.NET 6+应用网关+OIDC：基于路径路由的认证跳转故障求助

核心问题分析 #

你的场景中，应用网关通过路径前缀/apps/app1/*转发请求到后端应用服务，但OIDC中间件默认使用根路径的Cookie和回调配置，导致认证完成后无法正确保留路径前缀，最终跳转到根目录。另外，反向代理场景下必须正确配置ForwardedHeaders，让应用感知到真实的外部请求URL，而非网关转发后的内部URL。

关键配置步骤 #

1. 正确配置ForwardedHeaders #

必须确保应用能识别网关发来的转发头，否则OIDC中间件会使用内部的服务域名生成回调URL，导致不匹配。

builder.Services.Configure<ForwardedHeadersOptions>(options =>
{
    options.ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto | ForwardedHeaders.XForwardedHost;
    options.KnownNetworks.Clear();
    options.KnownProxies.Clear();
    options.ForwardLimit = null;
});

2. 配置OIDC中间件的回调路径与Cookie路径 #

• CallbackPath必须设置为网关路径前缀下的signin-oidc，即/apps/app1/signin-oidc
• 将Nonce和Correlation Cookie的路径设置为网关的路径前缀/apps/app1/
• 在事件中确保RedirectUri使用真实的外部URL（包含路径前缀）

builder.Services.AddAuthentication(options =>
{
    options.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = OpenIdConnectDefaults.AuthenticationScheme;
})
.AddCookie(options =>
{
    options.Cookie.Path = "/apps/app1/";
    options.LoginPath = "/apps/app1/Account/Login";
    options.ReturnUrlParameter = "ReturnUrl";
})
.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
    options.ClientId = builder.Configuration["AzureAd:ClientId"];
    options.ClientSecret = builder.Configuration["AzureAd:ClientSecret"];
    options.Authority = $"https://login.microsoftonline.com/{builder.Configuration["AzureAd:TenantId"]}/v2.0";
    options.ResponseType = OpenIdConnectResponseType.Code;
    options.CallbackPath = new PathString("/apps/app1/signin-oidc");
    options.NonceCookie.Path = "/apps/app1/";
    options.CorrelationCookie.Path = "/apps/app1/";

    options.Events = new OpenIdConnectEvents
    {
        OnRedirectToIdentityProvider = context =>
        {
            var redirectUri = new Uri(
                $"{context.Request.Scheme}://{context.Request.Host}/apps/app1/signin-oidc");
            context.ProtocolMessage.RedirectUri = redirectUri.AbsoluteUri;
            return Task.CompletedTask;
        },
        OnAuthorizationCodeReceived = context =>
        {
            var returnUrl = context.Properties.RedirectUri;
            if (string.IsNullOrEmpty(returnUrl) || returnUrl == "/")
            {
                context.Properties.RedirectUri = "/apps/app1/";
            }
            return Task.CompletedTask;
        }
    };
});

3. 验证AAD应用注册的回调URL #

必须在Azure AD应用注册中添加完整的回调URL：https://apps.mydomain.com/apps/app1/signin-oidc，缺失此配置会导致认证关联错误。

4. 配置CookiePolicy（可选） #

builder.Services.Configure<CookiePolicyOptions>(options =>
{
    options.Secure = CookieSecurePolicy.Always;
    options.MinimumSameSitePolicy = SameSiteMode.None;
    options.HttpOnly = HttpOnlyPolicy.Always;
    options.ConsentCookie.Path = "/apps/app1/";
});

5. 确保中间件顺序正确 #

app.UseForwardedHeaders();

app.UseCookiePolicy();
app.UseAuthentication();
app.UseAuthorization();

// 路由配置示例
app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");
app.MapRazorPages();

测试验证 #

1. 访问https://apps.mydomain.com/apps/app1/触发认证跳转
2. 完成AAD登录后，检查回调URL是否为https://apps.mydomain.com/apps/app1/signin-oidc
3. 认证成功后应跳转到https://apps.mydomain.com/apps/app1/而非根路径

内容的提问来源于stack exchange，提问作者Lucky Lindy