gpt4 book ai didi

c# - Azure AD B2C - 角色管理

转载 作者:可可西里 更新时间:2023-11-01 03:09:30 25 4
gpt4 key购买 nike

我有一个与 Azure AD B2C 连接的 Asp.NET MVC 应用程序。

在管理员设置中,我创建了一个管理员组:

enter image description here

在我的代码中我想使用 [Authorize(Roles = "Administrator")]

使用常规 Azure Active Directory 可以轻松添加(只需 3 行代码)。但对于 Azure AD B2C,我在网上找不到任何有效的教程或示例。也许你可以告诉我需要修改什么。

这是我的Startup.Auth.cs的ConfigureAuth方法

public void ConfigureAuth(IAppBuilder app)
{
app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

app.UseCookieAuthentication(new CookieAuthenticationOptions());

app.UseOpenIdConnectAuthentication(
new OpenIdConnectAuthenticationOptions
{
// Generate the metadata address using the tenant and policy information
MetadataAddress = String.Format(AadInstance, Tenant, DefaultPolicy),

// These are standard OpenID Connect parameters, with values pulled from web.config
ClientId = ClientId,
RedirectUri = RedirectUri,
PostLogoutRedirectUri = RedirectUri,

// Specify the callbacks for each type of notifications
Notifications = new OpenIdConnectAuthenticationNotifications
{
RedirectToIdentityProvider = OnRedirectToIdentityProvider,
AuthorizationCodeReceived = OnAuthorizationCodeReceived,
AuthenticationFailed = OnAuthenticationFailed,
},

// Specify the claims to validate
TokenValidationParameters = new TokenValidationParameters
{
NameClaimType = "name"
},

// Specify the scope by appending all of the scopes requested into one string (separated by a blank space)
Scope = $"openid profile offline_access {ReadTasksScope} {WriteTasksScope}"
}
);
}

最佳答案

Azure AD B2C 尚未在发送到应用程序的 token 中包含组声明,因此您无法遵循使用 Azure AD 概述的相同方法(该方法确实在发送到应用程序的 token 中包含组声明) token )。

您可以通过在 Azure AD B2C 反馈论坛中投票来支持此功能:Get user membership groups in the claims with Azure AD B2C

话虽这么说,您可以在此应用程序中执行一些额外的工作,让它手动检索组声明的这些声明并将它们注入(inject) token

首先,注册一个单独的应用程序,该应用程序将调用 Microsoft Graph 来检索组声明

  1. 转到https://apps.dev.microsoft.com
  2. 创建一个具有应用程序权限的应用:Directory.Read.All
  3. 点击生成新密码添加应用程序密码
  4. 添加平台并选择 Web 并为其提供任何重定向 URI(例如 https://yourtenant.onmicrosoft.com/groups)
  5. 导航至以下网址同意此申请:https://login.microsoftonline.com/YOUR_TENANT.onmicrosoft.com/adminconsent?client_id=YOUR_CLIENT_ID&state=12345&redirect_uri=YOUR_REDIRECT_URI

然后,您需要在 OnAuthorizationCodeReceived 处理程序内添加以下代码right after redeeming the code :

var authority = $"https://login.microsoftonline.com/{Tenant}";
var graphCca = new ConfidentialClientApplication(GraphClientId, authority, GraphRedirectUri, new ClientCredential(GraphClientSecret), userTokenCache, null);
string[] scopes = new string[] { "https://graph.microsoft.com/.default" };

try
{
AuthenticationResult authenticationResult = await graphCca.AcquireTokenForClientAsync(scopes);
string token = authenticationResult.AccessToken;

using (var client = new HttpClient())
{
string requestUrl = $"https://graph.microsoft.com/v1.0/users/{signedInUserID}/memberOf?$select=displayName";

HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, requestUrl);
request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);

HttpResponseMessage response = await client.SendAsync(request);
var responseString = await response.Content.ReadAsStringAsync();

var json = JObject.Parse(responseString);

foreach (var group in json["value"])
notification.AuthenticationTicket.Identity.AddClaim(new System.Security.Claims.Claim(System.Security.Claims.ClaimTypes.Role, group["displayName"].ToString(), System.Security.Claims.ClaimValueTypes.String, "Graph"));

//TODO: Handle paging.
// https://developer.microsoft.com/en-us/graph/docs/concepts/paging
// If the user is a member of more than 100 groups,
// you'll need to retrieve the next page of results.
}
} catch (Exception ex)
{
//TODO: Handle
throw;
}

关于c# - Azure AD B2C - 角色管理,我们在Stack Overflow上找到一个类似的问题: https://stackoverflow.com/questions/45885795/

25 4 0
Copyright 2021 - 2024 cfsdn All Rights Reserved 蜀ICP备2022000587号
广告合作:1813099741@qq.com 6ren.com