具有承载授权的 Azure Multi-Tenancy ASP.Net-Core 应用程序

Question

如何为 Multi-Tenancy 应用程序设置承载授权？

这是单页应用程序。在浏览器站点应用程序上使用 Adal.js对用户进行身份验证。身份验证后，应用程序使用 Authorization Bearer header 向 ASP.Net-Core 服务器端发送请求。

ASP.Net-Core使用Microsoft.AspNetCore.Authentication.JwtBearer检查请求。这是启动:

public class Startup
{
    public Startup(IConfiguration configuration)
    {
        Configuration = configuration;
    }

    public IConfiguration Configuration { get; }

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddAuthentication(sharedOptions =>
        {
            sharedOptions.DefaultScheme = JwtBearerDefaults.AuthenticationScheme;
        })
        .AddAzureAdBearer(options => Configuration.Bind("AzureAd", options));

        // ... other ...
    }

    public void Configure(IApplicationBuilder app, IHostingEnvironment env)
    {
        app.UseAuthentication();

        // ... other ...
    }
}

这是 AddAzureAdBearer 方法:

public static class AzureAdServiceCollectionExtensions
{
    public static AuthenticationBuilder AddAzureAdBearer(this AuthenticationBuilder builder)
        => builder.AddAzureAdBearer(_ => { });
    public static AuthenticationBuilder AddAzureAdBearer(this AuthenticationBuilder builder, Action<AzureAdOptions> configureOptions)
    {
        builder.Services.Configure(configureOptions);
        builder.Services.AddSingleton<IConfigureOptions<JwtBearerOptions>, ConfigureAzureOptions>();
        builder.AddJwtBearer();
        return builder;
    }
    private class ConfigureAzureOptions : IConfigureNamedOptions<JwtBearerOptions>
    {
        private readonly AzureAdOptions AzureOptions;
        public ConfigureAzureOptions(IOptions<AzureAdOptions> azureOptions)
        {
            AzureOptions = azureOptions.Value;
        }
        public void Configure(string name, JwtBearerOptions options)
        {
            options.Audience = AzureOptions.ClientId;

            // this works (specific TenantId)
            // options.Authority 
            //    = "https://login.microsoftonline.com/f8811864-6950-4347-af1c-9d22bb3d0615"
            // this did not work (common instead of specific TenantId)
            // options.Authority 
            //    = "https://login.microsoftonline.com/common";
            options.Authority = $"{AzureOptions.Instance}{AzureOptions.TenantId}";
        }
        public void Configure(JwtBearerOptions options)
        {
            Configure(Options.DefaultName, options);
        }
    }
 }

对于单个租户，这可以按预期工作，可以使用 [Authorize] 属性标记 Controller

[Route("api/[controller]")]
[Authorize]
public class CalendarController : Controller
{

对于 Multi-Tenancy ，我将 Adal.js 设置为公共(public)端点，并且它正在工作(用户可以成功登录)。但是 ASP.Net-Core 服务器无法检查 Bearer header，对于单个租户

JwtBearerOptions.Authority = "https://login.microsoftonline.com/f8811864-6950-4347-af1c-9d22bb3d0615 "

对于 Multi-Tenancy ，我尝试发送

JwtBearerOptions.Authority = "https://login.microsoftonline.com/common "

ASP.Net-Core 服务器返回未经授权的响应。

更新

发布The Common Endpoint: Walks Like a Tenant, Talks Like a Tenant… But Is Not a Tenant与共同权威描述问题的原因。

简而言之: token (作为授权承载 header 发送并且必须在服务器端进行验证)包含“颁发者”字符串，如下所示:https://sts.windows.net/<TENAT_ID> 。 <TENAT_ID> - 将是真实的<TENAT_ID>不是“常见”字符串。

因此，当验证授权承载 header 时，“颁发者”字符串与配置的选项进行比较。权限设置。

要解决此问题，可以禁用颁发者验证。并自己制作:

    public void Configure(string name, JwtBearerOptions options)
    {
        options.Audience = AzureOptions.ClientId;

        options.TokenValidationParameters = new TokenValidationParameters{
            ValidateIssuer = false
        };
        options.Events = new JwtBearerEvents()
        {
            OnTokenValidated = (context) =>
            {
                if(!context.SecurityToken.Issuer.StartsWith("https://sts.windows.net/"))
                    throw new SecurityTokenValidationException();

                return Task.FromResult(0);
            }
        };

        options.Authority = $"{AzureOptions.Instance}{AzureOptions.TenantId}";
    }

我不确定检查发行人是否是正确的方法。请告诉我这是否正确。

Answer 1

是的，你是对的。对于 Multi-Tenancy 应用程序，将 ValidateIssuer 设置为 false。这意味着应用程序将验证发行人。

在 JwtBearerEvents.TokenValidated 事件中验证 token 颁发者。发行人在“iss”声明中发送。

public override async Task TokenValidated(TokenValidatedContext context)
{
    var principal = context.Ticket.Principal;
    var tenantManager = context.HttpContext.RequestServices.GetService<TenantManager>();
    var userManager = context.HttpContext.RequestServices.GetService<UserManager>();
    var issuerValue = principal.GetIssuerValue();
    var tenant = await tenantManager.FindByIssuerValueAsync(issuerValue);

    if (tenant == null)
    {
        // The caller was not from a trusted issuer. Throw to block the authentication flow.
        throw new SecurityTokenValidationException();
    }

    var identity = principal.Identities.First();

}

您可以引用微软文档的这一部分 - Authenticating in the web API