azure - 使用 ADAL 进行身份验证

Question

我正在使用以下代码对我的 Azure 试用帐户中的默认用户进行身份验证。

    static void Main(string[] args)
    {
        GetTokenAsync().Wait();
    }

    static async Task<string> GetTokenAsync()
    {
        string Tenant = "mytest.onmicrosoft.com";
        string Authority = "https://login.microsoftonline.com/" + Tenant;
        string GatewayLoginUrl = "https://login.microsoftonline.com/something/wsfed";
        string ClientId = "something";
        Uri RedirectUri = new Uri("http://something");

        AuthenticationContext context = new AuthenticationContext(Authority);
        PlatformParameters platformParams = new PlatformParameters(PromptBehavior.Auto, null);
        AuthenticationResult result = await context.AcquireTokenAsync(GatewayLoginUrl, ClientId, RedirectUri, platformParams);

        return result.ToString();
    }

我想知道从哪里获取这些值:

• 租户
• 权威
• 网关登录网址
• 客户端ID
• 重定向Uri

这么多代码足以使用 AD 进行用户身份验证吗？

Answer 1

使用 Azure Active Directory 保护应用程序时有几种情况(请参阅 here):

These are the five primary application scenarios supported by Azure AD:

1. Web Browser to Web Application: A user needs to sign in to a web application that is secured by Azure AD.
2. Single Page Application (SPA): A user needs to sign in to a single page application that is secured by Azure AD.
3. Native Application to Web API: A native application that runs on a phone, tablet, or PC needs to authenticate a user to get resources from a web API that is secured by Azure AD.
4. Web Application to Web API: A web application needs to get resources from a web API secured by Azure AD.
5. Daemon or Server Application to Web API: A daemon application or a server application with no web user interface needs to get resources from a web API secured by Azure AD.

您提到您已经注册了一个 native 应用程序。我假设您需要针对 Azure Active Directory(从现在开始为 AAD)进行身份验证才能访问 protected Web api 或 Web 应用程序(场景 #3)，因此您也必须注册该应用程序。

static void Main(string[] args)
{
    GetTokenAsync().Wait();
}

static async Task<string> GetTokenAsync()
{
    string Tenant = "mytest.onmicrosoft.com";
    string Authority = "https://login.microsoftonline.com/" + Tenant;
    string GatewayLoginUrl = "https://login.microsoftonline.com/something/wsfed";
    string ClientId = "something";
    Uri RedirectUri = new Uri("http://something");

    AuthenticationContext context = new AuthenticationContext(Authority);
    PlatformParameters platformParams = new PlatformParameters(PromptBehavior.Auto, null);
    AuthenticationResult result = await context.AcquireTokenAsync(GatewayLoginUrl, ClientId, RedirectUri, platformParams);

    return result.ToString();
}

• Tenant 是 AAD 域的名称，看来您答对了
• Authority 是 "https://login.microsoftonline.com/"+ Tenant，看来您也有权利
• GatewayLoginUrl 是您正在保护的应用程序的 App Id Uri
• ClientId 是 native 应用程序的应用程序 ID
• RedirectUri 是 native 应用程序的重定向 Uri

要保护的应用程序:

您可以从此处获取GatewayLoginUrl。

访问要保护的应用程序的 native 应用程序:

您可以从此处获取 ClientId 和 RedirectUri。

其他引用

您可以查看 native 应用程序的完整演练 here

有关使用 native 应用程序访问 AAD protected 应用程序的全局概述，请参阅 the docs