azure - 从 Azure Web API 获取未经授权

Question

我使用 Visual Studio 2015 Update 3 for Web API 创建了一个基本项目(没有自定义，简单)，并按照说明将其部署到 Azure(免费帐户)here 。然后我使用以下代码创建了一个控制台客户端。

 public static async Task<bool> ReadValues()
    {
        try
        {
            // Authenticate the user and get a token from Azure AD
            //AuthenticationResult authResult = await AuthContext.AcquireTokenSilentAsync(Resource, ClientId);
            AuthenticationResult authResult = AuthContext.AcquireToken(Resource, ClientId, RedirectUri);

            // Create an HTTP client and add the token to the Authorization header
            HttpClient httpClient = new HttpClient();
            httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(
                //"Bearer" 
                authResult.AccessTokenType
                , authResult.AccessToken);

            // Call the Web API to get the values
            var requestUri = new Uri(WebApiUri, "api/values");
            Console.WriteLine("Reading values from '{0}'.", requestUri);
            HttpResponseMessage httpResponse = await httpClient.GetAsync(requestUri);
            Console.WriteLine("HTTP Status Code: '{0}'", httpResponse.StatusCode.ToString());
            //Console.WriteLine("HTTP Header: '{0}'", httpClient.DefaultRequestHeaders.Authorization.ToString());
            if (httpResponse.IsSuccessStatusCode)
            {
                //
                // Code to do something with the data returned goes here.
                //
                var s = await httpResponse.Content.ReadAsStringAsync();
                Console.WriteLine(s);
            }
            else
            {
                Console.ForegroundColor = ConsoleColor.Red;
                Console.WriteLine(httpResponse.ReasonPhrase);
            }
             return (httpResponse.IsSuccessStatusCode);
        }
        catch (Exception ex)
        {
            Console.WriteLine(ex.Message);
        }
        return false;
    }

当我在调试中从 Visual Studio 本地运行 WEB API 时，它工作正常，但当我将其部署到 Azure 时，它​​返回“未经授权”。我可能会被问到的一些常见问题:

1. I do receive a valid bearer token
2. I have created the App registrations in the Azure AD for bot hthe WEB API and the client
3. The client and WEB API are using the correct redirect, resource uri
4. The account I am using to login is the same as the one used to create the Azure account and it has full privileges in the domain/AD/API

在API方面，这是startup.auth.cs的全部

using System.Configuration;
using System.IdentityModel.Tokens;
using Microsoft.Owin;
using Microsoft.Owin.Security.ActiveDirectory;
using Owin;
using WebApi;

[assembly: OwinStartup("default", typeof(Startup))]

namespace WebApi
{
    public partial class Startup
    {
        // For more information on configuring authentication, please visit http://go.microsoft.com/fwlink/?LinkId=301864
        public void ConfigureAuth(IAppBuilder app)
        {
            app.UseWindowsAzureActiveDirectoryBearerAuthentication(
                new WindowsAzureActiveDirectoryBearerAuthenticationOptions
                {
                    Tenant = ConfigurationManager.AppSettings["ida:Tenant"],
                    TokenValidationParameters = new TokenValidationParameters {
                         ValidAudience = ConfigurationManager.AppSettings["ida:Audience"]
                    },
                });
        }
    }
}

我还应该检查什么？

Other references

https://www.simple-talk.com/cloud/security-and-compliance/azure-active-directory-part-3-developing-native-client-applications/

Answer 1

感谢 Juunas 的帮助，他为我提供了一份工作副本，我能够缩小问题的范围。当我将调试器附加到 Web API 的 Azure 实例时，我能够看到 Bad Audience 的异常。在尝试回溯我的步骤时，我发现在从 Visual Studio 进行部署时，我在设置中选择了企业身份验证，导致 web.config 发生更改，从而导致问题。如果不选择该选项，我就可以通过不记名 token 访问 API。