同意提示并不要求移动到V2.0权限后在AD App中设置的所有权限

Question

.AddOpenIdConnect(OpenIdConnectDefaults.AuthenticationScheme, options =>
            {
                options.CallbackPath = new PathString("/callback/");
                options.SignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
                options.SaveTokens = true;
                options.ClientId = <clientId>;
                options.Authority = "https://login.microsoftonline.com/common/v2.0/";
                options.ResponseType = OpenIdConnectResponseType.CodeIdToken;
                options.TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = true,
                    ValidIssuer = <valid-issuer>,
                    IssuerValidator = MultiTenantIssuerValidator.Validate,
                    ValidateAudience = true,
                    ValidateLifetime = true,
                    ValidateIssuerSigningKey = true,
                    ValidAudience = <client-id>,
                    NameClaimType = "preferred_username"
                };

使用v2.0endpoint重定向Uri-https://login.microsoftonline.com/common/oauth2/v2.0/authorize？client_id=&redirect_uri=&response_type=code id_token&scope=openid profile&response_mode=form_post

使用v1.0endpoint重定向Uri-https://login.microsoftonline.com/common/oauth2/authorize?client_id=&redirect_uri=&response_type=code id_token&scope=openid profile&response_mode=form_post

我试图浏览v2endpoint的文档，但没有找到任何解释这种行为变化的章节。

Answer 1

是的。V1.0和V2.0之间的行为是不同的。

对于V2.0endpoint，您应该将资源包含在作用域中。

例如，如果您的权限是Microsoft Graph，则应该如下所示生成请求uri：

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=&redirect_uri=&response_type=code id_token&scope=openid profile https//graph.microsoft.com/.default&response_mode=form_post