将ASP.NET 4.8认证/授权功能迁移至ASP.NET Core 6的示例问询

1. 配置文件（appsettings.json） #

替换原Web.config的appSettings，配置Azure AD相关参数：

{
  "AzureAd": {
    "ClientId": "SomeGuidValue",
    "Instance": "https://login.microsoftonline.com/",
    "TenantId": "SomeGuidValue",
    "PostLogoutRedirectUri": "https://localhost:SomePortNumber/"
  }
}

2. Program.cs 配置认证中间件 #

ASP.NET Core 6 使用顶级语句，在Program.cs中配置认证服务和中间件：

using Microsoft.AspNetCore.Authentication.Cookies;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.IdentityModel.Tokens;
using System.Globalization;

var builder = WebApplication.CreateBuilder(args);

// 添加控制器和视图服务
builder.Services.AddControllersWithViews();

// 配置认证服务
builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie(options =>
{
    options.Cookie.Name = "Cookies";
    // Core 中默认的 CookieManager 已处理分块逻辑，无需额外配置
})
.AddOpenIdConnect(options =>
{
    var azureAdConfig = builder.Configuration.GetSection("AzureAd");
    options.ClientId = azureAdConfig["ClientId"];
    options.Authority = string.Format(CultureInfo.InvariantCulture, "{0}{1}", 
        azureAdConfig["Instance"], azureAdConfig["TenantId"]);
    options.PostLogoutRedirectUri = azureAdConfig["PostLogoutRedirectUri"];
    
    options.TokenValidationParameters = new TokenValidationParameters
    {
        NameClaimType = System.Security.Claims.ClaimTypes.Name,
        RoleClaimType = System.Security.Claims.ClaimTypes.Role
    };
    
    // 处理认证失败事件
    options.Events = new OpenIdConnectEvents
    {
        OnAuthenticationFailed = context =>
        {
            context.HandleResponse();
            context.Response.Redirect("/");
            return Task.CompletedTask;
        }
    };
});

var app = builder.Build();

// 配置请求管道
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Home/Error");
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();

// 启用认证和授权中间件
app.UseAuthentication();
app.UseAuthorization();

app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");

app.Run();

3. 自定义授权属性（CustomAuthorizeAttribute.cs） #

ASP.NET Core 中自定义授权属性需继承AuthorizeAttribute并实现IAuthorizationFilter，同时通过依赖注入获取DbContext：

using Microsoft.AspNetCore.Mvc.Filters;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.DependencyInjection;

public class CustomAuthorizeAttribute : AuthorizeAttribute, IAuthorizationFilter
{
    private readonly string[] _roles;

    public CustomAuthorizeAttribute(params string[] roles)
    {
        _roles = roles;
    }

    public void OnAuthorization(AuthorizationFilterContext context)
    {
        if (!Authorize(context.HttpContext))
        {
            context.Result = new Microsoft.AspNetCore.Mvc.ForbidResult();
            return;
        }
    }

    private bool Authorize(HttpContext httpContext)
    {
        var authorize = false;

        // 通过请求上下文获取DbContext实例
        var coreDb = httpContext.RequestServices.GetRequiredService<CoreDbContext>();

        foreach (var role in _roles)
        {
            var adGroups = coreDb.GetAdGroupsFromRole(role);

            foreach (var adGroup in adGroups.ResultSet1)
            {
                if (httpContext.User.IsInRole(adGroup.ActiveDirectoryGroup))
                {
                    authorize = true;
                    break;
                }
            }

            if (authorize)
                break;
        }

        return authorize;
    }
}

注意：由于自定义属性需要依赖注入，不能直接使用[CustomAuthorize("SomeAzureAppRole")]，需改用[TypeFilter(typeof(CustomAuthorizeAttribute), Arguments = new object[] { "SomeAzureAppRole" })]。

4. Account控制器（AccountController.cs） #

Core 6 中使用HttpContext处理登录登出：

using Microsoft.AspNetCore.Mvc;
using Microsoft.AspNetCore.Authentication;
using Microsoft.AspNetCore.Authentication.OpenIdConnect;

public class AccountController : Controller
{
    public IActionResult SignIn()
    {
        if (!User.Identity.IsAuthenticated)
        {
            return Challenge(new AuthenticationProperties { RedirectUri = "/" }, 
                OpenIdConnectDefaults.AuthenticationScheme);
        }
        return RedirectToAction("Index", "Home");
    }

    public async Task<IActionResult> SignOut()
    {
        await HttpContext.SignOutAsync(CookieAuthenticationDefaults.AuthenticationScheme);
        await HttpContext.SignOutAsync(OpenIdConnectDefaults.AuthenticationScheme);
        return RedirectToAction("Index", "Home");
    }
}

5. 登录视图（_LoginPartial.cshtml） #

替换原_Login.cshtml，使用Core标签助手优化路由：

@if (User.Identity.IsAuthenticated)
{
    <text>
        Hello, @User.Identity.Name <a asp-action="SignOut" asp-controller="Account"> Sign Out</a>
    </text>
}
else
{
    <a asp-action="SignIn" asp-controller="Account">Sign In</a>
}

6. 自定义授权属性使用示例 #

使用TypeFilter注入依赖并应用授权：

[TypeFilter(typeof(CustomAuthorizeAttribute), Arguments = new object[] { "SomeAzureAppRole" })]
public IActionResult SecureAction()
{
    return View();
}

内容的提问来源于stack exchange，提问作者csharpdev