.NET 6 Web API集成Auth0与Azure AD B2C授权时配置获取失败求助

问题描述 #

我的ASP.NET Web API原本已实现Auth0认证，现在需要新增Azure AD B2C授权方案。单独使用任一认证方案均正常，但集成后调用接口时出现以下错误：

Unable to obtain configuration from: 'https://mydomain.auth0.com/.well-known/openid-configuration'.
 ---> System.IO.IOException: IDX20804: Unable to retrieve document from: 'https://mydomain.auth0.com/.well-known/openid-configuration'.

代码实现如下：

public static IServiceCollection AddSecurityPolicy(this IServiceCollection services, ConfigurationManager config)
{
    const string ClientPortalScheme = "ClientPortalBearerScheme";
    services.AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
    }).AddJwtBearer(options =>
    {
        options.Authority = config["AuthenticationSettings:Domain"];
        options.Audience = config["AuthenticationSettings:Audience"];
    }).AddJwtBearer(ClientPortalScheme, ClientPortalScheme, options =>
    {
        options.Authority = config["AzureADB2CSettings:Domain"];
        options.Audience = config["AzureADB2CSettings:Tenant"];
    });

    services.AddAuthorization(options =>
    {
        var defaultAuthorizationPolicyBuilder = new AuthorizationPolicyBuilder(
            JwtBearerDefaults.AuthenticationScheme,
            ClientPortalScheme);
        defaultAuthorizationPolicyBuilder =
            defaultAuthorizationPolicyBuilder.RequireAuthenticatedUser();
        options.DefaultPolicy = defaultAuthorizationPolicyBuilder.Build();
    });

    return services;
}

可能的原因及修复步骤 #

1. 检查Auth0 Authority配置格式 #

确保Auth0的Authority配置值是完整的URL，结尾包含斜杠，例如https://mydomain.auth0.com/。如果配置文件中AuthenticationSettings:Domain仅为mydomain.auth0.com，需补充前缀和斜杠，否则会导致配置端点拼接错误。

2. 验证Azure AD B2C的Audience配置 #

Azure AD B2C的Audience应设置为应用程序的Client ID，而非Tenant ID。检查AzureADB2CSettings:Tenant的值是否实际为应用Client ID，若不是，需修改配置为正确的Client ID。

3. 调整认证Scheme的默认行为 #

当前默认认证Scheme设置为Auth0的JwtBearerDefaults.AuthenticationScheme，导致所有请求优先用Auth0验证。若请求携带Azure AD B2C的Token，Auth0验证过程中会尝试获取自身配置，可能因Token issuer不匹配引发异常。

• 移除默认认证Scheme的设置，让中间件自动尝试所有注册的Scheme：

  services.AddAuthentication()
      .AddJwtBearer(options =>
      {
          options.Authority = config["AuthenticationSettings:Domain"];
          options.Audience = config["AuthenticationSettings:Audience"];
      })
      .AddJwtBearer(ClientPortalScheme, ClientPortalScheme, options =>
      {
          options.Authority = config["AzureADB2CSettings:Domain"];
          options.Audience = config["AzureADB2CSettings:ClientId"]; // 修正为Client ID
      });
  

• 或者在需要特定认证的Action上明确指定Scheme：

  // Auth0专属接口
  [Authorize(AuthenticationSchemes = JwtBearerDefaults.AuthenticationScheme)]
  [HttpGet("auth0-only")]
  public IActionResult Auth0Only() => Ok("Auth0 authenticated");
  
  // Azure AD B2C专属接口
  [Authorize(AuthenticationSchemes = ClientPortalScheme)]
  [HttpGet("azure-b2c-only")]
  public IActionResult AzureB2COnly() => Ok("Azure AD B2C authenticated");
  

4. 添加认证事件日志排查细节 #

在Auth0的JwtBearer配置中添加事件处理，记录详细错误信息，帮助定位问题：

.AddJwtBearer(options =>
{
    options.Authority = config["AuthenticationSettings:Domain"];
    options.Audience = config["AuthenticationSettings:Audience"];
    options.Events = new JwtBearerEvents
    {
        OnAuthenticationFailed = context =>
        {
            var logger = context.HttpContext.RequestServices.GetRequiredService<ILogger<Program>>();
            logger.LogError(context.Exception, "Auth0认证失败");
            return Task.CompletedTask;
        }
    };
})

5. 确认网络连通性 #

手动访问https://mydomain.auth0.com/.well-known/openid-configuration，确认服务器能正常获取该配置文档，排除防火墙、代理等网络限制问题。

内容的提问来源于stack exchange，提问作者Deepika