Asp.net Web Forms（非MVC）Azure AD身份认证开发问题咨询

本次实现采用资源所有者密码凭据流（ROPC），适配你自定义表单输入账号密码、直接校验Azure AD凭据的需求，无需跳转Azure托管登录页。

1. Azure端前置配置 #

• 登录Azure Portal进入Azure AD服务，注册新应用，应用类型选择Web应用/API
• 注册完成后记录客户端ID、租户ID两个参数
• 进入应用的「认证」板块，添加你的网站域名下的任意回调地址作为重定向URI，同时开启ID令牌签发选项
• 进入应用的「API权限」板块，添加Microsoft Graph的User.Read委托权限，点击「授予管理员同意」完成权限配置

2. 项目依赖安装 #

通过NuGet包管理器安装以下依赖：

• Microsoft.Identity.Client
• Microsoft.Owin.Security.OpenIdConnect
• Microsoft.Owin.Security.Cookies
• Microsoft.Owin.Host.SystemWeb

3. 核心代码实现 #

3.1 新增OWIN Startup类 #

using Microsoft.Owin;
using Owin;
using Microsoft.IdentityModel.Protocols.OpenIdConnect;
using Microsoft.Owin.Security;
using Microsoft.Owin.Security.Cookies;
using Microsoft.Owin.Security.OpenIdConnect;
using System.Configuration;

// 替换为你自己项目的命名空间
[assembly: OwinStartup(typeof(YourWebFormsProject.Startup))]
namespace YourWebFormsProject
{
    public class Startup
    {
        private static readonly string ClientId = ConfigurationManager.AppSettings["AAD:ClientId"];
        private static readonly string TenantId = ConfigurationManager.AppSettings["AAD:TenantId"];
        private static readonly string Authority = $"https://login.microsoftonline.com/{TenantId}/v2.0";
        private static readonly string RedirectUri = ConfigurationManager.AppSettings["AAD:SuccessRedirectUri"];

        public void Configuration(IAppBuilder app)
        {
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions());
            app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
            {
                ClientId = ClientId,
                Authority = Authority,
                RedirectUri = RedirectUri,
                PostLogoutRedirectUri = RedirectUri,
                ResponseType = OpenIdConnectResponseType.IdToken,
                Scope = "openid profile email",
                TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                {
                    ValidateIssuer = true,
                    NameClaimType = "name"
                }
            });
        }
    }
}

3.2 Web.config添加配置 #

在web.config的<appSettings>节点下新增以下配置：

<add key="AAD:ClientId" value="你之前记录的Azure应用客户端ID" />
<add key="AAD:TenantId" value="你之前记录的Azure AD租户ID" />
<add key="AAD:SuccessRedirectUri" value="登录成功后跳转的页面绝对地址，例如https://yourdomain.com/home.aspx" />

3.3 登录页面后台逻辑（以Login.aspx.cs为例） #

对应你自定义的邮箱、密码输入表单的登录按钮点击事件：

using Microsoft.Identity.Client;
using System.Configuration;
using System.Security.Claims;
using Microsoft.Owin.Security;
using System.Threading.Tasks;

protected async void btnLogin_Click(object sender, EventArgs e)
{
    string email = txtEmail.Text.Trim();
    string password = txtPassword.Text.Trim();
    string clientId = ConfigurationManager.AppSettings["AAD:ClientId"];
    string tenantId = ConfigurationManager.AppSettings["AAD:TenantId"];
    string[] scopes = new string[] { "User.Read", "openid", "profile", "email" };
    
    var pca = PublicClientApplicationBuilder
        .Create(clientId)
        .WithTenantId(tenantId)
        .Build();

    try
    {
        // 调用Azure AD校验账号密码
        var result = await pca.AcquireTokenByUsernamePassword(scopes, email, password)
            .ExecuteAsync();
        
        // 验证通过，创建本地登录Cookie
        var claims = new List<Claim>
        {
            new Claim(ClaimTypes.Name, result.Account.Username),
            new Claim(ClaimTypes.Email, result.Account.Username),
            new Claim("AccessToken", result.AccessToken)
        };
        var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationType);
        var authManager = Context.GetOwinContext().Authentication;
        // 可根据需求调整是否持久化登录状态
        authManager.SignIn(new AuthenticationProperties { IsPersistent = false }, identity);
        
        // 跳转到指定的登录后页面
        Response.Redirect(ConfigurationManager.AppSettings["AAD:SuccessRedirectUri"]);
    }
    catch (MsalException)
    {
        // 凭据校验失败，抛出错误提示
        lblErrorMsg.Text = "邮箱或密码错误，请重新输入";
    }
}

4. 注意事项 #

• 该方案不支持开启了多因素认证（MFA）的Azure AD用户，如果你租户要求MFA，建议更换为跳转Azure AD托管登录页的标准OpenID Connect认证流
• 生产环境必须全站启用HTTPS，避免账号密码在传输过程中泄露
• 敏感配置不要硬编码在代码或配置文件中，建议使用密钥管理服务存储

内容的提问来源于stack exchange，提问作者Ali Sultan