c# - MsalService异常: AADSTS90014: The required field 'aud' is missing

Question

我正在尝试通过 ASP.NET Core 2.2 后端应用程序(另一个 MVC 应用程序)访问 Azure REST api。我希望根据登录的 Azure AD 用户获得 REST api 的 OnBehalfOf 身份验证。我收到这个奇怪的错误。

MsalServiceException: AADSTS90014: The required field 'aud' is missing.

在文档或博客文章中，我无法找到解决方案，甚至无法找到讨论的更棘手的问题。下面提到的是我的代码。

public class TokenAcquisitionService : ITokenAcquisitionService
{
    private readonly UserAssertion _userAssertion;

    private readonly ConfidentialClientApplication _confidentialClientApp;

    public TokenAcquisitionService(UserContextInfo userContextInfo, MemoryTokenCache memoryTokenCache, IConfiguration configuration)
    {
        var tokenCache = memoryTokenCache.GetIDistributedCacheCacheInstance();
        var clientId = configuration.GetValue<string>("AzureAd:ClientId");
        var clientSecret = new ClientCredential(configuration.GetValue<string>("AzureAd:ClientSecret"));

        _confidentialClientApp = new ConfidentialClientApplication(clientId, userContextInfo.BaseRequestUrl, clientSecret, tokenCache, null);
        _userAssertion = new UserAssertion(userContextInfo.Token);
    }

    public async Task<string> AcquireTokenAsync()
    {
        string[] scopes = { "https://example.com/846fsd66-xxxx-yyyy-82cb-1fe40a30f00c/user_impersonation" };
        var accounts = await _confidentialClientApp.GetAccountsAsync();

        AuthenticationResult result;

        if (accounts.Any())
            result = await _confidentialClientApp.AcquireTokenSilentAsync(scopes, accounts.First());
        else
            result = await _confidentialClientApp.AcquireTokenOnBehalfOfAsync(scopes, _userAssertion);

        return result.AccessToken;
    }
}

我使用 NuGet 包 Microsoft.Identity.Client 版本 2.7.1 进行 REST API 身份验证，并使用 Microsoft.AspNetCore.Authentication.AzureAD.UI 版本 2.1.1 用于 MVC 应用程序的身份验证。

更新

对于 MVC 应用程序，我使用 Azure Active Directory 身份验证，如下所示(据我所知，它使用自己的 cookie 身份验证)。

services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
            .AddAzureAD(options =>
            {
                Configuration.Bind("AzureAd", options);
            });

Answer 1

错误描述:AADSTS90014 MissingRequiredField - This error code may appear in various cases when an expected field is not present in the credential.
来源:Authentication and authorization error codes .

字段aud适用于代币的目标受众。您需要它来验证 token 是否适用于您将其发送到的后端。

取自 JSON Web Token Introduction :

Registered claims - These are a set of predefined claims which are not mandatory but recommended, to provide a set of useful, interoperable claims. Some of them are: iss (issuer), exp (expiration time), sub (subject), aud (audience), and others.

取自 RFC 7519 - Section 4.1 :

The "aud" (audience) claim identifies the recipients that the JWT is for. Each principal intended to process the JWT MUST identify itself with a value in the audience claim. If the principal processing the claim does not identify itself with a value in the "aud" claim when this claim is present, then the JWT MUST be rejected. In the general case, the "aud" value is an array of case-sensitive strings, each containing a StringOrURI value. In the special case when the JWT has one audience, the "aud" value MAY be a single case-sensitive string containing a StringOrURI value. The interpretation of audience values is generally application specific. Use of this claim is OPTIONAL.

在 ASP.NET 后端配置 Azure Active Directory 身份验证时，您可以指定受众。在我们的例子中，代码如下所示:

services.AddAuthentication(o =>
{
    o.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    o.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
}).AddJwtBearer(options =>
{
    options.Authority = Authority;
    options.Audience = ClientId;
    options.TokenValidationParameters = new TokenValidationParameters
    {
        SaveSigninToken = true
    };
});

哪里Authority是包含 AAD Instance 的属性+我们的TenantID和ClientID是ClientID Azure Active Directory 中的应用程序的名称。

将 MSAL 配置为与经过身份验证的后端通信时，如下所示:

MsalModule.forRoot({
  authority: 'https://login.microsoftonline.com/<TENANT>.onmicrosoft.com',
  clientID: '<CLIENT_ID_GUID>',
  protectedResourceMap: protectedResourceMap
})

哪里protectedResourceMap包含 API URL 和所需范围的映射。