在Azure AD中发布JWT承载授权

Question

有两个ASP.NET核心Web API使用承载令牌身份验证。这些服务还提供静态文件，这些文件用于同意API进入消费应用程序的目录。所以这两个API都在Azure AD中启用了隐式流。

API2使用jwt-barer授权从Web API控制器调用API1。API2具有访问API1的权限。

来自第三个目录的用户导航到API2服务的SPA。用户被重定向到Azure AD，登录并同意API。用户被重定向回SPA应用程序，并对API2 web API进行AJAX调用。从该控制器，对API1进行另一次调用。使用jwt-bearer授权(urn:ietf:params:oauth:grant-type:jwt-bearer)对此调用进行身份验证。

Microsoft.IdentityModel.Clients.ActiveDirectory.AdalServiceException: 
AADSTS50027: Invalid JWT token. AADSTS50027: Invalid JWT token. Token format not valid.
Trace ID: 4031717e-aa0c-4432-bbd1-b97a738d3e6f
Correlation ID: 61ae6cd6-6df6-49ee-9145-c16570c28f7b
Timestamp: 2017-02-13 22:44:01Z ---> System.Net.Http.HttpRequestException:  Response status code does not indicate success: 400 (BadRequest). ---> System.Exception: {"error":"invalid_request","error_description":"AADSTS50027: Invalid JWT token. AADSTS50027: Invalid JWT token. Token format not valid.\r\nTrace ID: 4031717e-aa0c-4432-bbd1-b97a738d3e6f\r\nCorrelation ID: 61ae6cd6-6df6-49ee-9145-c16570c28f7b\r\nTimestamp: 2017-02-13 22:44:01Z","error_codes":[50027,50027],"timestamp":"2017-02-13 22:44:01Z","trace_id":"4031717e-aa0c-4432-bbd1-b97a738d3e6f","correlation_id":"61ae6cd6-6df6-49ee-9145-c16570c28f7b"}

EYJ0EXAIOIJKV1QILCJHBGCIOIJSUZI1Niising1DCI6IL9VZ3FYR190TUXKDVNKMVQ4Y2FIEFU3Y090YYISIMTPZCI6IL9VZ3FYR190TUXKDVNKMVQ4Y2FIEFU3Y0YYJ9.EYJHDWQIOIJMOTJJNGI5MS05NTY3LTRJYJGTOTI4MC0YYMFJNDUYYMZJZTEILCJPC3MIOIJODHRWCZOVL3N0CY53AW5KB3DZLM5LDC9IYWRIODCYNC1JO DexltrlyJETOTCWZI04YMI4MZU0NTi0OTEVIIWIAWF0IJOXNDG3MDM1MDI5LCJUYMYIOJE0ODCWMZUWMJKSIMV4CCI6MTQ4NZAZODKYOSWIYW1YIJPBINB3ZCJDLCJMYW1PBHLFBMFTZSI6IM9UZSISIMDMVUX25HBWUIOIJ1C2VYIIWIAXBHZGRIJOINZMUTU3LJEXMC4XNJQILCJUYW1LIJOIDXNLCIBVBMUILCJUB25JZSi6IMRJOTYWMJKZWQ0MTI TNDFMNY1Imgrhlwyzzwm2nte1ztm1ysisim9pzci6ijuzmte1oTy0lwqwotmtngm5ns05mdkzltg0zjlinzvmyznlosisinbsyxrmijoiminn1yii6ilvjvvvvlgduw9mr25vtkdszwi1FegtaSndidu9zm1eilcji04ymi4mzu0nti0oteilcj1bmlxdwvbbmft ZSi6InVZZXIXQHPPZWTLBMH1AXNBLM9UBWLJCM9ZB2Z0LMnVBSISINVWBII6InVZZXIXQHPPZWTLBMH1AXNBLM9UBWLJCM9ZB2Z0LMnVBSISINZLCII6IJEUMCJ9.LHWEL3X3Cu66L-DT-HWMH2DRMCCX2YorGHL4X4_13_LZUUVHMR1OFLUDJ4MZRWG5DJMC8F_SYC4XDISTWFDALSi_4L6NOXNAU3KF6SU3PNQD-FOXOQPTMPPMFRDRZ7NPETSAZECD9HESWGVRZYWJRBKQQQTBGBPS7-Y9KXRO-MouhNBDJJ-GWHU_WXWDEZAOULS68SZUAONAUNELMKO1IYLC9VHP5XRVZH3ERNRSIP3XMGJNMLBF-9AFUSRJN5UAFJFPGGGJIVOAKBL6RQ-J1XNPVKZDFYVOC7RMKQS1KM-LU-EI-QCKSB3NKHTG6J_BZ5UXMJYLTJKANWBUG

Answer 1

然后，由于API1的服务主体也不是在Directory3中创建的，所以我们需要首先登录API1，以便在Directory3承租人上创建API1的服务主体。

当用户从Directory3登录SPA并向API2发送请求时，在代码中，您从Directory2获取令牌。我们应该从用户的租户(Directory3)获取令牌。

在代码中，您是使用clientId获取令牌的，在这个secnario中，我们应该使用clientcredential，如下所示：

var result = await adal.AcquireTokenAsync(resource, clientCred, userAssertion);