Question

您好我开始使用此处的示例

https://github.com/Azure-Samples/active-directory-b2c-dotnet-webapp-and-webapi

并且让人们将TaskWebApp与TaskService进行对话。

我现在想扩展解决方案以获得第三项服务

我不确定问题是否在ConfidentialClientApplication中，因为它无法获取我的令牌时我没有例外。

我认为问题是我的TaskWebApp中的COnfigureApp方法只期望从单个TokenService管理令牌。

这是我的网络App Starttup.Auth ConfigureAuth方法，这与示例应用程序保持不变

 public void ConfigureAuth(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions());
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {
                // Generate the metadata address using the tenant and policy information
                MetadataAddress = String.Format(AadInstance, Tenant, DefaultPolicy),

                // These are standard OpenID Connect parameters, with values pulled from web.config
                ClientId = ClientId,
                RedirectUri = RedirectUri,
                PostLogoutRedirectUri = RedirectUri,

                // Specify the callbacks for each type of notifications
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    RedirectToIdentityProvider = OnRedirectToIdentityProvider,
                    AuthorizationCodeReceived = OnAuthorizationCodeReceived,
                    AuthenticationFailed = OnAuthenticationFailed,
                },

                // Specify the claims to validate
                TokenValidationParameters = new TokenValidationParameters
                {
                    NameClaimType = "name"
                },

                // Specify the scope by appending all of the scopes requested into one string (seperated by a blank space)
                Scope = $"{OpenIdConnectScopes.OpenId} {ReadTasksScope} {WriteTasksScope}"
            }
        );
    }

这是我的OnAuthorizationCodeReceived方法，再次未更改

 private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification notification)
    {
        // Extract the code from the response notification
        var code = notification.Code;

        var userObjectId = notification.AuthenticationTicket.Identity.FindFirst(ObjectIdElement).Value;
        var authority = String.Format(
                            AadInstance, 
                            Tenant, 
                            DefaultPolicy);
        var httpContext = notification.OwinContext.Environment["System.Web.HttpContextBase"] as HttpContextBase;

        // Exchange the code for a token. Make sure to specify the necessary scopes
        ClientCredential cred = new ClientCredential(ClientSecret);
        ConfidentialClientApplication app = new ConfidentialClientApplication(
                                            authority, 
                                            Startup.ClientId,
                                            RedirectUri, 
                                            cred, 
                                            new NaiveSessionCache(userObjectId, httpContext));

        var authResult = await app.AcquireTokenByAuthorizationCodeAsync(new string[]
        {
            ReadTasksScope,
            WriteTasksScope
        }, 
        code, 
        DefaultPolicy);



    }

问题似乎是我的Readand写入作用域直接引用了TaskService，当我尝试从其他应用程序请求适当的作用域时，它会抱怨。

在我的控制器中

    private async Task<String> acquireToken(String[] scope)
    {

        try
        {
            string userObjectID = ClaimsPrincipal.Current.FindFirst(Startup.ObjectIdElement).Value;
            string authority = String.Format(Startup.AadInstance, Startup.Tenant, Startup.DefaultPolicy);

            ClientCredential credential = new ClientCredential(Startup.ClientSecret);

            // Retrieve the token using the provided scopes
            ConfidentialClientApplication app = new ConfidentialClientApplication(authority, Startup.ClientId,
                Startup.RedirectUri, credential,
                new NaiveSessionCache(userObjectID, this.HttpContext));

            AuthenticationResult result = await app.AcquireTokenSilentAsync(scope);

            return result.Token;
        }
        catch (Exception e)
        {
            Debug.WriteLine(e.Message);
            throw e;
        }

使用此方法，但My AuthorisationResult失败，消息无法以无内部异常的方式获取令牌。

到目前为止，我已尝试删除NaiveSessionCache作为其可选项，但仍然无法

为了解决这个问题，我已经注册了第4项服务，然后让我的webapis使用单个客户端ID和密码来控制对其资源的访问，但这感觉它不是正确的前进方式。

任何帮助都会非常感谢

扩展MSAL以支持多个Web API

0 个答案: