXXXX-0000-0000-a1b1-c51dXXXXXXXX" />
<add key="ida:AADInstance" value="https://login.microsoftonline.com/" />
<add key="ida:Domain" value="keepapp.com" />
<add key="ida:TenantId" value="XXXXXXXXX-XXXX-0000-a89c-35XXXXXXXXcXX" />
<add key="ida:PostLogoutRedirectUri" value="https://qa1eu.keepapp.com/PortalSP/signin-oidc" />
<add key="BaseURL" value="https://qa1eu.keepapp.com/PortalSP" />
<add key="autoFormsAuthentication" value="false" />
<add key="enableSimpleMembership" value="false"/>

解决方案 #

1. 修复Authority拼接逻辑 #

问题根源大概率在EnsureTrailingSlash方法的实现上，该方法在QA环境中可能未正确处理ida:AADInstance的取值，导致aadInstance为空或无效，最终authority被拼接成相对路径，被中间件自动补充为服务器域名。

直接替换原拼接逻辑，避免依赖不确定的工具方法：

// 替换原authority定义，手动处理斜杠确保格式正确
private static string authority = $"{ConfigurationManager.AppSettings["ida:AADInstance"].TrimEnd('/')}/{tenantId}/v2.0";

2. 验证QA服务器配置 #

• 登录QA服务器，检查web.config中的ida:AADInstance配置是否确实为https://login.microsoftonline.com/，避免部署时配置被覆盖或遗漏。
• 确认配置项无多余空格、换行或特殊字符。

3. 输出日志排查Authority值 #

在Configuration方法中添加日志，确认authority变量的实际取值：

// 添加日志输出，检查Authority的实际值
System.Diagnostics.Trace.WriteLine($"Authority实际值：{authority}");

如果输出结果不是https://login.microsoftonline.com/[租户ID]/v2.0，则说明配置读取或拼接过程存在问题。

4. 升级中间件版本 #

检查Microsoft.Owin.Security.OpenIdConnect包的版本，旧版本可能存在相对路径处理的bug，升级到最新稳定版可解决此类异常。

内容的提问来源于stack exchange，提问作者pradeepmanker