asp.net-mvc – 如何从HttpContext获取JWT(使用OpenIdConnect),

我肯定会建议您阅读具体的authentication scenario,并查看相关样本.

以上内容将为您提供帮助,但要从Graph API获取JWT(不要与Microsoft Graph混淆),您需要在进行身份验证时获取身份验证代码,并将其存储在令牌缓存中.

您可以从Microsoft(MIT许可证)的this样本中获取可用的令牌缓存.现在,就我个人而言,我发现这些样本过于复杂,使用复杂的用例,实际上他们应该概述基础知识,但那只是我.不过,这些足以让你走近.

现在为一些代码.请允许我提请您注意’ResponseType = CodeIdToken’.

public void ConfigureAuth(IAppBuilder app)
        {
            //Azure AD Configuration
            app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
            app.UseCookieAuthentication(new CookieAuthenticationOptions());


            app.USEOpenIdConnectAuthentication(
                new OpenIdConnectAuthenticationOptions
                {
                    //sets client ID,and RedirectUri as obtained from web config
                    ClientId = clientId,//page that users are redirected to on logout
                    PostLogoutRedirectUri = redirectUrl,//scope - the claims that the app will make
                    Scope = OpenIdConnectScope.OpenIdProfile,ResponseType = OpenIdConnectResponseType.CodeIdToken,or set ValidateIssuer = true to config for single tennancy
                    TokenValidationParameters = new TokenValidationParameters()
                    {
                        ValidateIssuer = true,//SaveSigninToken = true
                    },Notifications = new OpenIdConnectAuthenticationNotifications
                    {
                        AuthenticationFailed = OnAuthenticationFailed,AuthorizationCodeReceived = OnAuthorizationCodeReceived,}

                }
                );
        }

提供上述参数时,以下代码将在您进行身份验证时运行：

private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification context)
    {
        var code = context.Code;
        ClientCredential cred = new ClientCredential(clientId,appKey);
        string userObjectId = context.AuthenticationTicket.Identity.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
        AuthenticationContext authContext = new AuthenticationContext(authority,new NaiveSessionCache(userObjectId));

        // If you create the redirectUri this way,it will contain a trailing slash.  
        // Make sure you've registered the same exact Uri in the Azure Portal (including the slash).
        Uri uri = new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path));
        AuthenticationResult result = await authContext.AcquireTokenByAuthorizationCodeAsync(code,uri,cred,"https://graph.windows.net");
    }

这将为您的令牌缓存提供可以传递给Graph API的代码.从这里开始,我们可以尝试使用Graph API进行身份验证.

string path = "https://graph.windows.net/me?api-version=1.6";
            string tenant = System.Configuration.ConfigurationManager.AppSettings["Tenant"];
            string userObjectId = ClaimsPrincipal.Current.FindFirst("http://schemas.microsoft.com/identity/claims/objectidentifier").Value;
            string resource = "https://graph.windows.net";
            AuthenticationResult result = null;  
            string authority = String.Format(System.Globalization.CultureInfo.InvariantCulture,System.Configuration.ConfigurationManager.AppSettings["Authority"],tenant);
            ClientCredential cc = new ClientCredential(ConfigurationManager.AppSettings["ClientId"],ConfigurationManager.AppSettings["ClientSecret"]);
            AuthenticationContext auth = new AuthenticationContext(authority,new NaiveSessionCache(userObjectId));
            try
            {
                result = await auth.AcquireTokenSilentAsync(resource,ConfigurationManager.AppSettings["ClientId"],new UserIdentifier(userObjectId,UserIdentifierType.UniqueId)).ConfigureAwait(false);
            }
            catch (AdalSilentTokenAcquisitionException e)
            {
                result = await auth.AcquireTokenAsync(resource,cc,new UserAssertion(userObjectId));

            }

获得身份验证令牌后,您可以通过Http Request将其传递给Graph API(这很容易).

HttpWebRequest request = (HttpWebRequest)HttpWebRequest.Create(path);
    request.Method = "GET";
    request.Headers.Set(HttpRequestHeader.Authorization,"Bearer " + result.AccessToken);
    WebResponse response = request.GetResponse();

    System.IO.Stream dataStream = response.GetResponseStream();

从这里开始,您有一个数据流,您可以将其传递到流读取器,从中获取JSON,并根据需要执行任何操作.就我而言,我只是在查找目录中的用户数据,但不包含在Azure AD身份验证中的默认声明中.所以在我的情况下,我正在调用的URL是

"https://graph.windows.net/me?api-version=1.6"

如果您需要对目录进行更深入的研究,我建议您使用Graph Explorer.这将帮助您构建API调用.再一次,我发现微软文档有点迟钝(如果你想看到一些光滑的东西,请查看Twilio API).但是一旦你弄明白,它实际上并没有那么糟糕.