ASP.NET Core 2.0 Web API Azure Ad v2 令牌授权不起作用

Question

我正在尝试使用ASP.NETCore 2.0创建一个Web API服务器，它使用azure ad v2endpoint令牌授权。我也有一个Angular 2应用程序，在那里会发生office365登录。我从那里获得令牌，然后向Web API服务器中的授权操作发送一个简单的请求。然而，我的令牌没有通过授权检查，我得到了401未授权响应。提供的描述是：

承载错误=“invalid_token”，error_description=“未找到签名密钥”

我解码了令牌，解码器也抛出了无效的签名错误。以下是我用于配置和令牌授权的代码的重要部分：

网络 API 服务器：

appsettings.json

{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "ClientId": "my-registered-app-client-id",
  },
  "Logging": {
    "IncludeScopes": false,
    "Debug": {
      "LogLevel": {
        "Default": "Warning"
      }
    },
    "Console": {
      "LogLevel": {
        "Default": "Warning"
      }
    }
  }
}

AzureAdAuthenticationBuilderExtensions.cs

public static class AzureAdServiceCollectionExtensions
{
    public static AuthenticationBuilder AddAzureAdBearer(this AuthenticationBuilder builder)
        => builder.AddAzureAdBearer(_ => { });

    public static AuthenticationBuilder AddAzureAdBearer(this AuthenticationBuilder builder, Action<AzureAdOptions> configureOptions)
    {
        builder.Services.Configure(configureOptions);
        builder.Services.AddSingleton<IConfigureOptions<JwtBearerOptions>, ConfigureAzureOptions>();
        builder.AddJwtBearer();
        return builder;
    }

    private class ConfigureAzureOptions: IConfigureNamedOptions<JwtBearerOptions>
    {
        private readonly AzureAdOptions _azureOptions;

        public ConfigureAzureOptions(IOptions<AzureAdOptions> azureOptions)
        {
            _azureOptions = azureOptions.Value;
        }

        public void Configure(string name, JwtBearerOptions options)
        {
            options.Audience = _azureOptions.ClientId;
            options.Authority = $"{_azureOptions.Instance}common/v2.0";

            options.TokenValidationParameters = new TokenValidationParameters
            {
                ValidateIssuer = false,
            };
        }

        public void Configure(JwtBearerOptions options)
        {
            Configure(Options.DefaultName, options);
        }
    }
}

启动.cs

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    // This method gets called by the runtime. Use this method to add services to the container.
    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(sharedOptions =>
        {
            sharedOptions.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddAzureAdBearer(options => Configuration.Bind("AzureAd", options));

        services.AddMvc();
        services.AddCors(options =>
        {
            options.AddPolicy("AllowAllOrigins",
             builder =>
             {
                 builder.AllowAnyMethod().AllowAnyHeader().AllowAnyOrigin();
             });
        });
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
    {
        loggerFactory.AddConsole(Configuration.GetSection("Logging"));
        loggerFactory.AddDebug();

        if (env.IsDevelopment())
        {
            app.UseDeveloperExceptionPage();
        }

        app.UseCors("AllowAllOrigins");

        app.UseAuthentication();
        app.UseMvc();
    }
}

下面是我在Angular2应用程序中用于认证的代码：

import { Injectable } from '@angular/core';
import { Headers } from '@angular/http';
import * as hello from 'hellojs/dist/hello.all.js';

import * as MicrosoftGraph from "@microsoft/microsoft-graph-types";
import * as MicrosoftGraphClient from "@microsoft/microsoft-graph-client";
import { Configs } from "../../../shared/configs"

@Injectable()
export class HttpService {
  url = `https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=${Configs.appId}&response_type=code&redirect_uri=http%3A%2F%2Flocalhost%2Fmyapp%2F&response_mode=query&scope=openid%20offline_access%20https%3A%2F%2Fgraph.microsoft.com%2Fmail.read&state=12345`;

  getAccessToken() {
    const msft = hello('msft').getAuthResponse();
    const accessToken = msft.access_token;
    return accessToken;
  }


  getClient(): MicrosoftGraphClient.Client
  {
    var client = MicrosoftGraphClient.Client.init({
      authProvider: (done) => {
          done(null, this.getAccessToken()); //first parameter takes an error if you can't get an access token
      },
      defaultVersion: 'v2.0'
    });
    return client;
  }
}

当从endpoint返回令牌时，我向Web API服务器上的有效endpoint发送请求。

重要提示：我在Web API和Angular应用程序中都使用相同的AppId，因为AzureAdv2.0endpoint需要它。

我的观点是，我认为我正在按书做所有事情，但显然缺少一些东西。如果有人能告诉我我在配置中做错了什么，我将不胜感激！

解码令牌的aud属性为:

https://graph.microsoft.com

Answer 1

在评论中进行了不那么短的讨论后，问题得到了解决。

讨论要点：

< li >访问令牌包含值为< code > https://Graph . Microsoft . com 的< code>aud声明，这意味着该令牌是针对Microsoft Graph API的，而不是他们的API < li >需要在https://apps.dev.microsoft.com/,注册Web API，之后应用程序需要使用< code>scope请求访问令牌，类似于:< code > API://25f 66106-ed D6-4724-ae6f-3a 204 CFD 9 f 63/access _ as _ user

因此，请确保aud声明包含API的客户端ID或应用ID URI。这意味着它适用于您的API。

令牌还需要包含必要的范围。

从 AAD 请求访问令牌时，请确保指定正确的范围。

此外，如果您使用v1endpoint，请确保使用ADAL，而不是MSAL。在v1中，您还必须使用< code>resource而不是scope，它必须有一个设置为API的客户端ID或应用ID URI的值。