我正在尝试使用ASP.NET Core 2.0创建一个Web API服务器,该服务器使用azure ad v2端点令牌授权。我还有一个Angular 2应用程序,其中发生了office365登录。我从那里获得一个令牌,然后向Web API服务器中的授权操作发送一个简单的请求。但是我的令牌没有通过授权检查,我收到401 Unauthorized响应。提供的描述是:
Bearer error =“invalid_token”,error_description =“找不到签名密钥”
我解码了令牌,解码器也抛出了无效的签名错误。以下是我用于配置和令牌授权的代码的重要部分:
Web服务器API:
appsettings.json
{
"AzureAd": {
"Instance": "https://login.microsoftonline.com/",
"ClientId": "my-registered-app-client-id",
},
"Logging": {
"IncludeScopes": false,
"Debug": {
"LogLevel": {
"Default": "Warning"
}
},
"Console": {
"LogLevel": {
"Default": "Warning"
}
}
}
}
AzureAdAuthenticationBuilderExtensions.cs
public static class AzureAdServiceCollectionExtensions
{
public static AuthenticationBuilder AddAzureAdBearer(this AuthenticationBuilder builder)
=> builder.AddAzureAdBearer(_ => { });
public static AuthenticationBuilder AddAzureAdBearer(this AuthenticationBuilder builder, Action<AzureAdOptions> configureOptions)
{
builder.Services.Configure(configureOptions);
builder.Services.AddSingleton<IConfigureOptions<JwtBearerOptions>, ConfigureAzureOptions>();
builder.AddJwtBearer();
return builder;
}
private class ConfigureAzureOptions: IConfigureNamedOptions<JwtBearerOptions>
{
private readonly AzureAdOptions _azureOptions;
public ConfigureAzureOptions(IOptions<AzureAdOptions> azureOptions)
{
_azureOptions = azureOptions.Value;
}
public void Configure(string name, JwtBearerOptions options)
{
options.Audience = _azureOptions.ClientId;
options.Authority = $"{_azureOptions.Instance}common/v2.0";
options.TokenValidationParameters = new TokenValidationParameters
{
ValidateIssuer = false,
};
}
public void Configure(JwtBearerOptions options)
{
Configure(Options.DefaultName, options);
}
}
}
Startup.cs
public class Startup
{
public Startup(IConfiguration configuration)
{
Configuration = configuration;
}
public IConfiguration Configuration { get; }
// This method gets called by the runtime. Use this method to add services to the container.
public void ConfigureServices(IServiceCollection services)
{
services.AddAuthentication(sharedOptions =>
{
sharedOptions.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddAzureAdBearer(options => Configuration.Bind("AzureAd", options));
services.AddMvc();
services.AddCors(options =>
{
options.AddPolicy("AllowAllOrigins",
builder =>
{
builder.AllowAnyMethod().AllowAnyHeader().AllowAnyOrigin();
});
});
}
// This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
{
loggerFactory.AddConsole(Configuration.GetSection("Logging"));
loggerFactory.AddDebug();
if (env.IsDevelopment())
{
app.UseDeveloperExceptionPage();
}
app.UseCors("AllowAllOrigins");
app.UseAuthentication();
app.UseMvc();
}
}
现在这里是我用于在Angular2应用程序中进行身份验证的代码:
import { Injectable } from '@angular/core';
import { Headers } from '@angular/http';
import * as hello from 'hellojs/dist/hello.all.js';
import * as MicrosoftGraph from "@microsoft/microsoft-graph-types";
import * as MicrosoftGraphClient from "@microsoft/microsoft-graph-client";
import { Configs } from "../../../shared/configs"
@Injectable()
export class HttpService {
url = `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=${Configs.appId}&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F&response_mode=query&scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2Fmail.read&state=12345`;
getAccessToken() {
const msft = hello('msft').getAuthResponse();
const accessToken = msft.access_token;
return accessToken;
}
getClient(): MicrosoftGraphClient.Client
{
var client = MicrosoftGraphClient.Client.init({
authProvider: (done) => {
done(null, this.getAccessToken()); //first parameter takes an error if you can't get an access token
},
defaultVersion: 'v2.0'
});
return client;
}
}
从端点返回令牌时,我向Web API服务器上的有效端点发送请求。
重要说明:我在Web API和Angular应用程序中使用相同的AppId,因为AzureAd v2.0端点需要它。
我的观点是,我认为我正在通过这本书做一切,但显然有些东西缺失了。如果有人能告诉我在配置中我做错了什么,我会感激不尽!
解码令牌的aud属性是:
在评论中进行了不那么短暂的讨论后,问题得到了解决。
讨论的关键点:
aud
声明,其值为https://graph.microsoft.com
,这意味着该令牌适用于Microsoft Graph API,而不是其APIscope
的api://25f66106-edd6-4724-ae6f-3a204cfd9f63/access_as_user
来请求访问令牌:aud
因此,请确保resource
声明包含API的客户端ID或应用ID URI。这意味着它适用于您的API。
令牌还需要包含必要的范围。
在从AAD请求访问令牌时,请确保指定正确的范围。
此外,如果您使用的是v1端点,请确保使用ADAL,而不是MSAL。在v1中也代替范围,您必须使用qazxswpoi,其值必须设置为API的客户端ID或应用程序ID URI。