azure - 如何为 Azure 应用程序配置同意(AADSTS65005 错误)

Question

我们有一个 Azure 资源应用程序，我们希望公开其 API 以供 Azure 上的客户端应用程序访问。这两个应用程序位于不同的租户上。访问 API 的用户(Office 365 帐户持有者)位于不同的租户中。

当我们在尝试从客户端应用程序针对资源应用程序进行身份验证的租户上手动配置服务主体时，整个设置就可以工作。我的意思是他们能够使用 Office 365 帐户登录并显示同意屏幕。

如果我们没有在尝试进行身份验证的用户的 AAD 租户上配置服务主体，我们会收到此错误:

AADSTS65005 - The app needs access to a service <service> that your 
organization org.onmicrosoft.com has not subscribed to or enabled. Contact 
your IT Admin to review the configuration of your service subscriptions.

我们不可能为每个访问我们的应用程序(资源应用程序)的租户提供服务主体。我们还缺少什么吗？我们使用的流程是否正确？

Answer 1

您可以在此处找到针对您的情况的帮助:https://learn.microsoft.com/en-us/azure/active-directory/develop/active-directory-devhowto-multi-tenant-overview#understanding-user-and-admin-consent 。 (向下滚动到多个租户中的多个层)

In the case of an API built by an organization other than Microsoft, the developer of the API needs to provide a way for their customers to consent the application into their customers' tenants.

The recommended design is for the 3rd party developer to build the API such that it can also function as a web client to implement sign-up:

1. Follow the earlier sections to ensure the API implements the multi-tenant application registration/code requirements

2. In addition to exposing the API's scopes/roles, ensure the registration includes the "Sign in and read user profile" Azure AD permission (provided by default)

3. Implement a sign-in/sign-up page in the web client, following the admin consent guidance discussed earlier

4. Once the user consents to the application, the service principal and consent delegation links are created in their tenant, and the native application can get tokens for the API

基本上，您的应用所需的所有部分都必须作为服务主体出现在客户的租户中。这是 AAD 的要求。

实现这一点的唯一方法是管理员分别同意 API 和应用程序，因为它们是在不同的租户中注册的。

如果它们在同一租户中注册，您可以使用 list 中的 knownClientApplications 属性来允许同时同意两者。