Azure Stack Server密钥滚动后SSO OpenID配置验证失败问题求助

问题根因 #

你当前的代码在应用启动阶段一次性请求了OIDC配置和签名密钥，后续不会自动刷新密钥，所以Azure Stack的ELR服务器每24小时滚动签名密钥后，本地缓存的旧密钥无法匹配新签名的IdToken，就会抛出IDX10501错误。
其余环境未触发问题是因为CTC环境的密钥滚动周期远长于24小时，甚至长期不滚动，所以不会出现签名不匹配的情况。

修复方案 #

不要手动提前拉取签名密钥赋值给IssuerSigningKeys，直接把你创建的ConfigurationManager传给OpenIdConnect中间件，让中间件自动定时刷新OIDC配置和签名密钥即可：

public static void Configuration(IAppBuilder app)
{
    // 保留ConfigurationManager，中间件会用它自动刷新配置
    var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
                                    $"{OidcOptions.Authority}/.well-known/openid-configuration",
                                    new OpenIdConnectConfigurationRetriever(),
                                    new HttpDocumentRetriever());

    app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        CookieManager = new SystemWebCookieManager()
    });
    app.UseOpenIdConnectAuthentication(
        new OpenIdConnectAuthenticationOptions
        {
            ClientId = OidcOptions.ClientId,
            ClientSecret = OidcOptions.ClientSecret,
            Authority = OidcOptions.Authority,
            RedirectUri = OidcOptions.RedirectUri,
            PostLogoutRedirectUri = OidcOptions.PostLogoutRedirectUri,
            Scope = OidcOptions.Scope,
            ResponseType = OidcOptions.ResponseType,
            UseTokenLifetime = false,
            // 新增这一行，把配置管理器传给中间件
            ConfigurationManager = configurationManager,
            TokenValidationParameters = new TokenValidationParameters()
            {
                // 删除手动赋值的IssuerSigningKeys，由中间件自动从配置管理器获取最新密钥
                RequireSignedTokens = true,
                RequireExpirationTime = true,
                ValidateLifetime = true,
                ValidateAudience = true,
                ValidAudience = OidcOptions.Audience,
                ValidateIssuer = true,
                ValidIssuer = OidcOptions.Issuer
            },
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                AuthenticationFailed = OnAuthenticationFailed,
                MessageReceived = OnMessageReceived,
                RedirectToIdentityProvider = OnRedirectToIdentityProvider,
                SecurityTokenValidated = OnSecurityTokenValidated
            }
        }
    );
}

如果需要调整配置刷新频率，可以在创建ConfigurationManager时传入第四个参数refreshInterval，比如设置为每12小时刷新一次配置：

var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
    $"{OidcOptions.Authority}/.well-known/openid-configuration",
    new OpenIdConnectConfigurationRetriever(),
    new HttpDocumentRetriever(),
    TimeSpan.FromHours(12)
);

额外排查验证点 #

如果修改代码后问题仍复现，检查以下配置：

• 确认生产环境没有防火墙、代理拦截中间件的OIDC配置刷新请求，保证中间件可以正常访问/.well-known/openid-configuration和JWKS端点
• 如果生产环境需要配置出站代理，给HttpDocumentRetriever配置代理信息：

var httpRetriever = new HttpDocumentRetriever { 
    HttpClient = new HttpClient(new HttpClientHandler { 
        Proxy = new WebProxy("你的生产环境代理地址") 
    }) 
};
var configurationManager = new ConfigurationManager<OpenIdConnectConfiguration>(
    $"{OidcOptions.Authority}/.well-known/openid-configuration",
    new OpenIdConnectConfigurationRetriever(),
    httpRetriever
);

• 确认生产环境的OidcOptions.Authority配置正确，没有指向错误的身份提供商端点

内容的提问来源于stack exchange，提问作者FabULOUS