AddmicrosoftIdentityWebapi .NET Core 5 Web API?此支持版本V1和V2 API会吗? MSAL

发布于 2025-01-31 07:58:01 字数 140 浏览 4 评论 0 原文

我使用Adal.js和我的前端进行反应,并使用我的后端 MSAL ###以下是代码

服务 。

​ 我如何支持这种情况?

因为我想强加我的后端了解v1 doken,而v1 doken是由front app adal.js创建的

i m using react my front end using ADAL.js and my back end using
MSAL ### below is code

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
.AddMicrosoftIdentityWebApi(Configuration.GetSection("AzureAd"))

as my front app use ADAL.js its create V1 token and in back end i have MSAL ?
how i can support this situation ?

as i want to impose my back end to understand V1 token which is created by front app ADAL.js

如果你对这篇内容有疑问,欢迎到本站社区发帖提问 参与讨论,获取更多帮助,或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论, 你可以免费 注册 一个本站的账号。

评论(1

游魂 2025-02-07 07:58:01

是的,可以根据要求请求V1访问令牌甚至V2。 。

但是,请检查API所需的标志:

  1. idtoken:如果您从 v1端点中要求一个ID令牌,则会获得V1 ID令牌。如果您从v2中要求ID令牌
    端点您将获得V2 ID令牌。
  2. AccessToken:访问令牌版本由清单中的应用程序/API的配置确定。

发布给应用程序的访问令牌类型(V1或V2)由资源API的申请注册确定。

您可以确定您的API的配置为哪种类型的令牌,以接受进行较小的更改或查看App注册中的内容。在门户网站,当您转到“清单”部分时,请检查“ AccessTokenAcceptedversion” 。如果将其设置为null或1,则所有请求访问令牌来调用此资源的客户端应用程序将获得V1访问令牌( ,无论他们使用MSAL或ADAL是否请求访问令牌 < /em>)。

您可能需要要求使用/.default 范围: https://database.windows.net//.default

v1.0应用程序(msal)(msal)|微软文档

注意:

  • 对于带有V1.0访问令牌的Adal,AUD = Resource
  • 对于MSAL接受v2.0令牌,aud = resource.Appid
  • 对于MSAL v2.0端点,获得接受V1.0访问令牌的资源的访问令牌(上面是这种情况),Azure AD

    通过服用
    从要求的范围中解析所需的受众
    最后一次斜线之前的一切,并将其用作资源
    标识符。因此,如果 https://database.windows.net.net
    https://example.com/ ,您需要请求
    https://example.com/.default

  • 的范围

参考: authentication-是否可以获得Azure AD V1令牌使用MSAL? - 堆叠溢出

Yes, it is possible to request an V1 access token and even V2 depending on the requirement. .

But please check which token the API needs as:

  1. Idtoken: If you ask for an ID token from the V1 endpoint, you get a V1 ID token. If you ask for an ID token from the V2
    endpoint you get a V2 ID token.
    enter image description here
  2. Accesstoken: Access Tokens versions are determined by the configuration of your application/API in the manifest.

The access token type (v1 or v2) which is issued to your app is determined by the application registration of the resource API.

You can determine which type of tokens your API is configured to accept making small change or seeing what is present in app registration. In portal,when you go to the "Manifest" section, and check for "accessTokenAcceptedVersion". If it is set to null or 1, then all client applications requesting access tokens to call this resource will get a v1 access token (Regardless if they use MSAL or ADAL to request the access token).
enter image description here
And you may need to request a scope with /.default for example: https://database.windows.net//.default

According to Scopes for v1.0 apps (MSAL) | Microsoft Docs

NOTE:

  • For ADAL with a v1.0 access token , aud=resource
  • For MSAL accepting v2.0 tokens, aud=resource.AppId
  • For MSAL v2.0 endpoint getting an access token for a resource that accepts a v1.0 access token (which is the case above), Azure AD
    parses the desired audience from the requested scope by taking
    everything before the last slash and using it as the resource
    identifier. Therefore, if https://database.windows.net expects an
    audience of https://example.com/, you'll need to request a
    scope of https://example.com/.default

Reference : authentication - Is it possible to obtain an Azure AD V1 token using MSAL? - Stack Overflow

~没有更多了~
我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站,即表示您同意使用 Cookies 和您的相关数据。
原文