Blazor 使用 Azure AD 身份验证允许匿名访问 [英] Blazor using Azure AD authentication allowing anonymous access

问题描述

我目前正在编写一个包含默认 AzureAD 身份验证的(服务器端)Blazor 应用程序.

I'm currently writing a (Server side) Blazor application that includes the default AzureAD Authentication.

这对经过身份验证的用户非常有效 - 对入口 (_Host.cshtml) 文件提出挑战，重定向，然后在经过身份验证后返回.

This works well for authenticated users - challenging on the entrance (_Host.cshtml) file, redirecting and then back once authenticated.

我需要有几个页面需要身份验证 - 我不希望用户受到质疑并将其重定向到 Microsoft.

I need to have a couple of pages not requiring authentication - I don't want the user being challenged and redirected to Microsoft.

这样做的正确方法是什么?我已经尝试了 AllowAnonymousAttribute、AllowAnonymousToPage 剃须刀页面选项，似乎没有什么能阻止挑战.

What is the correct way to do this? I have experimented with the AllowAnonymousAttribute, the AllowAnonymousToPage razor pages options, nothing seems to stop the challenge.

任何帮助将不胜感激！

以下是我的身份验证设置(ConfigureServices):

Below is my setup for Authentication (ConfigureServices):

public void ConfigureServices(IServiceCollection services)
{
    services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
        .AddAzureAD(options => Configuration.Bind("AzureAd", options));

    services.AddControllersWithViews(options =>
{
    var policy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .Build();
    options.Filters.Add(new AuthorizeFilter(policy));
});

    services.AddRazorPages();
    services.AddServerSideBlazor();
    services.AddTelerikBlazor();
}

然后是配置中的相应部分:

And then the appropriate part in Configure:

app.UseAuthentication();
app.UseAuthorization();

app.UseEndpoints(endpoints =>
{
    endpoints.MapControllers();
    endpoints.MapBlazorHub();
    endpoints.MapFallbackToPage("/_Host");
});

推荐答案

我发现我要做的就是将以下内容添加到_Hosts.cshtml

I found what I had to do was add the following to _Hosts.cshtml

@using Microsoft.AspNetCore.Authorization
@attribute [AllowAnonymous]

一旦我这样做了，默认情况下任何页面都不再需要此授权，然后我可以将其添加到我想要的页面中.

Once I did this authorization was no longer required on any of the pages by default and I could then add it to the pages where I wanted to require it.

例如，如果您想保护 Counter.razor 页面的安全，只需在顶部添加一个 Authorize 属性:

For example if you wanted to secure the Counter.razor page just add an Authorize attribute to the top:

@attribute [Authorize]

所以现在如果您尝试访问计数器页面，您将收到一条未授权消息.

So now if you tried to access the counter page you will get a Not authorized message.

如果您想在用户未登录时删除计数器链接，请修改 NavMenu.razor 并用 <AuthorizeView> 包围 Counter 链接.</AuthorizeView> 如下:

If you want to remove the counter link when the user is not logged in modify the NavMenu.razor and surround the Counter link with an <AuthorizeView> </AuthorizeView> as so:

<AuthorizeView>
    <li class="nav-item px-3">
        <NavLink class="nav-link" href="counter">
            <span class="oi oi-plus" aria-hidden="true"></span> Counter
        </NavLink>
    </li>
</AuthorizeView> 

理想情况下，我希望选择退出对索引页面的授权，并默认保护所有其他内容，但我找不到让它工作的方法.如果我尝试将 @attribute [AllowAnonymous] 添加到 Index.razor 页面，它似乎会忽略它.

Ideally I would have liked to just opt out of authorization for the index page and have everything else secured by default but I could not find a way to get that to work. If I tried adding the @attribute [AllowAnonymous] to the Index.razor page it seemed to ignore it.

这篇关于Blazor 使用 Azure AD 身份验证允许匿名访问的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！