c# - 使用 Azure B2C 进行 .NET 核心 JWT 验证

Question

我在针对 Azure B2C 进行 token 验证时遇到问题。错误是:

AuthenticationFailed: IDX10205: Issuer validation failed. Issuer: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'. Did not match: validationParameters.ValidIssuer: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]' or validationParameters.ValidIssuers: '[PII is hidden by default. Set the 'ShowPII' flag in IdentityModelEventSource.cs to true to reveal it.]'.

在我的 .net core webapi 项目中，我添加了来自 Nuget 的 System.IdentityModel.Tokens.Jwt。然后在 ConfigureServices 下的 Startup.cs 中添加:

  services.AddAuthentication(options =>
  { 
    options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme; 
  })
  .AddJwtBearer(jwtOptions =>
  {
    jwtOptions.Authority = 
         $"https://login.microsoftonline.com/tfp/{Configuration["B2CTenantId"]}/" + 
         "{Configuration["B2CPolicy"]}/v2.0/";
    jwtOptions.Audience = Configuration["B2CClientId"];
    jwtOptions.Events = new JwtBearerEvents
    {
      OnAuthenticationFailed = AuthenticationFailed
    };
  });

  private Task AuthenticationFailed(AuthenticationFailedContext arg)
  {
        // For debugging purposes only!
        var s = $"AuthenticationFailed: {arg.Exception.Message}";
        arg.Response.ContentLength = s.Length;
        arg.Response.Body.Write(Encoding.UTF8.GetBytes(s), 0, s.Length);

        return Task.FromResult(0);
  }

其中 B2CTenandId 类似于 mytenant.onmicrosoft.com，B2CClientId 是来自 Azure 门户的 if 和 B2CPolicy > 是 b2c_1_susi (为登录创建)。

Answer 1

正确的配置是

var cnn = $"https://login.microsoftonline.com/tfp/{Configuration["B2CTenantId"]}/" +
          $"{Configuration["B2CPolicy"]}/v2.0/";

B2CTenant 是您的域，例如 mydomain.onmicrosoft.com。B2CPolicy 是您在 Azure Portal 中创建的策略(请参阅问题中我的图片)。