您无权查看此目录或页面。使用Azure AD验证API时发生错误

Question

当我们尝试使用部署到azure的API之一时，我们收到以下错误：

“您无权查看此目录或页面。”

在完成了许多教程之后，我们已经在Azure中设置并注册了API应用。然后在此启用AD身份验证，尽管我们传入的是：

生成的访问令牌，但看起来我们缺少权限或作用域，这使邮递员无法访问API。

https://login.microsoftonline.com/ {tenantId} /oauth2/v2.0/token

我们注意到访问令牌没有任何范围，角色和权限。但是，即使在清单中添加新作用域，也无法确定必须在何处添加。查看诊断日志，将“最可能的原因”指定为：

“通过身份验证的用户无权访问处理请求所需的资源。”

正在生成访问令牌：

{
   "aud": "https://xxxxxxxxxxxxxxxxxxxx.azurewebsites.net",
   "iss": "https://sts.windows.net/xxxxxxxxxxxxxxxxxxxxxx/",
   "iat": 1234343434,
   "nbf": 1234343434,
   "exp": 1234343434,
   "aio": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx=",
   "appid": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
   "appidacr": "1",
   "idp": "https://sts.windows.net/xxxxxxxxxxxxxxxxxxxxxxxx/",
   "oid": "xxxxxxxxxxxxxxxxxxxxxxxxxxx",
   "sub": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
   "tid": "xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx",
   "uti": "xxxxxxxxxxxxxxxxxxxxxx",
   "ver": "1.0"
 }

邮递员生成的用于获取上方令牌的代码：

var client = new RestClient("https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token");
var request = new RestRequest(Method.GET);
request.AddHeader("cache-control", "no-cache");
request.AddHeader("Connection", "keep-alive");
request.AddHeader("content-length", "195");
request.AddHeader("accept-encoding", "gzip, deflate");
request.AddHeader("cookie", "fpc=AvF4ZvXAqUBPt5LOy7AEkVQIjAwtAQAAANhCb9QOAAAA; x-ms-gateway-slice=prod; stsservicecookie=ests");
request.AddHeader("Host", "login.microsoftonline.com");
request.AddHeader("Postman-Token", "b38e8e03-97f6-4d52-82fd-d9bec59de767,c13da490-096c-4847-8122-39d028d9625e");
request.AddHeader("Cache-Control", "no-cache");
request.AddHeader("Accept", "*/*");
request.AddHeader("User-Agent", "PostmanRuntime/7.11.0");
request.AddHeader("Content-Type", "application/x-www-form-urlencoded");
request.AddParameter("undefined", "grant_type=client_credentials&client_id={clientId}&scope=https%3A%2F%2Fxxxxxxxx.azurewebsites.net%2F.default&client_secret={clientSecret}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);

尝试使用访问令牌并收到错误消息时生成的代码：

var client = new RestClient("https://xxxxxxxxxxxxxxxxxx.azurewebsites.net/api/Status/xxxxxxx");
var request = new RestRequest(Method.GET);
request.AddHeader("cache-control", "no-cache");
request.AddHeader("Connection", "keep-alive");
request.AddHeader("accept-encoding", "gzip, deflate");
request.AddHeader("cookie", "ARRAffinity=249d53bdc28cc342edb4965228850aa72a8304630357254128300b6abf863e83");
request.AddHeader("Host", "xxxxxxxxxxxxxxxxxxx.azurewebsites.net");
request.AddHeader("Postman-Token", "7a9e0638-90cf-41c6-b6bf-0eea11aca929,95980a03-ef39-4c1e-af35-65bec0aaa903");
request.AddHeader("Cache-Control", "no-cache");
request.AddHeader("Accept", "*/*");
request.AddHeader("User-Agent", "PostmanRuntime/7.11.0");
request.AddHeader("Authorization", "Bearer {bearerToken}");
request.AddHeader("Content-Type", "application/x-www-form-urlencoded");
IRestResponse response = client.Execute(request);

Answer 1

要获取令牌，您需要对 management.azure.com

进行 POST 呼叫

前一段时间，我在下面的链接中汇总了信息，以帮助阐明使用RestApi（在这种情况下为Postman）管理Azure的步骤。

https://github.com/hhazeley/Azure-Postman