Question

对于此post，我一直遵循此example，并按建议对门户和代码进行了补充：

门户：Web API-公开API-添加“ offline_access”范围（也尝试使用“ demo.offline_access”格式）； Web App添加了“ offline_access”权限

代码：已对Start_Auth.cs，Global.cs和两个Web.config文件添加了offline_access。

我根据documentation通过以下方式提出accessToken和refreshToken的请求：

var ClientID = "XXXX";
            var BaseURL = "https://XXX.b2clogin.com/XXX.onmicrosoft.com/oauth2/v2.0/token?p=B2C_1_signinsignoutpolicy";
            var ClientSecret = "XXX";
            string redirectUri = "https://XXX.azurewebsites.net/api/GetAccessToken";
            var content = new StringContent(
              "&grant_type=authorization_code"+
              "&client_id="+ClientID+
              "&scope=" + "https://XXX.onmicrosoft.com/api/demo.read https://XXX.onmicrosoft.com/api/demo.write https://XXX.onmicrosoft.com/api/offline_access" +
              "&code="+authCode+
              "&redirect_uri=" + redirectUri+
              "&client_secret=" + ClientSecret,
              Encoding.UTF8,
              "application/x-www-form-urlencoded");

            var response = await httpClient.PostAsync(BaseURL, content);
            var output = await response.Content.ReadAsStringAsync();

输出返回access_token但没有刷新令牌。查看access_token的声明时，范围（scp）正确显示offline_access demo.read demo.write

我缺少什么以获得刷新令牌？

[编辑} 这是邮递员的结果：收到访问令牌的JWT： WebApp API权限： WebAPI-公开API：

代码更改： WebApp和WebAPI Web.config范围：

<add key="api:ReadScope" value="demo.read" />
<add key="api:WriteScope" value="demo.write" />
<add key="api:OfflineScope" value="offline_access" />

TaskWebApp Globals.cs范围添加：

// API Scopes
    public static string ApiIdentifier = ConfigurationManager.AppSettings["api:ApiIdentifier"];
    public static string ReadTasksScope = ApiIdentifier + ConfigurationManager.AppSettings["api:ReadScope"];
    public static string WriteTasksScope = ApiIdentifier + ConfigurationManager.AppSettings["api:WriteScope"];
    public static string OfflineTasksScope = ApiIdentifier + ConfigurationManager.AppSettings["api:OfflineScope"];
    public static string[] Scopes = new string[] { ReadTasksScope, WriteTasksScope, OfflineTasksScope };

在ConfigureAuth上添加TaskWebApp Startup.Auth.cs范围：

// Specify the scope by appending all of the scopes requested into one string (separated by a blank space)
                Scope = $"openid profile offline_access {Globals.ReadTasksScope} {Globals.WriteTasksScope} {Globals.OfflineTasksScope}"

感谢您的帮助

Answer 1

https://XXX.onmicrosoft.com/api/offline_access是您在网络api应用中自定义的权限。不是为了获取刷新令牌。

您只需要在此处使用offline_access。

"&scope=" + "https://XXX.onmicrosoft.com/api/demo.read https://XXX.onmicrosoft.com/api/demo.write offline_access"

Azure WebApp-WebAPI->授予类型authorization_code不返回RefreshToken

1 个答案: