Blazor WASM自定义AuthenticationStateProvider破坏Azure MSAL认证流程

问题根因 #

你当前的错误核心是直接替换了Blazor全局的AuthenticationStateProvider实现：Azure AD认证依赖微软官方提供的RemoteAuthenticationStateProvider处理回调、状态同步等内置逻辑，你注册自定义的JWT认证提供器作为全局唯一实现后，Azure AD的认证流程找不到对应的内置处理器，就会抛出事件关联异常。

解决方案 #

采用复合认证状态提供器的方案，不覆盖原有Azure AD的认证逻辑，同时兼容JWT认证能力，具体实现步骤如下：

步骤1：修改服务注册逻辑 #

不要直接替换全局AuthenticationStateProvider，改为同时保留两种认证提供器的注册：

// 保留原有的Azure AD认证配置，不要修改
builder.Services.AddMsalAuthentication(...); 

// 单独注册自定义JWT认证状态提供器，不要替换全局实现
builder.Services.AddScoped<ApiAuthenticationStateProvider>();
// 注册复合认证状态提供器作为全局实现
builder.Services.AddScoped<AuthenticationStateProvider, CompositeAuthenticationStateProvider>();

步骤2：实现复合认证状态提供器 #

新建CompositeAuthenticationStateProvider类，自动判断当前应该走哪种认证逻辑：

public class CompositeAuthenticationStateProvider : AuthenticationStateProvider
{
    private readonly ApiAuthenticationStateProvider _jwtAuthProvider;
    private readonly RemoteAuthenticationStateProvider _azureAdAuthProvider;
    private readonly ILocalStorageService _localStorage;

    public CompositeAuthenticationStateProvider(
        ApiAuthenticationStateProvider jwtAuthProvider,
        RemoteAuthenticationStateProvider azureAdAuthProvider,
        ILocalStorageService localStorage)
    {
        _jwtAuthProvider = jwtAuthProvider;
        _azureAdAuthProvider = azureAdAuthProvider;
        _localStorage = localStorage;
        // 转发两种认证的状态变更事件
        _jwtAuthProvider.AuthenticationStateChanged += state => NotifyAuthenticationStateChanged(state);
        _azureAdAuthProvider.AuthenticationStateChanged += state => NotifyAuthenticationStateChanged(state);
    }

    public override async Task<AuthenticationState> GetAuthenticationStateAsync()
    {
        // 存在本地JWT令牌则走JWT认证逻辑
        var token = await _localStorage.GetItemAsync<string>("authToken");
        if (!string.IsNullOrWhiteSpace(token))
        {
            return await _jwtAuthProvider.GetAuthenticationStateAsync();
        }
        // 否则走Azure AD认证逻辑
        return await _azureAdAuthProvider.GetAuthenticationStateAsync();
    }
}

步骤3：修改AccountService注入逻辑 #

直接注入自定义JWT认证提供器，避免类型转换错误：

public class AccountService : IAccountService
{
    private readonly HttpClient _httpService;
    // 直接注入自定义JWT认证提供器，不需要类型转换
    private readonly ApiAuthenticationStateProvider _jwtAuthProvider;
    private readonly ILocalStorageService _localStorage;
    private readonly NavigationManager _navigationManager;

    public User User { get; private set; }

    public AccountService(
        HttpClient httpService,
        ApiAuthenticationStateProvider jwtAuthProvider,
        ILocalStorageService localStorageService,
        NavigationManager navigationManager)
    {
        _httpService = httpService;
        _jwtAuthProvider = jwtAuthProvider;
        _localStorage = localStorageService;
        _navigationManager = navigationManager;
    }

    public async Task Initialize()
    {
        User = await _localStorage.GetItemAsync<User>("user");
    }

    public async Task<LoginResult> Login(LoginRequest model)
    {
        AuthCredentials authCredentials = new AuthCredentials()
        {
            Username = model.Email,
            Password = model.Password
        };
        try
        {
            var loginAsJson = JsonSerializer.Serialize(authCredentials);
            var response = await _httpService.PostAsync("api/auth/login", new StringContent(loginAsJson, Encoding.UTF8, "application/json"));
            var loginResult = JsonSerializer.Deserialize<LoginResult>(await response.Content.ReadAsStringAsync(), new JsonSerializerOptions { PropertyNameCaseInsensitive = true });

            if (!loginResult.Successful)
                return null;

            await _localStorage.SetItemAsync("authToken", loginResult.Token);
            await _localStorage.SetItemAsync("user", loginResult.User);
            User = loginResult.User;
            // 直接调用JWT认证提供器的方法
            _jwtAuthProvider.MarkUserAsAuthenticated(loginResult.Email);
            _httpService.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("bearer", loginResult.Token);
            return loginResult;
        }
        catch (Exception ex)
        {
            return null;
        }
    }

    public async Task Logout()
    {
        await _localStorage.RemoveItemAsync("authToken");
        await _localStorage.RemoveItemAsync("user");
        _jwtAuthProvider.MarkUserAsLoggedOut();
        _httpService.DefaultRequestHeaders.Clear();
        // 检查是否是Azure AD登录用户，是则走Azure AD登出逻辑
        var state = await _azureAdAuthProvider.GetAuthenticationStateAsync();
        if (state.User.Identity.IsAuthenticated)
        {
            _navigationManager.NavigateTo("authentication/logout");
        }
        else
        {
            _navigationManager.NavigateTo("/");
        }
    }
}

步骤4：兼容原有业务逻辑 #

自定义账号密码登录按钮直接走AccountService.Login逻辑，Azure AD登录按钮保持官方RemoteAuthenticatorView组件的原有调用方式即可，两种登录逻辑完全独立互不影响。

内容的提问来源于stack exchange，提问作者Martin Dempsey