守护程序应用程序和作用域 [英] Daemon Apps and Scopes

问题描述

因此，我正在尝试查看是否可以支持C#守护程序应用程序可以访问受MSAL.NET和OAuth2范围保护的自定义Web API的方案.到目前为止，我看不到这样做的方法.

So, I am trying to do see if I can support a scenario where a C# daemon app can access a custom Web API protected with MSAL.NET and OAuth2 scopes. As of now, I see no way of doing this.

库和工具集的版本为:

.NET Core 2.2Microsoft.Identity.Client 4.1.0

.NET Core 2.2 Microsoft.Identity.Client 4.1.0

客户是

var app = ConfidentialClientApplicationBuilder.Create("<app_id_of_my_web_api>")
                .WithClientSecret("<client_secret>")
                .WithAuthority("https://login.microsoftonline.com/<tenant_id_that_hosts_the_web_api>")
                .Build();

然后获取令牌

await app.AcquireTokenForClient(new string[] { "api://<app_id_of_the_web_api>/.default" });

这时，我确实获得了令牌，我将其称为使用MSAL和具有上述App ID的Azure App保护的自定义Web API端点.这不起作用，因为我在端点上具有基于策略的授权，希望在Azure AD应用程序中定义特定的自定义范围.

At this point, I do get the token back with which I call my custom Web API end point protected using MSAL and an Azure App with the above mentioned App ID. This doesn't work since I have a policy based authorization on the end point, expecting a specific custom scope defined in the Azure AD app.

问题是，如何配置客户端和Azure AD，以便获得作为Web API声明传递的特定范围?

The question is, how do I configure the client and Azure AD so I will get the specific scopes passed in as claims for the Web API?

推荐答案

您需要注册两个应用程序，一个用于守护程序(客户端应用程序)，一个用于Web api(后端应用程序).

You need to register two applications, one for daemon app(client app), one for web api(backend app).

点击网络api应用->公开API.

Click the web api app->Expose an API.

单击守护程序app-> API权限->添加权限->我的API->选择Web api应用程序->选择权限.

Click the daemon app->API permissions->Add a permission->My APIs->choose web api app->select the permissions.

然后是客户

var app = ConfidentialClientApplicationBuilder.Create("<client app id>")
                .WithClientSecret("<client app client_secret>")
                .WithAuthority("https://login.microsoftonline.com/<tenant_id>")
                .Build();

范围:

await app.AcquireTokenForClient(new string[] { "api://<app_id_of_the_web_api>/read" });

请参阅此样本.您可以将Web API视为Microsoft Graph API.

Refer to this sample. You can think of your web api as Microsoft Graph API.

这篇关于守护程序应用程序和作用域的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！