Question

StackOverflow中发布的问题如下

我们有一个多租户Web应用程序（ASP.NET MVC 5.2.2），受Azure AD保护，用于用户身份验证，Web应用程序调用Backend Rest API（ASP.NET Web API 5.2.3），它也是受保护的威盛OAuth 2.0持票人令牌。我们使用Open-ID Connect OWIN模块在Web应用程序中使用Open-ID Connect协议。

我们需要使用Graph API 1.5版将租户的Azure AD目录用户和组放入应用程序商店。我们使用Microsoft ADAL 2.0获取访问令牌并刷新令牌并将其存储在ADAL令牌缓存中扩展到Redis缓存。

设计是这样一种方式，即Web App将用户上下文传递给Web API，其中包括SignInUserId，ObjectId，TenantId和Web Api，使用此上下文和Web App标识来读取已存储在TokenCache中的Access Token（如果已过期以刷新访问令牌，并使用此令牌获取租户AD数据。

           // get a token for the Graph without triggering any user interaction (from the cache, via multi-resource refresh token, etc)
           ClientCredential clientcred = new ClientCredential(clientId, appKey);
          // initialize AuthenticationContext with the token cache of the currently signed in user, as kept in the app's EF DB
           AuthenticationContext authContext = new AuthenticationContext(string.Format("https://login.microsoftonline.com/{0}", tenantID), new CustomTokenCache(signedInUserID));
           AuthenticationResult result = await authContext.AcquireTokenSilentAsync(graphResourceID, clientcred, new UserIdentifier(userObjectID, UserIdentifierType.UniqueId));
           return result.AccessToken;

当读取令牌时，即使从缓存中立即访问令牌，也会抛出FailedToRefreshAccessToken异常。

任何帮助都将不胜感激。

自定义令牌缓存的代码

public class PerUserCache
    {
        public string userUniqueId { get; set; }
        public byte[] cacheBits { get; set; }
        public DateTime LastWrite { get; set; }

    }

    public class CustomTokenCache : TokenCache
    {

        string userID;
        PerUserCache Cache;
        ICache database = CacheFactory.GetCacheInstance();

     /// <summary>
     /// 
     /// </summary>
     /// <param name="userID"></param>
        public CustomTokenCache(string userID)
        {
            // associate the cache to the web api
            this.userID = userID;

            this.AfterAccess = AfterAccessNotification;
            this.BeforeAccess = BeforeAccessNotification;
            this.BeforeWrite = BeforeWriteNotification;

            // look up the entry in the DB

                Cache = database.Get<PerUserCache>(this.userID);

            // place the entry in memory
            this.Deserialize((Cache == null) ? null : Cache.cacheBits);
        }

        // clean up the DB
        public override void Clear()
        {
            base.Clear();
        }
    enter code here
        // Notification raised before ADAL accesses the cache.
        // This is your chance to update the in-memory copy from the DB, if the in-memory version is stale
        void BeforeAccessNotification(TokenCacheNotificationArgs args)
        {
            if (Cache == null)
            {
                // first time access
                    Cache = database.Get<PerUserCache>(userID);
            }`enter code here`
            else
            {   // retrieve last write from the DB
                var status = database.Get<PerUserCache>(userID).LastWrite;
                // if the in-memory copy is older than the persistent copy
                if (status > Cache.LastWrite)
                //// read from from storage, update in-memory copy
                {
                    Cache = database.Get<PerUserCache>(userID);
                }
            }
            this.Deserialize((Cache == null) ? null : Cache.cacheBits);
        }
        // Notification raised after ADAL accessed the cache.
        // If the HasStateChanged flag is set, ADAL changed the content of the cache
        void AfterAccessNotification(TokenCacheNotificationArgs args)
        {
            // if state changed
            if (this.HasStateChanged)
            {
                Cache = new PerUserCache
                {
                    userUniqueId = userID,
                    cacheBits = this.Serialize(),
                    LastWrite = DateTime.Now
                };
                //// update the DB and the lastwrite                
                database.Set<PerUserCache>(userID, Cache,null);
                this.HasStateChanged = false;
            }
        }
        void BeforeWriteNotification(TokenCacheNotificationArgs args)
        {
            // if you want to ensure that no concurrent write take place, use this notification to place a lock on the entry
        }
    }

}

Answer 1

似乎CustomTokenCache的代码没有问题。通常，此问题是由无法找到特定用户的缓存引起的。

您可以通过将断点设置为BeforeAccessNotification的方法来验证此问题，并确保Cache对象在反序列化时不为空。

您还可以直接根据userObjectID检查Redis中的缓存。

此外，由于您指出Web应用程序将令牌存储到上图中的缓存存储中。您是否介意在Web应用程序中共享有关如何获取令牌的代码？

无法从WebAPI读取存储在ADAL TokenCache中的图形API访问令牌

1 个答案: