azure - 如何将我的 Azure AD 应用程序更改为 secret 客户端？ (非公共(public)客户端)

Question

来自文档:Configurable token lifetimes in Azure Active Directory (Public Preview)

它提到“ secret 客户端”，刷新 token 是“直到撤销”。

Confidential clients are applications that can securely store a client password (secret). They can prove that requests are coming from the client application and not from a malicious actor. For example, a web app is a confidential client because it can store a client secret on the web server. It is not exposed. Because these flows are more secure, the default lifetimes of refresh tokens issued to these flows is until-revoked, cannot be changed by using policy, and will not be revoked on voluntary password resets.

那么，我的 Azure AD 应用程序是 Web 应用程序，那么，如何将我的 Azure AD 应用程序更改为“ secret 客户端”？我在 Azure AD 中找不到任何用于设置“ secret 客户端”或“公共(public)客户端”的应用设置。

谢谢。

Answer 1

关于[ secret 客户][1]:

confidentialClients capable of maintaining the confidentiality of their credentials (e.g., client implemented on a secure server withrestricted access to the client credentials), or capable of secureclient authentication using other means.

此规范是围绕以下客户资料设计的:

web application

A web application is a confidential client running on a web server.Resource owners access the client via an HTML user interface renderedin a user-agent on the device used by the resource owner. The clientcredentials as well as any access token issued to the client arestored on the web server and are not exposed to or accessible by theresource owner.

这意味着 native 应用程序和基于用户代理的应用程序是公共(public)客户端，但 Web 应用程序是 secret 客户端。

<小时/>

so, how I can change my Azure AD app to "confidential client"?

答案很明显:如果您创建的应用程序是Web APP/Web API，那么它只是一个 secret 客户端。否则，它是公共(public)客户端。这取决于您创建的应用程序类型。

希望这有帮助![1]:https://www.rfc-editor.org/rfc/rfc6749#section-2.1