如何为部署在Azure上的ASP Classic应用启用身份验证？Azure环境下ASP Classic应用配置Active Directory认证的可行性及方案咨询

Absolutely doable! Azure App Service has native support for ASP Classic apps, and integrating Azure Active Directory (AAD) authentication is straightforward—you won’t need to gut your existing ASP code to make this work. Let’s break down how to pull this off:

1. Get Your ASP Classic App Hosted on Azure App Service #

First things first, you’ll need to get your app deployed to Azure:

• Pick the right App Service plan: Go with a Windows-based Basic/B1 tier or higher (the free tier might lock you out of some necessary features). Windows plans support the ASP Classic runtime and any COM components your app relies on.
• Deploy your app: Use FTP, GitHub Actions, Azure DevOps, or just zip up your app and upload it directly via the Azure portal—same as you would for a regular ASP.NET app.
• Tweak runtime settings: In your App Service’s Configuration > General Settings, set the .NET Framework version to v2.0 (ASP Classic depends on this) and enable 32-bit applications if your app uses 32-bit COM components.

2. Set Up AAD Authentication (No Code Changes Needed!) #

Azure App Service handles the heavy lifting of authentication for you—you don’t have to write any login logic:

1. In the Azure portal, navigate to your App Service and open the Authentication blade. Click Add identity provider.
2. Choose Microsoft as the provider, then select your AAD tenant (defaults to your current subscription’s tenant, but you can specify another if needed).
3. Configure the login behavior: Set it to Require authentication so any unauthenticated requests get redirected to the AAD login page automatically.
4. Optional extras: You can restrict access to specific user groups, set a custom login page URL, or configure a logout path here too.

3. Access User Info in Your ASP Classic Code #

Once users log in via AAD, App Service injects their identity details into request headers. You can pull these into your ASP code easily:

• User ID: Request.ServerVariables("HTTP_X_MS_CLIENT_PRINCIPAL_ID")
• User email/username: Request.ServerVariables("HTTP_X_MS_CLIENT_PRINCIPAL_NAME")
• User groups (comma-separated IDs): Request.ServerVariables("HTTP_X_MS_CLIENT_PRINCIPAL_GROUPS")

Here’s a quick example to display user info:

<%
Dim userId, userName
userId = Request.ServerVariables("HTTP_X_MS_CLIENT_PRINCIPAL_ID")
userName = Request.ServerVariables("HTTP_X_MS_CLIENT_PRINCIPAL_NAME")

If userId <> "" Then
    Response.Write("Welcome, " & userName & "!<br>")
    Response.Write("Your user ID: " & userId)
Else
    Response.Write("You're not logged in.")
End If
%>

4. Key Things to Keep in Mind #

• Session persistence: If your app uses sessions, make sure ARR Affinity is enabled in Configuration > General Settings. This ties a user’s session to a specific App Service instance so their session data stays consistent.
• Group-based access control: If you need to restrict access to certain groups, you can either configure this in the AAD identity provider settings, or add a check in your ASP code to verify the user’s group IDs match your allowed list.
• Testing permissions: By default, all users in your AAD tenant can access the app. If you want to limit this, head to your AAD app registration and adjust the user/group access settings.

内容的提问来源于stack exchange，提问作者Stefano Bafaro