Question

我有一个asp.net 4.6 Web窗体应用程序（没有MVC）。我正在更新应用程序中的安全性。我正在使用OpenIdConnectAuthentication向我们的Azure AD进行身份验证。然后，我将访问令牌传递给Microsoft图，以通过Office 365发送电子邮件。我的令牌设置为在60分钟后过期。我要么需要将到期时间扩展到8小时，要么刷新令牌。没有MVC，我不确定如何处理。我正在寻求指导，并可能对示例进行编码。

（我最初尝试使用MVC示例，并使用会话令牌类将其放入我的项目中。一旦我们与多个用户进行了测试，我相信我会发生内存泄漏，并且会在大约5分钟内崩溃。）

启动代码：

protoc

SDK助手：

public class Startup
    {
        private readonly string _clientId = ConfigurationManager.AppSettings["ClientId"];
        private readonly string _redirectUri = ConfigurationManager.AppSettings["RedirectUri"];
        private readonly string _authority = ConfigurationManager.AppSettings["Authority"];
        private readonly string _clientSecret = ConfigurationManager.AppSettings["ClientSecret"];

        public void Configuration(IAppBuilder app)
        {
            ConfigureAuth(app);
        }

        public void ConfigureAuth(IAppBuilder app)
        {
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                CookieManager = new SystemWebCookieManager(),
            });


            app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
            {
                ClientId = _clientId,
                ClientSecret = _clientSecret,
                //Authority = _authority,
                Authority = String.Format(_authority, domain, "/v2.0"),
                RedirectUri = _redirectUri,
                ResponseType = OpenIdConnectResponseType.CodeIdToken,
                Scope = OpenIdConnectScope.OpenIdProfile,
                UseTokenLifetime = false,
                TokenValidationParameters = new TokenValidationParameters { NameClaimType = "name", RequireExpirationTime = false},
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    AuthorizationCodeReceived = async n =>
                    {
                        // Exchange code for access and ID tokens
                        var auth = String.Format(_authority, "common/oauth2/v2.0", "/token");
                        var tokenClient = new TokenClient($"{auth}", _clientId, _clientSecret);

                        var tokenResponse = await tokenClient.RequestAuthorizationCodeAsync(n.Code, _redirectUri);
                        if (tokenResponse.IsError)
                        {
                            throw new Exception(tokenResponse.Error);
                        }
                        var claims = new List<Claim>()
                      {
                        new Claim("id_token", tokenResponse.IdentityToken),
                        new Claim("access_token", tokenResponse.AccessToken)
                      };

                        n.AuthenticationTicket.Identity.AddClaims(claims);
                    },

                },


            });
        }
    }

发送电子邮件：

public class SDKHelper
    {

        // Get an authenticated Microsoft Graph Service client.
        public static GraphServiceClient GetAuthenticatedClient()
        {
            GraphServiceClient graphClient = new GraphServiceClient(
                new DelegateAuthenticationProvider(
                    async (requestMessage) =>
                    {
                         string accessToken = System.Security.Claims.ClaimsPrincipal.Current.FindFirst("access_token").Value;

                        // Append the access token to the request.
                        requestMessage.Headers.Authorization = new AuthenticationHeaderValue("bearer", accessToken);

                        // Get event times in the current time zone.
                        requestMessage.Headers.Add("Prefer", "outlook.timezone=\"" + TimeZoneInfo.Local.Id + "\"");

                        // This header has been added to identify our sample in the Microsoft Graph service. If extracting this code for your project please remove.
                        requestMessage.Headers.Add("SampleID", "aspnet-snippets-sample");
                    }));
            return graphClient;
        }

    }

Answer 1

您需要请求范围offline_access。请求后，/token端点将同时返回access_token和refresh_token。当令牌过期时，您可以再次调用/token端点，以请求一组新的访问和刷新令牌。

您可能会发现这篇文章有所帮助：Microsoft v2 Endpoint Primer。特别是关于refresh tokens的部分。

ASP.NET Web窗体访问令牌中的Microsoft Graph过期-如何在Web窗体应用程序而不是MVC中刷新令牌

1 个答案: