azure - 对于 '10/15/2018' 问题之后创建的此类应用程序，不支持使用/common 端点

Question

Similar issue here 。我已经检查了答案并尝试使用以下代码在我的startup.cs类中实现所有可能的链接形式:

var idClient = ConfidentialClientApplicationBuilder.Create(appId)
                .WithRedirectUri(redirectUri)
                .WithTenantId(tenantId)
                .WithClientSecret(appSecret)
                .WithAuthority(Authority) // Authority contains the link as mentioned in the page(link attached above)
                .Build();

我仍然遇到类似的错误:

"OpenIdConnectMessage.Error was not null, indicating an error. Error: 'invalid_request'. Error_Description (may be empty): 'AADSTS50194: Application 'xxx-xxx-xxx-xxx-xxxx'(ASPNET-Quickstart) is not configured as a multi-tenant application. Usage of the /common endpoint is not supported for such applications created after '10/15/2018'. Use a tenant-specific endpoint or configure the application to be multi-tenant.Trace ID: xxx-xxx-xxx-xxx-xxxxCorrelation ID: xxx-xxx-xxx-xxx-xxxxTimestamp: 2022-06-11 05:33:24Z'. Error_Uri (may be empty): 'error_uri is null'."

我在变量Authority中使用的链接组合如下:“https://login.microsoftonline.com/MY_TENANT_NAME”和“https ://login.microsoftonline.com/MY_TENANT_ID"

我被重定向到登录页面，但在输入凭据后，OnAuthenticationFailedAsync 方法正在执行。这是我的启动类的代码:

[assembly: OwinStartup(typeof(Web.Startup))]

namespace Web
{
    public partial class Startup
    {
        // Load configuration settings from PrivateSettings.config
        private static string appId = ConfigurationManager.AppSettings["ida:AppId"];
        private static string appSecret = ConfigurationManager.AppSettings["ida:AppSecret"];
        private static string redirectUri = ConfigurationManager.AppSettings["ida:RedirectUri"];
        private static string graphScopes = ConfigurationManager.AppSettings["ida:AppScopes"];
        private static string tenantId = ConfigurationManager.AppSettings["ida:tenantId"];
        private static string aadInstance = EnsureTrailingSlash(ConfigurationManager.AppSettings["ida:AADInstance"]);
        public static string Authority = "https://graph.microsoft.com/"+ tenantId;
        string graphResourceId = "https://graph.microsoft.com/";

        public void Configuration(IAppBuilder app)
        {
            // For more information on how to configure your application, visit https://go.microsoft.com/fwlink/?LinkID=316888
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            app.UseOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {
                    ClientId = appId,
                    Authority = "https://login.microsoftonline.com/common/v2.0",
                    Scope = $"openid email profile offline_access {graphScopes}",
                    RedirectUri = redirectUri,
                    PostLogoutRedirectUri = redirectUri,
                    TokenValidationParameters = new TokenValidationParameters
                    {
                        // For demo purposes only, see below
                        ValidateIssuer = true
                    },
                    Notifications = new OpenIdConnectAuthenticationNotifications
                    {
                        AuthenticationFailed = OnAuthenticationFailedAsync,
                        AuthorizationCodeReceived = OnAuthorizationCodeReceivedAsync
                    }
                }
            );
        }
        private static Task OnAuthenticationFailedAsync(AuthenticationFailedNotification<OpenIdConnectMessage,
            OpenIdConnectAuthenticationOptions> notification)
        {
            notification.HandleResponse();
            string redirect = $"/Home/Error?message={notification.Exception.Message}";
            if (notification.ProtocolMessage != null && !string.IsNullOrEmpty(notification.ProtocolMessage.ErrorDescription))
            {
                redirect += $"&debug={notification.ProtocolMessage.ErrorDescription}";
            }
            notification.Response.Redirect(redirect);
            return Task.FromResult(0);
        }

        private async Task OnAuthorizationCodeReceivedAsync(AuthorizationCodeReceivedNotification notification)
        {
            var idClient = ConfidentialClientApplicationBuilder.Create(appId)
                .WithRedirectUri(redirectUri)
                .WithTenantId(tenantId)
                .WithClientSecret(appSecret)
                .WithAuthority(Authority)
                .Build();
           
            string email = string.Empty;
            try
            {
                string[] scopes = graphScopes.Split(' ');

                var result = await idClient.AcquireTokenByAuthorizationCode(
                    scopes, notification.Code).ExecuteAsync();

                email = await GraphHelper.GetUserDetailsAsync(result.AccessToken);
            }
            catch (MsalException ex)
            {
                System.Diagnostics.Trace.TraceError(ex.Message);
            }
            notification.HandleResponse();
            notification.Response.Redirect($"/Account/SignInAzure?email={email}");
        }

        private static string EnsureTrailingSlash(string value)
        {
            if (value == null)
            {
                value = string.Empty;
            }

            if (!value.EndsWith("/", StringComparison.Ordinal))
            {
                return value + "/";
            }

            return value;
        }

    }
}

我的应用程序适用于单租户，因此请不要建议我更改设置并将其设为 Multi-Tenancy 。

Answer 1

请检查以下几点:

尝试将其更改为特定租户后，即；更改为 Ex: 后 - https://login.microsoftonline.com/contoso.onmicrosoft.com (或租户 ID)，请保存更改，刷新门户/所有内容，然后重试。

如果仍然显示错误，请检查应用程序是否已作为 Multi-Tenancy 应用程序注册到 Azure AD 租户。

• 如果仍然存在，请检查该帐户是否确实位于 Azure 上AD，因为当您尝试使用用户凭据时可能会发生此错误使用不属于应用程序所在的同一租户实际注册于。
• 如果是不同的租户并且您尝试从不同的租户进行访问帐户，那么您可能需要将其支持的帐户类型更改为任何组织目录，或者您需要检查是否正确证书。如果没有检查所有内容或创建新的应用程序注册.
• 另请查看此 "Use a tenant-specific endpoint or configure the application to be multi-tenant" when signing into my Azure website为了可能的解决问题的方法。

否则你可以筹集support request

引用文献:

1. msal - MsalException: Applicationis not configured as a multi-tenantapplication. Android - Stack Overflow
2. Use single-tenant Azure AD apps with Microsoft Graph Toolkit -Waldek Mastykarz