c# - 应用程序不支持通过/common 或/consumers 端点错误 AD 登录

Question

我希望有人能帮我解决这个问题

我正在尝试从 Microsoft Graph Api 中获取代码示例之一，以处理公司特定的应用程序。在我的租户登录屏幕上登录后，我被重定向到应用程序并出现以下错误。

AADSTS90130: Application '{application id}' (aad name) is not supported over the /common or /consumers endpoints. Please use the /organizations or tenant-specific endpoint.

在我的启动类中，我有以下代码:

    // The graphScopes are the Microsoft Graph permission scopes that are used by this sample: User.Read Mail.Send
    private static string appId = ConfigurationManager.AppSettings["ida:AppId"];
    private static string appSecret = ConfigurationManager.AppSettings["ida:AppSecret"];
    private static string redirectUri = ConfigurationManager.AppSettings["ida:RedirectUri"];
    private static string graphScopes = ConfigurationManager.AppSettings["ida:GraphScopes"];

    public void ConfigureAuth(IAppBuilder app)
    {
        app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

        app.UseCookieAuthentication(new CookieAuthenticationOptions());

        app.UseOpenIdConnectAuthentication(
            new OpenIdConnectAuthenticationOptions
            {

                // The `Authority` represents the Microsoft v2.0 authentication and authorization service.
                // The `Scope` describes the permissions that your app will need. See https://azure.microsoft.com/documentation/articles/active-directory-v2-scopes/                    
                ClientId = appId,
                Authority = "https://login.microsoftonline.com/{tenantid}",
                PostLogoutRedirectUri = redirectUri,
                RedirectUri = redirectUri,
                Scope = "openid email profile offline_access " + graphScopes,
                TokenValidationParameters = new TokenValidationParameters
                {
                    ValidateIssuer = false,
                    // In a real application you would use IssuerValidator for additional checks, 
                    // like making sure the user's organization has signed up for your app.
                    //     IssuerValidator = (issuer, token, tvp) =>
                    //     {
                    //         if (MyCustomTenantValidation(issuer)) 
                    //             return issuer;
                    //         else
                    //             throw new SecurityTokenInvalidIssuerException("Invalid issuer");
                    //     },
                },
                Notifications = new OpenIdConnectAuthenticationNotifications
                {
                    AuthorizationCodeReceived = async (context) =>
                    {
                        var code = context.Code;
                        string signedInUserID = context.AuthenticationTicket.Identity.FindFirst(ClaimTypes.NameIdentifier).Value;

                        TokenCache userTokenCache = new SessionTokenCache(signedInUserID,
                            context.OwinContext.Environment["System.Web.HttpContextBase"] as HttpContextBase).GetMsalCacheInstance();
                        ConfidentialClientApplication cca = new ConfidentialClientApplication(
                            appId, 
                            redirectUri,
                            new ClientCredential(appSecret),
                            userTokenCache,
                            null);
                        string[] scopes = graphScopes.Split(new char[] { ' ' });

                        AuthenticationResult result = await cca.AcquireTokenByAuthorizationCodeAsync(code, scopes);
                    },
                    AuthenticationFailed = (context) =>
                    {
                        context.HandleResponse();
                        context.Response.Redirect("/Error?message=" + context.Exception.Message);
                        return Task.FromResult(0);
                    }
                }
            });
    }
}

在这段代码中，我在登录 url 中有特定于租户的 ID，它适用于具有相同登录样式的另一个应用程序。

我不确定哪里出了问题，所以我希望有人可以帮助我。我在这里查看了相关问题，但似乎没有一个与此问题相关。

Answer 1

您正在使用 v1 端点通过 Azure 门户注册您的应用程序并将 Multi-Tenancy 设置为 false。这会将您的应用程序限制为仅来自其注册租户的 AAD 用户。

如果您想接受任何 AAD 用户，则需要启用多个租户。这将允许报告 AAD 租户识别您的应用程序并允许用户进行身份验证。

如果您想同时接受 AAD 和 MSA 用户，则需要在 https://apps.dev.microsoft.com 注册您的应用程序.您还需要重构身份验证代码以使用 v2 端点。