Question

在微软搜索了几个小时的产品API文档之后，我仍然不知道如何在windows azure pack发行版中验证其他API请求。主要是我想创建一个自动化部署虚拟机的API的API，但是我找不到任何关于如何获取身份验证令牌来访问资源的文档。

某些文档说明了ADFS的使用，但没有提供有关ADFS REST API的任何参考以进行身份验证。

我不想首先使用ADFS。我想使用AZURE租户和管理界面进行身份验证。

总之，如果任何人都可以提供有关REST API身份验证的任何帮助，那么它将成为我的一天。提前致谢。

Answer 1

您可以使用以下PowerShell获取访问令牌。

Add-Type -Path 'C:\Program Files\Microsoft Azure Active Directory Connect\Microsoft.IdentityModel.Clients.ActiveDirectory.dll'

$tenantID = "<the tenant id of you subscription>"
$authString = "https://login.windows.net/$tenantID" 

# It must be an MFA-disabled admin. 
$username = "<the username>"
$password = "<the password>"

# The resource can be https://graph.windows.net/ if you are using graph api.
# Or, https://management.azure.com/ if you are using ARM.
$resource = "https://management.core.windows.net/"

# This is the common client id.
$client_id = "1950a258-227b-4e31-a9cf-717495945fc2"

$creds = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.UserCredential" `
    -ArgumentList $username,$password

$authContext = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext" `
    -ArgumentList $authString

$authenticationResult = $authContext.AcquireToken($resource,$client_id,$creds)

# An Authorization header can be formed like this.
$authHeader = $authenticationResult.AccessTokenType + " " + $authenticationResult.AccessToken

Answer 2

我正在做类似的工作。

        static string GetAspAuthToken(string authSiteEndPoint, string userName, string password)
    {

        var identityProviderEndpoint = new EndpointAddress(new Uri(authSiteEndPoint + "/wstrust/issue/usernamemixed"));

        var identityProviderBinding = new WS2007HttpBinding(SecurityMode.TransportWithMessageCredential);
        identityProviderBinding.Security.Message.EstablishSecurityContext = false;
        identityProviderBinding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
        identityProviderBinding.Security.Transport.ClientCredentialType = HttpClientCredentialType.None;

        var trustChannelFactory = new WSTrustChannelFactory(identityProviderBinding, identityProviderEndpoint)
        {
            TrustVersion = TrustVersion.WSTrust13,
        };
        //This line is only if we're using self-signed certs in the installation 
        trustChannelFactory.Credentials.ServiceCertificate.SslCertificateAuthentication = new X509ServiceCertificateAuthentication() { CertificateValidationMode = X509CertificateValidationMode.None };

        trustChannelFactory.Credentials.SupportInteractive = false;
        trustChannelFactory.Credentials.UserName.UserName = userName;
        trustChannelFactory.Credentials.UserName.Password = password;

        var channel = trustChannelFactory.CreateChannel();
        var rst = new RequestSecurityToken(RequestTypes.Issue)
        {
            AppliesTo = new EndpointReference("http://azureservices/TenantSite"),
            TokenType = "urn:ietf:params:oauth:token-type:jwt",
            KeyType = KeyTypes.Bearer,
        };

        RequestSecurityTokenResponse rstr = null;
        SecurityToken token = null;


        token = channel.Issue(rst, out rstr);
        var tokenString = (token as GenericXmlSecurityToken).TokenXml.InnerText;
        var jwtString = Encoding.UTF8.GetString(Convert.FromBase64String(tokenString));

        return jwtString;
    }

参数“authSiteEndPoint”是您的租户身份验证网站网址。默认端口是30071。

你可以在这里找到一些资源： https://msdn.microsoft.com/en-us/library/dn479258.aspx

示例程序“SampleAuthApplication”可以解决您的问题。

Azure Pack REST API身份验证

2 个答案: