Azure AD ASP. Net Core 2.1的带有无效受众错误的未经授权响应

Question

我使用ASP开发了UI和Web API。具有Azure AD身份验证的net Core 2.1。两者都已在Azure应用程序注册中注册。我正在UI中使用以下代码。但我遇到了一个未经授权的错误。

string AZURE_AD_INSTANE = "https://login.microsoftonline.com/";
string TENANT_ID = "<tenant GUID>";
string CLIENT_ID = "<Client GUID ofWeb API>";
string SECRET = "<Secret created for Web API under Certificates & secrets>";
string RESOURCE = "https://MyOrg.onmicrosoft.com/TestWebAPI"; //Application ID URI set in Expose an API
ClientCredential ClientCredential = new ClientCredential(CLIENT_ID, SECRET);
string authority = String.Format("{0}{1}", AZURE_AD_INSTANE, TENANT_ID);


AuthenticationContext authContext = new AuthenticationContext(authority);
string accessToken = authContext.AcquireTokenAsync(RESOURCE, ClientCredential).Result.AccessToken;

HttpClient client = new HttpClient();
client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, "https://localhost:44326/api/values/Get");
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
HttpResponseMessage response = client.SendAsync(request).GetAwaiter().GetResult();

string status = response.StatusCode.ToString();

开始p.cs

public void ConfigureServices(IServiceCollection services)
{
      services.AddAuthentication(AzureADDefaults.BearerAuthenticationScheme)
                .AddAzureADBearer(options => Configuration.Bind("AzureAd", options)); 
       services.AddMvc().SetCompatibilityVersion(CompatibilityVersion.Version_2_1);
}

我正在获取访问令牌。当我在jwt登记时。io，上面写着“签名已验证”。但API调用会给出未经授权的响应状态代码。当我检查响应头时，它的信息是“{承载错误=“无效的\u令牌”，错误描述=“受众无效”}”

如何解决此问题？

Answer 1

确保https://MyOrg.onmicrosoft.com/TestWebAPI在您的WebAPI中注册为有效访问群体：

.AddJwtBearer(options =>
{
    options.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
    {
        ValidateIssuer = true,
        ValidAudiences = new List<string> 
        {
            "https://MyOrg.onmicrosoft.com/TestWebAPI",
            "..."
        }
    }
};