Azure Active Directory WebApi - 服务器到服务器

2 回答

• 1

  我相信您的问题最终在于如何设置AuthorizationHeader以及您的ServerWebApi如何响应请求 .

  看看this blog . 我相信这是您正在寻找的解决方案 .

  回复于 2024-05-05T08:58:19+08:00
• 0

  我也面临类似的问题并等待解决方案 . 但是作为一种解决方法，我创建如下 . 我相信这可能不是一个合适的解决方案 . 更好的答案建议肯定会对我们有所帮助 .

  步骤1：在WebApiConfig.cs中向Register方法添加以下行

  config.MessageHandlers.Add(new AzureADAuthorizationHandler
  {
      Audience = ConfigurationManager.AppSettings["Audience"],
      SymmetricKey = ConfigurationManager.AppSettings["ClientSecretKey"]
  });
  

  第2步： ( Note below implementation is Work In Progress as mentioned in the comments)

  using System;
  using System.IdentityModel.Tokens;
  using System.Net;
  using System.Net.Http;
  using System.Security.Claims;
  using System.Threading;
  using System.Threading.Tasks;
  using System.Web.Http.Controllers;
  
  namespace MyDevWebApiService.Common
  {
      public class AzureADAuthorizationHandler : DelegatingHandler //: AuthorizeAttribute
      {
           //public override void OnAuthorization(HttpActionContext actionContext)
          protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage httpRequestObject, CancellationToken cancellationToken)
          {
              HttpResponseMessage httpResponseMessage = null;
  
              try
              {
                  var RequuestObj = System.Web.HttpContext.Current.Request;
                  var AuthHeader = RequuestObj.Headers["Authorization"];
  
                  if (AuthHeader == null)
                  {
                      httpResponseMessage = httpRequestObject.CreateErrorResponse(HttpStatusCode.BadRequest, "No authorization header present in the request");
                  }
                  else
                  {
                      string encodedTokenString = AuthHeader.StartsWith("Bearer ") ? AuthHeader.Substring(7) : AuthHeader;
                      //Validate date the token - Work in Progress. Should be able to handle Bearer and Basic headers.
                      //Extract the Azure Ad info (tenant, client id and client security key etc) and use ADAL to authenticate with Azure AD.
                      SetCurrentPrincipal(encodedTokenString);
                  }
              }            
              catch (Exception ex)
              {
                  httpResponseMessage = httpRequestObject.CreateErrorResponse(HttpStatusCode.BadRequest, ex + "Invalid header, header token extration failed");
              }
  
              return httpResponseMessage != null ? Task.FromResult(httpResponseMessage) : base.SendAsync(httpRequestObject, cancellationToken);
          }
  
          public void SetCurrentPrincipal(string encodedTokenString)
          {
              try
              {
                  ClaimsIdentity ClaimsIdentityObject = new ClaimsIdentity();
  
                  JwtSecurityToken JwtSecurityTokenObject = new System.IdentityModel.Tokens.JwtSecurityToken(encodedTokenString);
  
                  foreach (Claim ClaimObj in JwtSecurityTokenObject.Claims)
                  {
                      ClaimsIdentityObject.AddClaim(ClaimObj);
                  }
  
                  Thread.CurrentPrincipal = new ClaimsPrincipal(ClaimsIdentityObject);
              }
              catch (Exception ex)
              {
                  throw ex;
              }
          }
      }
  }
  

  ================================================== ================================================= Note: 被动联邦：

  当我们在VS2013和.NET4.5.1中创建MVC项目时，它将在项目中创建持久性本地数据库并存储所有身份验证详细信息 .

  调整此被动联合以进行活动联合，尤其是持久性存储角度，这并不合适 .

  下面的类将自动生成 .

  • Models.TenantDbContext

  • Models.IssuingAuthorityKey

  • Models.Tenant

  • Utils.DatabaseIssuerNameRegistry

  • IdentityConfig

  • 附加行 - > IdentityConfig.ConfigureIdentity（）;在Global.asax.cs中Application_Start（）

  • 配置文件条目 .

  回复于 2024-05-05T08:58:19+08:00