将IdentityServer4与Azure Active Directory连接

显然,我几乎是对的。以下是我的解决方案:

JwtSecurityTokenHandler.DefaultInboundClaimTypeMap.Clear();

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationScheme = 
        IdentityServerConstants.DefaultCookieAuthenticationScheme,
    AutomaticAuthenticate = true,
    AutomaticChallenge = true
});

    public static OpenIdConnectOptions CreateAzureAdOptions(X509Certificate2 certificate2, IConfiguration configuration)
    {
        return new OpenIdConnectOptions
        {
            DisplayName = "Azure Active Directory",
            AuthenticationScheme = "Azure",
            ClientId = configuration["OpenId:AzureAD:AppId"],
            Authority = string.Format(CultureInfo.InvariantCulture, "https://login.windows.net/{0}", configuration["OpenId:AzureAD:Instance"]),
            TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = false
            },
            // https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-token-and-claims
            Scope = {"openid", "email", "roles", "groups"},
            Events = new OpenIdConnectEvents
            {
                OnRemoteFailure = context => HandleRemoteFailure(context)
            },
            SignInScheme = IdentityServerConstants.ExternalCookieAuthenticationScheme
        };
    }

    private static Task HandleRemoteFailure(FailureContext context)
    {
        Log.Error(context.Failure, "Azure AD Remote Failure");
        context.Response.Redirect("/accessdenied");
        context.HandleResponse();
        return Task.FromResult(0);
    }