ASP.NET 4.7 VB.NET WebForms Azure B2C认证界面不显示问题

问题背景 #

使用VB.NET编写的ASP.NET 4.7 WebForms遗留应用接入Azure B2C认证，已完成Azure平台应用注册、OWIN中间件对应NuGet包安装、所有已知配置修改，预期应用运行时弹出登录界面，但实际未触发认证流程，应用可直接绕过认证校验正常运行，已确认程序执行会进入Startup.vb的Configuration()方法。

现有配置代码 #

Startup.vb #

Imports System.Threading.Tasks
Imports Microsoft.IdentityModel.Protocols.OpenIdConnect
Imports Microsoft.IdentityModel.Tokens
Imports Microsoft.Owin
Imports Microsoft.Owin.Security
Imports Microsoft.Owin.Security.Cookies
Imports Microsoft.Owin.Security.Notifications
Imports Microsoft.Owin.Security.OpenIdConnect
Imports Owin

<Assembly: OwinStartup(GetType(InfoWebCore.Startup))>
Namespace InfoWebCore
Public Class Startup
    Private Shared clientId As String = ConfigurationManager.AppSettings("ida:ClientId")
    Private Shared aadInstance As String = ConfigurationManager.AppSettings("ida:AadInstance")
    Private Shared tenant As String = ConfigurationManager.AppSettings("ida:Tenant")
    Private Shared redirectUri As String = ConfigurationManager.AppSettings("ida:RedirectUri")
    Public Shared SignInPolicyId As String = ConfigurationManager.AppSettings("ida:SignInPolicyId")

    Public Sub Configuration(ByVal app As IAppBuilder)
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType)
        app.UseCookieAuthentication(New CookieAuthenticationOptions())
        app.UseOpenIdConnectAuthentication(CreateOptionsFromPolicy(SignInPolicyId))
    End Sub

    Private Function AuthenticationFailed(ByVal notification As AuthenticationFailedNotification(Of OpenIdConnectMessage, OpenIdConnectAuthenticationOptions)) As Task
        notification.HandleResponse()

        If notification.Exception.Message = "access_denied" Then
            notification.Response.Redirect("/")
        Else
            notification.Response.Redirect("/Home/Error?message=" & notification.Exception.Message)
        End If

        Return Task.FromResult(0)
    End Function

    Private Function CreateOptionsFromPolicy(ByVal policy As String) As OpenIdConnectAuthenticationOptions
        Dim options = New OpenIdConnectAuthenticationOptions With {
            .MetadataAddress = String.Format(aadInstance, tenant, policy),
            .AuthenticationType = policy,
            .ClientId = clientId,
            .RedirectUri = redirectUri,
            .PostLogoutRedirectUri = redirectUri,
            .Notifications = New OpenIdConnectAuthenticationNotifications With {
                .AuthenticationFailed = AddressOf AuthenticationFailed
            },
            .Scope = "openid",
            .ResponseType = "id_token",
            .TokenValidationParameters = New TokenValidationParameters With {
                .NameClaimType = "name"
            }
        }
        Return options
    End Function
End Class
End Namespace

Web.config 相关配置片段 #

<authentication mode="None" />

...

<!-- Azure AD B2C Settings -->
<add key="ida:Tenant" value="laticreteb2c.onmicrosoft.com" />
<add key="ida:ClientId" value="8hq22y21-f12g-4a2d-b170-fdaa0b2dc467" />
<add key="ida:AadInstance" value="https://login.microsoftonline.com/{0}/v2.0/.well-known/openid-configuration?p={1}" />
<add key="ida:RedirectUri" value="https://localhost:44379/signin-oidc" />
<add key="ida:SignInPolicyId" value="B2C_1_signin" />

遗漏配置&修复方案 #

现有配置只完成了认证中间件的注册，没有配置请求拦截规则，也缺少WebForms场景下OWIN运行必需的配套配置，具体遗漏点如下：

• 缺少全局认证拦截逻辑
  OWIN的OpenID Connect中间件本身不会自动拦截匿名请求触发登录挑战，需要在Configuration方法中补充自定义中间件，对非回调路径的未认证请求主动发起认证挑战。
  在app.UseOpenIdConnectAuthentication(CreateOptionsFromPolicy(SignInPolicyId))行后追加以下代码：

  app.Use(Async Function(context, [next])
              ' 排除B2C回调路径，避免登录循环
              If Not context.Request.Path.Equals(New PathString("/signin-oidc"), StringComparison.OrdinalIgnoreCase) Then
                  Dim user = context.Authentication.User
                  If user Is Nothing OrElse Not user.Identity.IsAuthenticated Then
                      ' 触发B2C登录挑战
                      context.Authentication.Challenge(New AuthenticationProperties With {
                          .RedirectUri = context.Request.PathBase + context.Request.Path + context.Request.QueryString
                      }, SignInPolicyId)
                      Return
                  End If
              End If
              Await [next]()
          End Function)
  

• 确认安装Microsoft.Owin.Host.SystemWeb NuGet包
  这是ASP.NET WebForms（IIS集成管线）场景下运行OWIN中间件的必需依赖，没装这个包就算Configuration方法执行了，中间件也不会实际接入请求处理管线，自然不会触发认证。
• 校验Web.config管线配置
  确认system.webServer节点下的配置满足OWIN运行要求，确保所有请求都会经过OWIN托管模块处理，不会被IIS静态文件处理逻辑直接跳过：

  <system.webServer>
    <modules runAllManagedModulesForAllRequests="true" />
  </system.webServer>
  

• 补充回调路径的匿名访问配置
  在Web.config中新增location节点，允许/signin-oidc路径匿名访问，避免授权逻辑拦截B2C返回的认证回调请求：

  <location path="signin-oidc">
    <system.web>
      <authorization>
        <allow users="*" />
      </authorization>
    </system.web>
  </location>
  

内容的提问来源于stack exchange，提问作者David Shochet