azure - 无法使用 Azure B2C 获取 AccessToken，存在 IdToken 但没有范围权限

Question

我正在关注this使用 Azure B2C 设置客户端/服务器的教程。

我认为我已经正确完成了所有操作，但我遇到了一些问题。

1. AccessToken 为 null，但已填充 IdToken

当我尝试访问 protected 资源时，在 https://login.microsoftonline.com 登录后会执行以下代码。以下行失败，因为 AccessToken 为 null:

request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);

TaskWebApp.Controllers.TaskController.cs(客户端应用程序):

public async Task<ActionResult> Index()
{
    try
    {
        // Retrieve the token with the specified scopes
        var scope = new string[] { Startup.ReadTasksScope };
        string signedInUserID = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
        TokenCache userTokenCache = new MSALSessionCache(signedInUserID, this.HttpContext).GetMsalCacheInstance();
        ConfidentialClientApplication cca = new ConfidentialClientApplication(Startup.ClientId, Startup.Authority, Startup.RedirectUri, new ClientCredential(Startup.ClientSecret), userTokenCache, null);

        var user = cca.Users.FirstOrDefault();
        if (user == null)
        {
            throw new Exception("The User is NULL.  Please clear your cookies and try again.  Specifically delete cookies for 'login.microsoftonline.com'.  See this GitHub issue for more details: https://github.com/Azure-Samples/active-directory-b2c-dotnet-webapp-and-webapi/issues/9");
        }

        AuthenticationResult result = await cca.AcquireTokenSilentAsync(scope, user, Startup.Authority, false);

        HttpClient client = new HttpClient();
        HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, apiEndpoint);

        // Add token to the Authorization header and make the request
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken); //AccessToken null - crash
        //request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", result.IdToken); //This does work however
    }
    ...
}

结果 AquireTokenSilentAsync 的内容:

IdToken 不包含Scope 权限

如果我使用 IdToken 代替 AccessToken - 我会更进一步，但我遇到了一个新的绊脚石。这里失败了:

TaskService.Controllers.TasksController.cs(WebAPI):

public const string scopeElement = "http://schemas.microsoft.com/identity/claims/scope";

private void HasRequiredScopes(String permission)
{
    if (!ClaimsPrincipal.Current.FindFirst(scopeElement).Value.Contains(permission)) //Crashes here as token doesn't contain scopeElement
    {
        throw new HttpResponseException(new HttpResponseMessage
        {
            StatusCode = HttpStatusCode.Unauthorized,
            ReasonPhrase = $"The Scope claim does not contain the {permission} permission."
        });
    }
}

这是我的 ClaimsPrincipal.Current 的屏幕截图:

如有任何建议，我们将不胜感激。

编辑

登录网址:

https://login.microsoftonline.com/te/turtlecorptesting.onmicrosoft.com/b2c_1_email/oauth2/v2.0/authorize?client_id=03ef2bd...&redirect_uri=https%3a%2f%2flocalhost%3a44316%2f&response_mode=form_post&response_type=code+id_token&scope=openid+profile+offline_access+https%3a%2f%2fturtlecorptesting.onmicrosoft.com%2fread+https%3a%2f%2fturtlecorptesting.onmicrosoft.com%2fwrite&state=OpenIdConnect.AuthenticationProperties%3daDQntAuD0Vh=...&nonce=63655.....YWRmMWEwZDc.....

Answer 1

1. 在 Azure AD B2C 下转到您的应用程序

在“API 访问权限”下，点击“添加”，选择您的 API 及其范围

您现在应该在响应中获得 AccessToken。