ASP.NET WebForms 4.8下Okta预发环境认证无限循环求助

问题现象 #

• 基于Okta的认证功能在开发电脑运行正常，预发服务器上出现无限循环
• 系统日志仅存在3条记录，无错误信息

环境信息 #

• 框架：ASP.NET WebForms 4.8
• 认证方案：Okta OAuth2/OpenID Connect

Okta配置细节 #

Web.Config中的配置 #

<!-- OKTA: -->
<!-- 1. Replace these values with your Okta configuration -->
<add key="okta:ClientId" value="************" />
<add key="okta:ClientSecret" value="*******************" />
<add key="okta:OktaDomain" value="https://dev-*****.okta.com" />
<add key="okta:AuthorizationServerId" value="default" />
<!-- 2. Update the Okta application with these values -->
<add key="okta:RedirectUri" value="https://www.company-url.com/subdomain/default.aspx" />
<add key="okta:PostLogoutRedirectUri" value="https://www.company-url.com/subdomain" />

Okta开发者控制台配置 #

• 登录重定向URI：https://www.company-url.com/subdomain/default.aspx
• 登出重定向URI：https://www.company-url.com/subdomain
• 可信来源已添加https://www.company-url.com，并允许CORS和重定向

核心代码 #

Startup类（VB.NET） #

Imports System.Collections.Generic
Imports System.Configuration
Imports System.Web
Imports Microsoft.Owin
Imports Microsoft.Owin.Security
Imports Microsoft.Owin.Security.Cookies
Imports Okta.AspNet
Imports Owin

<Assembly: OwinStartup(GetType(Company.Startup))>

Public Class Startup
        Public Sub Configuration(ByVal app As IAppBuilder)
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType)
            app.UseCookieAuthentication(New CookieAuthenticationOptions() With {
                .LoginPath = New PathString("/Login.aspx")
            })
            app.UseOktaMvc(New OktaMvcOptions() With {
                .OktaDomain = ConfigurationManager.AppSettings("okta:OktaDomain"),
                .ClientId = ConfigurationManager.AppSettings("okta:ClientId"),
                .ClientSecret = ConfigurationManager.AppSettings("okta:ClientSecret"),
                .AuthorizationServerId = ConfigurationManager.AppSettings("okta:AuthorizationServerId"),
                .RedirectUri = ConfigurationManager.AppSettings("okta:RedirectUri"),
                .PostLogoutRedirectUri = ConfigurationManager.AppSettings("okta:PostLogoutRedirectUri"),
                .Scope = New List(Of String) From {
                    "openid",
                    "profile",
                    "email"
                },
                .LoginMode = LoginMode.SelfHosted
            })
        End Sub
    End Class

Login.aspx标记 #

<%@ Page Language="vb" AutoEventWireup="true" CodeBehind="Login.aspx.vb" Inherits="Illinois.Login" %>

<script src="https://global.oktacdn.com/okta-signin-widget/5.2.0/js/okta-sign-in.min.js" type="text/javascript"></script>
<link href="https://global.oktacdn.com/okta-signin-widget/5.2.0/css/okta-sign-in.min.css" type="text/css" rel="stylesheet" />
<script src="include/jquery-3.4.1.min.js"></script>


<div id="widget"></div>

<form method="POST" action="Login.aspx">
    <input type="hidden" name="sessionToken" id="hiddenSessionTokenField" />
</form>

<script type="text/javascript">
    var oktaDomain = '<%= System.Configuration.ConfigurationManager.AppSettings("okta:oktaDomain").ToString() %>';

    var signIn = new OktaSignIn({
        baseUrl: oktaDomain
    });

    signIn.renderEl({ el: '#widget' }, (res) => {
        var sessionTokenField = $("#hiddenSessionTokenField");
        sessionTokenField.val(res.session.token);
        var form = sessionTokenField.parent();
        form.submit();
    }, (err) => {
        console.error(err);
        });
</script>

Login.aspx.vb代码 #

Imports System
Imports System.Security.Claims
Imports System.Web
Imports Microsoft.Owin.Security
Imports Microsoft.Owin.Security.OpenIdConnect

Partial Public Class Login
        Inherits System.Web.UI.Page

        Protected Sub Page_Load(ByVal sender As Object, ByVal e As EventArgs)
            If Request.RequestType = "POST" AndAlso Not Request.IsAuthenticated Then
                Dim claimsPrincipal As ClaimsPrincipal = TryCast(Page.User, ClaimsPrincipal)
                Dim sessionToken As String = Request.Form("sessionToken")?.ToString()
                Dim properties As AuthenticationProperties = New AuthenticationProperties()
                properties.Dictionary.Add("sessionToken", sessionToken)
                properties.RedirectUri = "/"
                HttpContext.Current.GetOwinContext().Authentication.Challenge(properties, OpenIdConnectAuthenticationDefaults.AuthenticationType)
            End If
        End Sub
    End Class

请帮忙排查哪部分配置或代码存在问题，导致预发环境出现无限循环。

内容的提问来源于stack exchange，提问作者Cal