如何在 .Core 应用程序中使用授权验证 Azure B2C 访问令牌

Posted 2023-03-10

【中文标题】如何在 .Core 应用程序中使用授权验证 Azure B2C 访问令牌

【英文标题】：How to validate Azure B2C access token using Authorization in .Core application

【发布时间】：2021-09-12 13:49:12

【问题描述】：

我能够使用以下代码成功验证控制器内部 Azure AD B2C 颁发的访问令牌：

string discoveryEndpoint = "https://<tenant>.b2clogin.com/<tenant>.onmicrosoft.com/<policyId>/v2.0/.well-known/openid-configuration";
ConfigurationManager<OpenIdConnectConfiguration> configManager = new(discoveryEndpoint, new OpenIdConnectConfigurationRetriever());
OpenIdConnectConfiguration openIdconfig = configManager.GetConfigurationAsync().Result;
TokenValidationParameters validationParameters = new()

    ValidateAudience = true,
    ValidAudience = <ClientId>,
    ValidateIssuer = true,
    ValidIssuer = openIdconfig.Issuer,
    IssuerSigningKeys = openIdconfig.SigningKeys,
    ValidateLifetime = true
;
JwtSecurityTokenHandler tokenHandler = new();
tokenHandler.ValidateToken(accessToken, validationParameters, out SecurityToken validatedToken);

但不能像这样在 Startup.cs 中设置授权

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
   .AddJwtBearer(cfg =>
   
       <...the same code as above to get issuer and signing keys...>
       cfg.TokenValidationParameters = new()
       
          ValidateAudience = true,
          ValidAudience = <ClientId>,
          ValidateIssuer = true,
          ValidIssuer = openIdconfig.Issuer,
          IssuerSigningKeys = openIdconfig.SigningKeys,
          ValidateLifetime = true
       ;
   );
<...>
public void Configure(IApplicationBuilder appBuilder)

   <...>
   appBuilder.UseRouting();
   appBuilder.UseAuthorization();
   <...>

并在我的控制器方法中使用 [Authorize] 属性。在这种情况下，我得到 401 响应。我在这里做错了什么？

【参考方案1】：

我会给你一个小费。 在 AddJwtBearer 选项中注册事件

           .AddJwtBearer("JwtBearer", opts =>
           
               opts.Authority = GetAuthority(configuration);
               opts.Audience = configuration["Authentication:AzureAdB2C:ClientId"];
               opts.TokenValidationParameters = new TokenValidationParameters()
               
                   ValidateIssuer = true,
                   ValidIssuer = configuration["Authentication:AzureAdB2C:Issuer"],
                   ValidAudiences = new string[]  opts.Audience ,
                   ValidateLifetime = true,
                   NameClaimType = "name",
               ;

               opts.Events = new JwtBearerEvents();

               opts.Events.OnAuthenticationFailed = authFailedContext =>
               
                   return Task.CompletedTask;
               ;
               opts.Events.OnMessageReceived = messageContext =>
               
                   return Task.CompletedTask;
               ;
               opts.Events.OnTokenValidated = tokenValidatedContext =>
               
                   return Task.CompletedTask;
               ;
               opts.Events.OnForbidden = forbiddenContext =>
               
                   return Task.CompletedTask;
               ;
           );

并检查/记录天蓝色验证上下文。