问使用Azure AD进行身份验证，但使用and成员资格角色和声明进行授权

EN

public partial class Startup
    {       
        public void ConfigureAuth(IAppBuilder app)
        {
            string clientId = System.Configuration.ConfigurationManager.AppSettings["ClientId"];
            string redirectUri = System.Configuration.ConfigurationManager.AppSettings["RedirectUri"];
            string tenant = System.Configuration.ConfigurationManager.AppSettings["Tenant"];
            string authority = string.Format(System.Configuration.ConfigurationManager.AppSettings["Authority"], tenant);
            var cookieExpiryHours = Int32.Parse(System.Configuration.ConfigurationManager.AppSettings["CookieExpiryHours"]);

            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                CookieManager = new SystemWebCookieManager(),
                ExpireTimeSpan = TimeSpan.FromMinutes(cookieExpiryHours), 
                SlidingExpiration=true,             
            });

            app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {                   
                    ClientId = clientId,
                    Authority = authority,
                    RedirectUri = redirectUri,                   
                    PostLogoutRedirectUri = redirectUri,
                    Scope = OpenIdConnectScope.OpenIdProfile,
                    UseTokenLifetime = false,
                    // ResponseType is set to request the code id_token - which contains basic information about the signed-in user
                    ResponseType = OpenIdConnectResponseType.CodeIdToken,                    
                    TokenValidationParameters = new TokenValidationParameters()
                    { 
                        ValidateIssuer = true
                    },                  
                  
                    Notifications = new OpenIdConnectAuthenticationNotifications
                    {
                        AuthenticationFailed = OnAuthenticationFailed,
                        SecurityTokenValidated = OnSecurityTokenValidated,
                    }
                }

            );
         
        }

        private Task OnSecurityTokenValidated(SecurityTokenValidatedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> context)
        {
            var OIDClaimDesc = "http://schemas.microsoft.com/identity/claims/objectidentifier";
            var claims = context.AuthenticationTicket.Identity.Claims;
            var cookieExpiryHours = Int32.Parse(System.Configuration.ConfigurationManager.AppSettings["CookieExpiryHours"]);

            context.AuthenticationTicket.Properties.ExpiresUtc = DateTimeOffset.UtcNow.AddHours(cookieExpiryHours);
            context.AuthenticationTicket.Properties.IsPersistent = false;

            var owinContext = context.OwinContext;
            var userIdentity = context.AuthenticationTicket.Identity;
            var userClaims = userIdentity as ClaimsIdentity;
            
            var firstName = userClaims?.FindFirst(ClaimTypes.GivenName)?.Value ?? string.Empty;
            var lastName = userClaims?.FindFirst(ClaimTypes.Surname)?.Value ?? string.Empty;
            var email = userClaims?.FindFirst(ClaimTypes.Email)?.Value ?? string.Empty;
            var objID = Guid.Parse(userClaims.FindFirst(OIDClaimDesc).Value);
            var user = new UserService().GetUser(objID, email);

            if (user is null)//This user has just wandered in to the site or the admins have not added this user in the DB yet. Just redirect them back to log out
            {
                owinContext.Authentication.Challenge();
                return Task.FromResult(0);
            }

            if (userIdentity.IsAuthenticated)
            {
                userIdentity.AddClaim(new Claim(ClaimTypes.GivenName, firstName));
                userIdentity.AddClaim(new Claim(ClaimTypes.Surname, lastName));
                userIdentity.AddClaim(new Claim(ClaimTypes.Email, email));
                userIdentity.AddClaim(new Claim("AzureID", objID.ToString()));
                userIdentity.AddClaim(new Claim(ClaimTypes.Role, "user"));
            }

            new UserService().UpdateUser(objID, firstName, lastName, email);

            foreach (var claim in user.UserClaims)
            {
                if (!claim.ClaimType.Equals(ClaimTypes.GivenName, StringComparison.OrdinalIgnoreCase)
                    && !claim.ClaimType.Equals(ClaimTypes.Surname, StringComparison.OrdinalIgnoreCase))
                {
                    userIdentity.AddClaim(new Claim(ClaimTypes.Role, claim.ClaimValue));
                }
            }

            return Task.FromResult(0);
        }

        /// <summary>
        /// Handle failed authentication requests by redirecting the user to the home page with an error in the query string
        /// </summary>
        /// <param name="context"></param>
        /// <returns></returns>
        private Task OnAuthenticationFailed(AuthenticationFailedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> context)
        {
            var code = "IDX21323";
            if (context.Exception.Message.Contains(code)) //I need this, as under certain conditions, the auth process was going on an infinite loop. 
            {
                context.HandleResponse();
                context.OwinContext.Authentication.Challenge();
            }

            return Task.FromResult(true);
        }
    }

public UserViewModel GetUser(Guid guid, string email)
        {
            var model = new UserViewModel();
            using (var ctxt = new DBContext())
            {
                var user = ctxt.Users.Where(x => (x.Email == email || x.OID==guid) && x.IsActive).FirstOrDefault();
                if (user == null)
                    return null;
                var claims = ctxt.UserClaims.Where(x => x.UserId==user.ID).ToList();
                model = Mapper.Map<UserViewModel>(user);
                model.UserClaims = Mapper.Map<List<ViewModels.UserClaimViewModel>>(claims);
            }


            return model;
        }