Azure活动目录和owin身份验证

刚刚遇到一个与azure广告应用程序和owin openid身份验证有关的奇怪问题 . 重现问题 .

1.在vs 2015中选择 Cloud 应用模板，使用azure广告身份验证创建一个Web应用 .

2.标准代码按原样 .

3.let startup.auth原样 .

4.在本地运行应用程序它工作正常 .

5.现在在启动àuth中更改代码如下

public partial class Startup
{
    private static string clientId = ConfigurationManager.AppSettings["ida:ClientId"];
    private static string appKey = ConfigurationManager.AppSettings["ida:ClientSecret"];
    private static string aadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
    private static string tenantId = ConfigurationManager.AppSettings["ida:TenantId"];
    private static string postLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];

    public static readonly string Authority = aadInstance + tenantId;

    // This is the resource ID of the AAD Graph API.  We'll need this to request a token to call the Graph API.
    string graphResourceId = "https://graph.windows.net";

    private static readonly log4net.ILog logger = log4net.LogManager.GetLogger(System.Reflection.MethodBase.GetCurrentMethod().DeclaringType);

    public void ConfigureAuth(IAppBuilder app)
    {
        ApplicationDbContext db = new ApplicationDbContext();

        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
        logger.Debug("SetDefaultSignInAsAuthenticationType called");
        //app.UseCookieAuthentication(new CookieAuthenticationOptions());
        app.UseCookieAuthentication(
        new CookieAuthenticationOptions
        {
            Provider = new CookieAuthenticationProvider
            {
                OnResponseSignIn = ctx =>
                {
                    //logger.Debug("OnResponseSignIn called");
                    ////ctx.Identity = TransformClaims(ctx.Identity);
                    //logger.Debug("TransformClaims called");
                }
            }
        });

app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                ClientId = clientId,
                Authority = Authority,
                PostLogoutRedirectUri = postLogoutRedirectUri,

                Notifications = new OpenIdConnectAuthenticationNotifications()
                {
                    // If there is a code in the OpenID Connect response, redeem it for an access token and refresh token, and store those away.
                   AuthorizationCodeReceived = (context) =>
                   {
                       var code = context.Code;
                       ClientCredential credential = new ClientCredential(clientId, appKey);
                       string signedInUserID = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;
                       logger.Debug("OnResponseSignIn called");
                       logger.Debug("signedInUserID =" + signedInUserID);
                       TransformClaims(context.AuthenticationTicket.Identity);
                       logger.Debug("TransformClaims called");
                       AuthenticationContext authContext = new AuthenticationContext(Authority, new ADALTokenCache(signedInUserID));
                       AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode(
                       code, new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), credential, graphResourceId);



                       return Task.FromResult(0);
                   },



                    // we use this notification for injecting our custom logic
                    SecurityTokenValidated = (context) =>
                    {
                        logger.Debug("SecurityTokenReceived called");
                        //TransformClaims();  //pass the identity
                        return Task.FromResult(0);
                    },


                }
            });
    }


    private static void TransformClaims(System.Security.Claims.ClaimsIdentity identity)
    {
        if (identity != null && identity.IsAuthenticated == true)
        {
            var usserobjectid = identity.FindFirst(ConfigHelpers.Azure_ObjectIdClaimType).Value;
                ((System.Security.Claims.ClaimsIdentity)identity).AddClaim(new System.Security.Claims.Claim("DBID", "999"));
                ((System.Security.Claims.ClaimsIdentity)identity).AddClaim(new System.Security.Claims.Claim("Super","True"));
        }

        // return identity;
    }

}

6.在本地运行应用程序它将完美 .

7.在azure网站上部署应用程序，并且永远不会调用启动àuthowin通知方法 . 但是应用程序有效，但身份转换没有

有人可以帮助解决这个问题，因为azure广告应用不支持Cookie或通知不会解雇或代码有任何问题 .

只是为了重新声明其他而不是startup.àuth，没有标准代码被更改 .