排查ASP.NET Core站点EF调用返回401响应的故障原因

异常信息 #

• 访问站点时接口返回401响应，报错接口为 configuration/staticcontent
• 异常截图：

关联代码 #

1. 报错接口实现 #

[HttpGet("staticcontent")]
public async Task<IActionResult> GetStaticContent()
{
    return Ok(this.mapper.Map<StaticContentValueDto[]>(await this.staticContentValuesProvider.GetStaticContentValues()));
}

2. 依赖方法GetStaticContentValues()实现 #

public async Task<IEnumerable<StaticContentValue>> GetStaticContentValues()
{
    return await this.dbContext.StaticContentValues.ToArrayAsync();
}

3. ConfigureServices服务配置代码 #

public void ConfigureServices(IServiceCollection services)
{
    services.AddApplicationInsightsTelemetry();
    services.AddSpaStaticFiles(configuration => { configuration.RootPath = "ClientApp/dist"; });
    services.AddMvcCore()
        .AddAuthorization();

    services.AddControllers().AddNewtonsoftJson(o=>
    {
        o.SerializerSettings.ContractResolver = new DefaultContractResolver();
        o.SerializerSettings.ReferenceLoopHandling = ReferenceLoopHandling.Ignore;
    });
    

    string connection = Configuration.GetConnectionString("DefaultConnection");
    string reportingConnection = Configuration.GetConnectionString("ReportingConnection");

    services.AddDbContext<PnbIdentityDbContext>(options =>
        options.UseSqlServer(connection));
    
    //此处还有约20个针对SQL Server的AddDbContext配置
    //此处还有约20个针对SQL Server的AddDbContext配置
    
    services.AddIdentity<PnbIdentityUser, PnbIdentityRole>(options => {
        options.Password.RequireDigit = true;
        options.Password.RequiredLength = 8;
        options.Password.RequireNonAlphanumeric = false;
        options.Password.RequireUppercase = false;
        options.Password.RequireLowercase = false;
    })
        .AddEntityFrameworkStores<PnbIdentityDbContext>()
        .AddDefaultTokenProviders();

    services.AddAutoMapper(typeof(CapsAutoMapperProfile));

    SessionConfigurator.Configure(services);
    AuthConfigurator.Configure(services, Configuration["Identity:TokenSecret"]);
    DiConfigurator.Configure(services);
    HangfireConfigurator.Configure(services, connection);
}

已知前提 #

• 初步怀疑故障和AD身份验证配置有关
• Identity:TokenSecret参数已在appsettings.json中完成配置

配置问题&401触发原因 #

存在的配置问题 #

1. 仅在ConfigureServices中调用了AddAuthorization()启用授权能力，但没有在Configure方法的请求管道中注册身份验证中间件，服务端无法解析请求携带的身份凭证，直接触发401
2. 同时注册AddMvcCore().AddAuthorization()和AddControllers()存在配置冗余，AddControllers()内部已经包含AddMvcCore()核心功能，重复注册可能导致授权规则加载异常
3. 如果项目全局配置了[Authorize]过滤器，GetStaticContent接口没有添加[AllowAnonymous]注解的话，未携带合法身份凭证的请求会被直接拦截返回401
4. 若AuthConfigurator.Configure方法内部没有正确配置AD/JWT的默认身份验证、挑战方案，或者AD元地址、客户端ID等核心参数配置错误，也会导致身份校验失败返回401

401直接触发原因 #

Configure方法中缺少app.UseAuthentication()注册，或是UseAuthentication放在了UseAuthorization之后，顺序错误会直接导致身份验证失效
请求头未携带合法身份凭证、凭证过期、签名校验失败也会触发401响应。

内容的提问来源于stack exchange，提问作者Alex Gordon