ASP.Net - Azure AD 身份验证

Question

我正在尝试在我正在构建的 ASP.Net Web 表单应用程序上实现 Azure AD 身份验证。

预期的流程是提示用户输入来自 Azure 的用户名/密码，该用户名/密码经过身份验证，然后传回应用程序。

我的验证码如下

Private Shared app As PublicClientApplication

    Shared Sub New()

        Dim clientId As String = ConfigurationManager.AppSettings("ida:ClientId")
        Dim redirectUri As String = ConfigurationManager.AppSettings("ida:RedirectUri")
        Dim tenantId As String = ConfigurationManager.AppSettings("ida:Tenant")
        Dim authorityUri = "https://login.microsoftonline.com/" & tenantId
        Dim scopes As String() = New String() {"https://graph.microsoft.com/User.Read"}



        app = PublicClientApplicationBuilder.Create(clientId).WithAuthority(authorityUri).WithTenantId(tenantId).WithRedirectUri(redirectUri).Build()
    End Sub

    Public Function GetAuthenticationResult() As String
        Try
            Dim scopes As String() = New String() {"https://graph.microsoft.com/User.Read"}

            Dim result As Microsoft.Identity.Client.AuthenticationResult = app.AcquireTokenInteractive(scopes).WithPrompt(Prompt.ForceLogin).ExecuteAsync().Result
            Return result.Account.Username
        Catch ex As Exception
            Err.Clear()
            Return "-"
            Exit Function
        End Try

    End Function

 Private Sub BtnConnectWithAzure_Click(sender As Object, e As EventArgs) Handles BtnConnectWithAzure.Click
        Dim t As New Threading.Thread(AddressOf AuthenticateUser)
        t.SetApartmentState(ApartmentState.STA)
        t.Start()
    End Sub

    Private Sub AuthenticateUser()
        System.Net.ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls11 Or SecurityProtocolType.Tls12
        Dim app As New AuthenticationManager
        Dim username As String = app.GetAuthenticationResult()

        If username <> "-" Then
            Response.Redirect(username)
        End If

    End Sub

但是，我收到以下错误消息:

错误类型:invalid_client。

错误描述:AADSTS7000218:请求正文必须包含以下参数:‘client_assertion’或‘client_secret

我已在 Azure AD 门户上启用“允许公共(public)客户端流”，但它似乎没有解决问题

Answer 1

"AADSTS7000218: The request body must contain the following parameter: ‘client_assertion’ or ‘client_secret"

如果您在代码中使用公共(public)客户端应用程序时，通过将“允许公共(public)客户端流”启用为是，错过了在移动和桌面应用程序平台中添加重定向 URI，通常会发生此错误.

我注册了一个 Azure AD 应用程序，并在 Web 平台中添加了重定向 URI，如下所示:

当我运行下面的示例代码以使用交互式流程获取登录用户详细信息时，我遇到了与下面相同的错误:

using Azure.Identity;
using Microsoft.Graph;

var scopes = new[] { "User.Read" };

var tenantId = "9d2265a5-3de9-4610-98c2-xxxxxxx";
var clientId = "7102a1a5-312f-4c91-8ca3-xxxxxxxx";

var options = new InteractiveBrowserCredentialOptions
{
    TenantId = tenantId,
    ClientId = clientId,
    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud,
    RedirectUri = new Uri("http://localhost"),
};

var interactiveCredential = new InteractiveBrowserCredential(options);

var graphClient = new GraphServiceClient(interactiveCredential, scopes);
var result = await graphClient.Me.GetAsync();
Console.WriteLine(result.DisplayName);
Console.WriteLine(result.Id);

回应:

要解决此错误，请从 Web 平台中删除重定向 URI，并将其添加到移动和桌面应用程序平台中，如下所示:

当我在进行上述更改后再次运行代码示例时，我成功地得到了响应，如下所示:

using Azure.Identity;
using Microsoft.Graph;

var scopes = new[] { "User.Read" };

var tenantId = "9d2265a5-3de9-4610-98c2-xxxxxxx";
var clientId = "7102a1a5-312f-4c91-8ca3-xxxxxxxx";

var options = new InteractiveBrowserCredentialOptions
{
    TenantId = tenantId,
    ClientId = clientId,
    AuthorityHost = AzureAuthorityHosts.AzurePublicCloud,
    RedirectUri = new Uri("http://localhost"),
};

var interactiveCredential = new InteractiveBrowserCredential(options);

var graphClient = new GraphServiceClient(interactiveCredential, scopes);
var result = await graphClient.Me.GetAsync();
Console.WriteLine(result.DisplayName);
Console.WriteLine(result.Id);

回应:

根据您的情况，从Web 平台中删除重定向 URI，并将其添加到移动和桌面应用程序平台中。