如何修改Visual Studio默认Microsoft身份认证启动逻辑

我负责的网页要求用户使用Microsoft账号登录，基于Microsoft Identity Platform完成身份认证，但当前测试/生产环境一打开就直接跳转至Microsoft登录页。我需要先展示自定义“登录”视图，点击“使用Microsoft账号登录”按钮再触发认证流程，想知道要修改哪些默认配置，附上相关代码及效果：

Program.cs 代码 #

using Microsoft.AspNetCore.Authentication.OpenIdConnect;
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc.Authorization;
using Microsoft.Identity.Web;
using Microsoft.Identity.Web.UI;

var builder = WebApplication.CreateBuilder(args);

// Add services to the container.
builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"));

builder.Services.AddAuthorization(options =>
{
    options.FallbackPolicy = options.DefaultPolicy;
});

builder.Services.AddControllersWithViews(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
    options.Filters.Add(new AuthorizeFilter(policy));
});
builder.Services.AddRazorPages()
    .AddMicrosoftIdentityUI();

var app = builder.Build();

// Configure the HTTP request pipeline.
if (!app.Environment.IsDevelopment())
{
    app.UseExceptionHandler("/Home/Error");
    // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
    app.UseHsts();
}

app.UseHttpsRedirection();
app.UseStaticFiles();

app.UseRouting();

app.UseAuthentication();
app.UseAuthorization();

app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Index}/{id?}");
app.MapRazorPages();
app.MapControllers();

app.Run();

当前启动效果 #

期望的登录页代码 #

<form id="form_login" action="~/Home/LoginMicrosoft" method="post">
    <div class="input">
        <input type="submit" value="Use Microsoft account"/>
        <span id="ver_clave" class="ver_clave input-group-append">
            <i class="fa-brands fa-microsoft"></i>
        </span>
    </div>
</form>

尝试的控制器代码 #

[HttpPost]
public async Task<IActionResult> LoginMicrosoft ()
{
    try
    {
        MicrosoftAuthService aut = new MicrosoftAuthService();
        aut.Initialize();
        await aut.OnSignInAsync();

        return View("Index");
    }
    catch (Exception ex)
    {
        throw new Exception(ex.Message);
    }
}

问题核心是全局强制要求认证导致自动跳转，同时认证配置默认开启了自动挑战。按以下步骤修改即可，不会破坏原有认证逻辑：

1. 移除全局授权过滤器 #

打开Program.cs，修改AddControllersWithViews的配置，去掉全局的AuthorizeFilter，默认所有页面允许匿名访问，仅在需要认证的控制器/方法上手动添加[Authorize]：

// 修改后代码
builder.Services.AddControllersWithViews();

2. 调整授权策略 #

修改AddAuthorization配置，取消默认的全局认证要求，保留默认策略供[Authorize]使用：

builder.Services.AddAuthorization(options =>
{
    // 设置默认 fallback 策略为允许匿名
    options.FallbackPolicy = new AuthorizationPolicyBuilder()
        .AllowAnonymous()
        .Build();
    // 保留默认认证策略，需要时通过[Authorize]引用
    options.DefaultPolicy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
});

3. 禁用认证自动挑战 #

修改AddMicrosoftIdentityWebApp的配置，禁用自动跳转到Microsoft登录页的行为：

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"), options =>
    {
        // 关闭自动挑战，避免未认证时自动跳转登录
        options.AutomaticChallenge = false;
    });

4. 修正登录按钮触发逻辑 #

不需要自定义MicrosoftAuthService，直接使用ASP.NET Core内置的认证挑战方法修改控制器代码：

using Microsoft.AspNetCore.Authentication.OpenIdConnect;

// ...

[HttpPost]
public async Task<IActionResult> LoginMicrosoft()
{
    // 触发Microsoft认证流程，登录后跳转至首页
    var authProperties = new AuthenticationProperties { RedirectUri = "/" };
    return Challenge(authProperties, OpenIdConnectDefaults.AuthenticationScheme);
}

5. 配置页面权限 #

• 给自定义登录页的控制器方法添加[AllowAnonymous]，确保未认证用户能访问：

public class HomeController : Controller
{
    [AllowAnonymous]
    public IActionResult Login()
    {
        return View(); // 返回自定义登录视图
    }

    // 需要认证的页面添加[Authorize]
    [Authorize]
    public IActionResult Index()
    {
        return View();
    }
}

• 可选：修改默认路由，让网站启动时默认打开登录页：

app.MapControllerRoute(
    name: "default",
    pattern: "{controller=Home}/{action=Login}/{id?}");

内容的提问来源于stack exchange，提问作者popo