在Javascript中编写承载令牌

Question

我在做概念验证。我正在使用Azure Active Directory并试图在遗留项目中实现OAuth。

这个项目的一半使用Web表单，另一半直接通过JavaScript在另一个项目中调用WebAPI。

作为一个测试，我通过UseOpenIDConnectauthEntication的AuthorizationCodeReceed通知事件获得承载令牌。我使用以下代码将令牌快速写入调用WebAPI的页面：

 $.ajax({
                        url: baseVotingHeaderURL,
                        type: 'GET',
                        dataType: "json",
                        beforeSend: function(xhr){
                            xhr.setRequestHeader('Authorization', 'Bearer ' + XXXXXXXXXXXXXXXXX);
                        },
                        success: function(result) {
                            options.success(result);
                        },
                        error: function(err) {
                            options.error(err);
                        }
                    });

我可以在Fiddler中看到正在传递令牌：

下面是startup.auth.cs的代码

app.SetDefaultSignInAsAuthenticationType( CookieAuthenticationDefaults.AuthenticationType );
app.UseCookieAuthentication( new CookieAuthenticationOptions( ) );

app.UseWindowsAzureActiveDirectoryBearerAuthentication( new WindowsAzureActiveDirectoryBearerAuthenticationOptions
{
    Tenant = "XXXXXX.onmicrosoft.com",
    AuthenticationType = "OAuth2Bearer",
    TokenValidationParameters = new TokenValidationParameters( )
    {
        ValidAudience = "https://XXXX.onmicrosoft.com/XXXXX"
    }
} );

app.UseOpenIdConnectAuthentication(
        new OpenIdConnectAuthenticationOptions
        {
            ClientId = "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
            Authority = "https://login.microsoftonline.com/XXXXX.onmicrosoft.com",
            PostLogoutRedirectUri = "https://XXXXXXX/gbl/Home.aspx",
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                AuthenticationFailed = context =>
                {
                    context.HandleResponse( );
                    context.Response.Redirect( "/Error?message=" + context.Exception.Message );
                    return Task.FromResult( 0 );
                },              
                AuthorizationCodeReceived = context =>
                {
                    var client = ClientId;
                    var key = "XXXXXXXXXXXXXXXXXXX=";                               

                    var credential = new ClientCredential( client, key );
                    var authority = String.Format( CultureInfo.InvariantCulture, @"https://login.microsoftonline.com/{0}", "XXXXX.onmicrosoft.com" );
                    var authContext = new Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext( authority );

                    Uri redirectUri = new Uri( HttpContext.Current.Request.Url.GetLeftPart( UriPartial.Path ) );
                    var apiResourceId = "https://graph.windows.net";
                    AuthenticationResult result = authContext.AcquireTokenByAuthorizationCode(
                            context.Code, redirectUri, credential, apiResourceId );

                    EndpointAndTokenHelper.DecodeAndWrite( result.AccessToken );
                    System.Diagnostics.Debug.WriteLine( result.AccessToken );

                    return Task.FromResult( 0 );
                }
            }
        } );
}

Answer 1

我一字不差地照着这些例子。但是，AuthContext.AquireTokenByAuthorizationCode中的最后一个参数应该是我的WebAPI资源，而不是https://graph.windows.net。

我不知道为什么示例使用https://graph.windows.net。