C# .NET Core 如何配置多认证提供方实现AzureAD与Auth0自动认证

场景说明 #

现有已上线API基于AzureAD完成身份认证，需新增Auth0认证支持，要求：

• 完全保留原有AzureAD用户的访问权限
• 无需客户端在请求中指定认证架构，API可直接识别Authorization请求头携带的令牌来源，自动完成对应校验

ConfigureServices 服务配置 #

注册多套JWT认证架构 #

将AzureAD的JWT Bearer认证设为默认架构，Auth0的JWT Bearer以自定义唯一名称注册：

{
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddJwtBearer(options =>
        {
            options.Audience = "dgdf7g6967-97fdgd";
            options.Authority = "https://login.microsoftonline.com/myazure.abc.com";
        })
        .AddJwtBearer("Auth0", options =>
        {
            options.Audience = "myweb.abc.com";
            options.Authority = "https://my.auth0.com";
        });
}

更新默认授权策略 #

调整默认授权策略，使其同时兼容两套认证架构，任意一套认证通过即可满足授权要求：

services.AddAuthorization(options =>
{
    var defaultAuthorizationPolicyBuilder = new AuthorizationPolicyBuilder(
        JwtBearerDefaults.AuthenticationScheme, "Auth0");
    defaultAuthorizationPolicyBuilder = defaultAuthorizationPolicyBuilder.RequireAuthenticatedUser();
    options.DefaultPolicy = defaultAuthorizationPolicyBuilder.Build();
});

自定义身份合并中间件 #

基础配置完成后，需合并两套认证架构返回的身份标识，通过自定义中间件MultipleSchemaAuthenticationMiddleware实现，核心InvokeAsync逻辑：

public async Task InvokeAsync(HttpContext context)
{
    var principal = new ClaimsPrincipal();

    // 校验AzureAD默认架构令牌
    var resultAzureAD = await context.AuthenticateAsync();
    if (resultAzureAD?.Principal != null)
    {
        principal.AddIdentities(resultAzureAD.Principal.Identities);
    }
   
    // 校验Auth0自定义架构令牌
    var resultAuth0 = await context.AuthenticateAsync(AppHelper.Settings.Auth0.SchemaName);
    if (resultAuth0?.Principal != null)
    {
        principal.AddIdentities(resultAuth0.Principal.Identities);
    }

    context.User = principal;
    await _next(context);
}

中间件管道注册 #

在Startup.cs的Configure方法中注册上述自定义中间件：

app.UseMiddleware<MultipleSchemaAuthenticationMiddleware>();

内容的提问来源于stack exchange，提问作者mahisanka