c# - 使用 GoogleWebAuthorizationBroker.AuthorizeAsync 时出现 HttpListenerException "access is denied"

Question

我正在尝试使用 Azure 托管 Web 应用程序执行 OAuth2，但我无法使用服务帐户(此处有许多可用的解决方案，但它们都坚持服务帐户/证书)，而我需要用户由 Google 进行身份验证和授权。

代码:

var credential = GoogleWebAuthorizationBroker.AuthorizeAsync(
    new ClientSecrets { ClientId = _clientId, ClientSecret = _clientSecret },
    scopes,
    User.Identity.Name,
    CancellationToken.None,
    new FileDataStore("GA.Auth.Store")) /* tried this to be null as well */
    .Result;

var service = new AnalyticsService(
    new BaseClientService.Initializer()
    {
        HttpClientInitializer = credential,
        ApplicationName = "Analytics API Sample"
    });

它在本地工作，但在部署为 Azure Web 应用程序时出现此异常:

[HttpListenerException (0x5): Access is denied]
Microsoft.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) +82
Microsoft.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccess(Task task) +76
Google.Apis.Auth.OAuth2.<AuthorizeAsync>d__1.MoveNext() +233

我猜测 GoogleWebAuthorizationBroker.AuthorizeAsync 正在尝试建立一个 http 监听器，这在 Azure Web 应用程序中是不可能的。

我尝试使用 Azure Web 应用程序身份验证。这确实对用户进行了身份验证，但我如何检索经过身份验证的用户以向 Google 授权他？

顺便说一句:因为我需要 GA Real-Time，所以我只能使用 GA Reporting v3 库。

Answer 1

GoogleWebAuthorizationBroker.AuthorizeAsync 专为已安装的应用程序而设计，它无法托管，因为它会尝试打开网络浏览器窗口以征求服务器的同意。

您应该关注web示例。

public void ConfigureServices(IServiceCollection services)
{
    ...

    // This configures Google.Apis.Auth.AspNetCore3 for use in this app.
    services
        .AddAuthentication(o =>
        {
            // This forces challenge results to be handled by Google OpenID Handler, so there's no
            // need to add an AccountController that emits challenges for Login.
            o.DefaultChallengeScheme = GoogleOpenIdConnectDefaults.AuthenticationScheme;
            // This forces forbid results to be handled by Google OpenID Handler, which checks if
            // extra scopes are required and does automatic incremental auth.
            o.DefaultForbidScheme = GoogleOpenIdConnectDefaults.AuthenticationScheme;
            // Default scheme that will handle everything else.
            // Once a user is authenticated, the OAuth2 token info is stored in cookies.
            o.DefaultScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        })
        .AddCookie()
        .AddGoogleOpenIdConnect(options =>
        {
            options.ClientId = {YOUR_CLIENT_ID};
            options.ClientSecret = {YOUR_CLIENT_SECRET};
        });
}