我正在开发烧瓶 + Angular Web应用程序，我想使用Microsoft OAuth2使用REST API获取一些数据。
因此，我在Angular中有一个“登录到Microsoft”按钮，但是我需要从后端（烧瓶）调用API，那么这种情况的最佳解决方案是什么？我可以在Azure AD中注册前端或后端吗？
编辑：
我将在此处进行更多解释：
- 因此，我有一个Angular应用程序，该应用程序来自后端（烧瓶）
- 我应用程序的用户必须授予我一些权限以访问其Power BI帐户中的数据。
- 在我的Blask应用中，我需要获得Microsoft Power BI的访问令牌以使用一些REST API，例如：获取用户的报告或仪表板
- ，然后我必须处理我从Power BI Rest API中收到的数据，并且将响应发送到前端应用程序（Angular）。
因此，问题是：
- 如果我注册后端应用程序，我将无法管理会话，因为我的后端是无状态的。
- 如果我注册了前端应用程序，则有两种情况：
- 案例1：从前端调用Power BI REST API，这对我来说不是一个好情况，因为我想处理后端收到的数据。
- 案例2：通过邮政请求将令牌发送给我认为根本没有安全的后端。
实际上，我可以做另一个解决方案，即：注册我的Angular App -＆gt;请求Angular的API-＆GT;在角度进行一些处理，并将结果发送到后端 - ＆gt;后端将在不使用access_token的情况下完成处理阶段的其余部分，我可以这样做吗？
I'm developing a flask + angular web app, and I want to use Microsoft oauth2 to get some data using rest APIs.
So I have a "sign in to Microsoft" button in Angular, but I need to call the APIs from the backend (Flask), so what's the best solution to this kind of situations? shall I register the frontend or the backend as client in azure AD ?
Edit :
I will explain more here:
- So I have an angular app that calls APIs from the backend (Flask)
- The users of my app have to grant me some permissions to access data in their power BI Accounts.
- In my Flask app I need to get an access token to Microsoft power BI to use some rest APIs such as : get reports or dashboards of the user
- Then I have to process the data that I've received from the power bi rest APIs, and send the response to the frontend app (Angular).
So the problem is:
- if I register the backend app, I won't be able to manage sessions since my backend is stateless.
- if I register the frontend app, I have two cases:
- Case 1: Calling the power bi rest APIs from the frontend which is not a good case for me because I want to process the data received in the backend.
- Case 2: sending the token through a post request to the backend which I think is not secure at all.
I actually can do another solution, which is: registering my angular app --> requesting the apis from angular --> doing some processing in angular and send the result to the backend --> the backend will do the rest of the processing phase without using the access_token, Can I do this?, or there is a better solution
发布评论
评论（2）
客户ID听起来很困惑。客户端ID只是用于识别每个应用程序注册的一般ID，而不是像客户端“前端”应用程序那样的应用程序类型。
另外，Azure AD中应该有一个向导
，因此您需要对 前端“ Angular Spa”和后端API进行应用程序注册。
这是在Azure AD中注册API的示例。
那么第一个问题您要使用哪种类型的流程？
另外，我建议使用MSAL库
这是一个链接，其链接它支持
https://learn.microsoft.com/en-us/azure/active-directory/develop/develop/msal-authentication-flows
这是一个示例，是一个示例msal
您需要注册您的客户端（Angular应用程序） ）与API一起。
另外，您还需要考虑使用MSAL确保Web API。
您还需要
在所有将会发生的事情中设置诸如示例之类的内容，即当您导航到Angular应用程序时，您将登录到Microsoft，这将为您提供一个携带者令牌，然后将其在请求中的API中发送给您然后，API将验证该令牌并拒绝或退回响应。
在这里看： https://realpython.com/blog/基于python/doken-authentication-with-flask/
也要检查一下。最新/
Client ID can sound confusing. The client id is just a general ID used to identify each app registration not the app type like a client "front end" application.
Also there should be a wizard in azure ad
So you will need to do an app registration for both front end "angular spa" and backend api.
Here is example of registering an api in azure ad.
https://learn.microsoft.com/en-us/azure/active-directory/develop/quickstart-configure-app-expose-web-apis
So first question what type of flow are you trying to use?
Also I would advise using the MSAL library
here is a link with the flows that it supports
https://learn.microsoft.com/en-us/azure/active-directory/develop/msal-authentication-flows
here is an example how to setup angular with azure ad msal https://www.c-sharpcorner.com/article/build-a-secure-angular-app-using-msal-and-azure-active-directory/
You will need to register you client(angular application) along with the api.
Also you will want to look into securing a web api with msal.
You will also need to set things such as scopes
In all what will happen is you will login to Microsoft when you navigate to your angular app which will give you a bearer token which would then be sent in the header in your requests to your api which the api would then validate that token and either deny or send back the response.
Have a look here: https://realpython.com/blog/python/token-based-authentication-with-flask/
Check this too http://flask-jwt-extended.readthedocs.io/en/latest/
我认为您可以注册您的后端应用程序并将Redirect_uri配置为前端，我不确定
I think you can register your backend application and configure the redirect_uri to the frontend, I'm not sure tho