Redirect user to custom login page when using Azur

问题:

I'm using the following code example to plug in Azure AD login to my application (https://github.com/AzureADSamples/WebApp-OpenIDConnect-DotNet).

I'm finding that the code works just fine however I want to have to ability to redirect a user to a custom login page if the user hasn't logged in yet or their session has expired. I'm struggling however to get this to work and was wondering if this is indeed possible at all?

Is it by design that the user is always redirected to the Microsoft Login page for Azure AD rather than your own custom page or is there a setting I've missed?

I've amended the supplied code in FilterConfig.cs to enable the Authorize filter attribute:

filters.Add(new AuthorizeAttribute());

I've also added the following to web.config but to no effect:

<authorization>
<allow users="?" />
</authorization>

Within the Startup.Auth.cs file I cannot see any changes that are possible to app.UseOpenIdConnectAuthentication to allow me to set up a generic login page as I may possibly do with cookies based auth.

回答1:

After some re going over the code I've found the solution to my issue.

Within Startup.Auth.cs:

app.UseCookieAuthentication(new CookieAuthenticationOptions {
   LoginPath = new PathString("/Account/Login")
});

app.UseOpenIdConnectAuthentication(
   new OpenIdConnectAuthenticationOptions {
      ClientId = clientId,
      Authority = authority,
      PostLogoutRedirectUri = postLogoutRedirectUri,
      AuthenticationMode = AuthenticationMode.Passive
});

It's the inclusion of the AuthenticationMode = AuthenticationMode.Passive line which seems to stop OpenIdConnectAuth from performing the automatic 302 redirect to the AAD login pages.

回答2:

Assuming Azure AD is your identity provider, you can Customize the login page, but you have to be running Azure AD Premium to do so.

回答3:

This maybe what I'm looking for...

• non-interactive authentication in a native client (https://github.com/AzureADSamples/NativeClient-Headless-DotNet)

This sample allows a user to login to Azure AD without the need to use Azure AD's native browser based logins.

I understand this is somewhat considered an anti pattern as I'll be forgoing Azure's built in mechanisms for handling multi factor auth, password resets etc. but I'll retain full control of the experience.

==== Edit ==== This isn't the way I want to go as I'll be stripping out a lot of what AAD offers out the box. In essence I'd like to keep AAD's control flows but I just want to have the ability to control what page a user lands on when a user isn't logged in.

Currently the flow is: Not authorised -> 302 redirect -> AAD login

I'd like: Not authorised -> 302 redirect -> Self hosted login required page -> User login button press -> 302 redirect -> AAD login

Its this flow I can't seem to work out.