在 AAD 保护的 Azure Web 应用程序中检索访问令牌 [英] Retrieve Access Token within a AAD secured Azure Web App

问题描述

我有一个托管在 Azure Web 应用程序中的 Angular4 应用程序和一个托管在 Azure API 应用程序中的 .NET 核心 Web API.

API 受 Azure Active Directory 保护.目前我使用 ng2-adal 来获取一个访问令牌，我将其注入到标头中以执行我的 API 调用.

现在我尝试删除 ng2-adal 模块，并使用 相同 ClientId(如 API)通过身份验证/授权功能保护我的 Web 应用程序.当我浏览到我的网站时，我被重定向到 AAD 登录名，在我成功登录后，我被重定向到我的网站.现在我不想在我的 Web 应用程序中调用 API(使用相同的 ClientId 进行保护)，但找不到检索令牌的方法.

在这种情况下，有没有办法在我的 Angular 应用程序中检索访问令牌?看起来令牌以加密方式存储在 AppServiceAuthSession Cookie 中:

解决方案

AppServiceAuthSession 是 cookie，它不同于 令牌.在这种情况下，您需要修改 Azure 应用的配置，使其获取 Web API 的 access_token.

我们可以使用

然后我们需要使用Advanced Azure Active Settings来保护web API，如下图所示，使access_token可以调用web API:

I have an Angular4 Application hosted in an Azure Web App and a .NET core Web API hosted in an Azure API App.

The API is secured with Azure Active Directory. Currently I use ng2-adal to aquire an access token which I inject to the headers to perform my API calls.

Now I try to remove the ng2-adal module and secure my Web App with the Authentication / Authorization feature using the same ClientId (like the API). When I browse to my website I get redirected to the AAD login and after I successfully login, I get redirected to my site. Now I wan't to call the API (that is secured with the same ClientId) within my Web App but can't find a way to retrieve the token.

Is there a way to retrieve the access token within my Angular App in this scenario? It looks like the token is stored encrypted within the AppServiceAuthSession Cookie:

解决方案

The AppServiceAuthSession is cookie which is different than a token. In this scenario, you need to modify the config of Azure app to make it acquire the access_token for the web API.

We can use the Resource Explore to modify the settings like below:

1 . locate the angular web app

2 . locate the config->authsettings(resource is the clientId of Azure app which used to protect your apps)

"additionalLoginParams": [
  "response_type=code id_token",
  "resource=3fa9607b-63cc-4050-82b7-91e44ff1df38"
],

3. config the redirect_uri for Azure app like below: https://appfei.azurewebsites.net/.auth/login/aad/callback

Then after you login in the angular app, you can get the access_token via the endpoint: https://appfei.azurewebsites.net/.auth/me

Then we need to protect the web API using the Advanced Azure Active Settings like figure below to enable the access_token could call the web API:

这篇关于在 AAD 保护的 Azure Web 应用程序中检索访问令牌的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！