WebForms中Azure AD认证本地正常，生产服务器异常排查

问题根源 #

你的场景是HAProxy做SSL卸载，IIS后端接收HTTP请求，导致Owin中间件无法正确识别外部的真实HTTPS协议，进而引发nonce cookie的传递/验证失败——OpenID Connect的nonce值存储在cookie中，若应用无法感知外部是HTTPS，会导致cookie的Secure属性设置错误，最终验证时找不到nonce值，抛出IDX21323异常。

解决方案步骤 #

1. 配置Owin信任HAProxy的转发头 #

让Owin识别HAProxy传递的真实请求协议和客户端信息，添加转发头处理中间件：

using Microsoft.Owin.Extensions;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.OpenIdConnect;
using Owin;
using System.Security.Claims;
using System.Threading.Tasks;

public void Configuration(IAppBuilder app)
{
    // 配置转发头，信任HAProxy的X-Forwarded-Proto和X-Forwarded-For
    app.UseForwardedHeaders(new Microsoft.Owin.BuilderProperties.ForwardedHeadersOptions
    {
        ForwardedHeaders = Microsoft.Owin.BuilderProperties.ForwardedHeaders.XForwardedFor | Microsoft.Owin.BuilderProperties.ForwardedHeaders.XForwardedProto,
        // 添加HAProxy服务器的IP到信任列表，避免伪造转发头
        KnownProxies = new System.Collections.Generic.List<System.Net.IPAddress>
        {
            System.Net.IPAddress.Parse("你的HAProxy服务器IP")
        }
    });

    // 其余认证配置...
}

2. 调整Cookie和OpenID Connect配置 #

修改关键参数适配SSL卸载场景：

app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    CookieManager = new SystemWebCookieManager(),
    CookieSameSite = Microsoft.Owin.SameSiteMode.Lax,
    CookieHttpOnly = true,
    // 自动根据真实请求协议设置Secure属性
    CookieSecure = CookieSecureOption.SameAsRequest
});

app.UseOpenIdConnectAuthentication(
    new OpenIdConnectAuthenticationOptions
    {
        ClientId = clientId,
        Authority = authority,
        PostLogoutRedirectUri = postLogoutRedirectUri,
        // 生产环境建议设为true，确保元数据通过HTTPS获取
        RequireHttpsMetadata = true,

        // 显式配置nonce cookie属性，适配HTTPS场景
        NonceCookie = new CookieAuthenticationOptions
        {
            CookieSecure = CookieSecureOption.SameAsRequest,
            CookieSameSite = Microsoft.Owin.SameSiteMode.Lax,
            CookieHttpOnly = true
        },

        Notifications = new OpenIdConnectAuthenticationNotifications()
        {
            AuthenticationFailed = async (context) =>
            {
                if (context.Exception is OpenIdConnectProtocolInvalidNonceException)
                {
                    // 清除无效的nonce cookie
                    context.OwinContext.Response.Cookies.Delete("OpenIdConnect.nonce." + context.ProtocolMessage.State);
                    // 重新发起认证挑战，避免循环
                    context.HandleResponse();
                    await context.OwinContext.Authentication.ChallengeAsync(OpenIdConnectAuthenticationDefaults.AuthenticationType);
                }
                return Task.CompletedTask;
            },

            SecurityTokenValidated = (context) =>
            {
                string name = context.AuthenticationTicket.Identity.FindFirst("preferred_username").Value;
                context.AuthenticationTicket.Identity.AddClaim(new Claim(ClaimTypes.Name, name, string.Empty));
                return Task.CompletedTask;
            }
        }
    });

3. 验证HAProxy转发头配置 #

确保HAProxy转发请求时，正确传递以下头信息：

• X-Forwarded-Proto: https：告知后端应用外部是HTTPS协议
• X-Forwarded-For: 客户端真实IP：可选，用于日志和安全验证

对你疑问的解答 #

1. Azure AD认证支持SSL卸载架构：完全支持，只要应用能正确识别外部真实请求协议（通过转发头），Azure AD仅关心回调URL为HTTPS，后端是否用HTTP不影响。
2. IIS不需要配置SSL证书：HAProxy已处理SSL终止，IIS只需处理HTTP请求，但必须确保转发头配置正确，让应用感知到外部是HTTPS。

内容的提问来源于stack exchange，提问作者JaggenSWE