用户从Office应用程序单击链接时找不到OpenIdConnect关联Cookie [英] OpenIdConnect Correlation Cookie not found when user click link from Office application
问题描述
我有一个使用OpenIdConnect向Azure Active Directory进行身份验证的应用程序.除非我从Office应用程序(excel/word)链接到我的网站,否则一切都工作正常.从这些应用程序中,我得到一个异常:关联失败.".
I have an app that is authenticating with Azure Active Directory using OpenIdConnect. Everything is working fine except when I link to my site from a Office Application (excel/ word). From these applications I get a "Exception: Correlation failed.".
从我的研究看来,办公室首先要进行302重定向,然后打开该页面而不是原始链接.
From my research it seems to be that office is first doing the 302 redirect and then opening that page not the original link.
请参阅: https://github.com/aspnet/Security/issues/1252
在有关如何处理此情况的建议之后.我不想对身份验证流程进行很多更改并引入错误.
After a recommendation for how to handle this scenario. I don't want to have to make to many changes to the authentication flow and introduce bugs.
当我检测到excel的用户代理时,我尝试重定向到我网站上的其他页面.我以为可以设置正确的cookie,然后可以从那里重定向到请求的页面,然后触发授权.虽然没有运气
I have tried redirecting to a different page on my site when a user-agent of excel is detected. I thought then the correct cookie would be set and I could redirect from there to the requested page which would then trigger authorization. No luck though
OnRedirectToIdentityProvider = context =>
{
if (context.Request.Headers["User-Agent"].ToString().Contains("Microsoft Office Excel"))
{
string redirect = context.Request.Scheme + "://" + context.Request.Host + context.Request.PathBase + "/Home/Office" + "?url=" + context.Request.Scheme + "://" + context.Request.Host + context.Request.PathBase + context.Request.Path;
context.Response.Clear();
context.Response.Redirect(redirect);
context.HandleResponse();
return Task.CompletedTask;
}
}
推荐答案
我能够使用owin中间件实现不错的解决方案.很大程度上是在这篇文章的帮助下: https://github.com/aspnet/AspNetKatana/issues/78
I was able to implement a decent solution using owin middleware. Largely with the help of this post: https://github.com/aspnet/AspNetKatana/issues/78
我到底需要将其转换为.net core 2.0.这是转换后的代码:
I how ever did need to convert it to .net core 2.0. Here's the converted code:
public class MsOfficeLinkPrefetchMiddleware
{
RequestDelegate _next;
public MsOfficeLinkPrefetchMiddleware(RequestDelegate next)
{
_next = next;
}
public Task Invoke(HttpContext context)
{
if (Is(context, HttpMethod.Get, HttpMethod.Head) && IsMsOffice(context))
{
// Mitigate by preempting auth challenges to MS Office apps' preflight requests and
// let the real browser start at the original URL and handle all redirects and cookies.
// Success response indicates to Office that the link is OK.
context.Response.StatusCode = (int)HttpStatusCode.OK;
context.Response.Headers["Cache-Control"] = "no-cache, no-store, must-revalidate";
context.Response.Headers["Pragma"] = "no-cache";
context.Response.Headers["Expires"] = "0";
}
else if (_next != null)
{
return _next.Invoke(context);
}
return Task.CompletedTask;
}
private static bool Is(HttpContext context, params HttpMethod[] methods)
{
var requestMethod = context.Request.Method;
return methods.Any(method => StringComparer.OrdinalIgnoreCase.Equals(requestMethod, method.Method));
}
private static readonly Regex _msOfficeUserAgent = new Regex(
@"(^Microsoft Office\b)|([\(;]\s*ms-office\s*[;\)])",
RegexOptions.CultureInvariant | RegexOptions.IgnoreCase | RegexOptions.Singleline | RegexOptions.Compiled);
private static bool IsMsOffice(HttpContext context)
{
var headers = context.Request.Headers;
var userAgent = headers["User-Agent"];
return _msOfficeUserAgent.IsMatch(userAgent)
|| !string.IsNullOrWhiteSpace(headers["X-Office-Major-Version"]);
}
}
启动
app.UseMiddleware<MsOfficeLinkPrefetchMiddleware>();
希望这能够在将来帮助某人.
Hope this is able to help someone in the future.
这篇关于用户从Office应用程序单击链接时找不到OpenIdConnect关联Cookie的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!