Azure移动应用程序和身份验证

Question

I have a Mobile App I am writing, at present it is simply the To Do Item list quick start application with custom Authentication added. I have the associated Xamarin Forms app.

From the App I am able to login using the LoginAsync method, my website returns a token and shows the username I am logging in as, but subsequent calls suggest I am not authorised.

After a bit of debugging, I can see that the request arrives at the web server with the X-ZUMO-AUTH header and the token in the value, but I can see that the User does not seem to be populated and the call to the GetAllTodoItems method is returned as 401:Unauthorized.

In the startup code for the website, the ConfigureMobileApp contains the following:

    app.UseWebApi(config);

    if (string.IsNullOrEmpty(settings.HostName))
    {
        // This middleware is intended to be used locally for debugging. By default, HostName will
        // only have a value when running in an App Service application.
        app.UseAppServiceAuthentication(new AppServiceAuthenticationOptions
        {
            SigningKey = ConfigurationManager.AppSettings["SigningKey"],
            ValidAudiences = new[] { ConfigurationManager.AppSettings["ValidAudience"] },
            ValidIssuers = new[] { ConfigurationManager.AppSettings["ValidIssuer"] },
            TokenHandler = config.GetAppServiceTokenHandler()
        });
    }

I have an account controller class:

[Route(".auth/login/custom")]
public class AccountController : ApiController
{
    private static string URL = "https://myapidev.azurewebsites.net/";
    private static string KEY = "FC31EB8CAAAAAA9D74EEE3613A7A08CA65CB1ACAA8CEFF82A5B5E915625B31D";

    public AccountController()
    {

    }
    [HttpPost]
    public IHttpActionResult Post([FromBody] LoginUser assertion)
    {
        if (isValidAssertion(assertion))
        {
            JwtSecurityToken token = AppServiceLoginHandler.CreateToken(new Claim[] { new Claim(JwtRegisteredClaimNames.Sub, assertion.username) },
                ConfigurationManager.AppSettings["SigningKey"],
                ConfigurationManager.AppSettings["ValidAudience"],
                ConfigurationManager.AppSettings["ValidIssuer"],
                TimeSpan.FromHours(24));

            return Ok(new LoginResult()
            {
                authenticationToken = token.RawData,
                user = new LoginResultUser() { userId = assertion.username }
            });
        }
        else // user assertion was not valid
        {
            return ResponseMessage(Request.CreateErrorResponse(HttpStatusCode.Unauthorized, "Invalid Request"));
        }
    }

    private bool isValidAssertion(LoginUser assertion)
    {
        return assertion != null;
    }
}

The TodoItemController contains the following:

[Authorize]
[MobileAppController]
public class TodoItemController : TableController<TodoItem>
{
    protected override void Initialize(HttpControllerContext controllerContext)
    {
        base.Initialize(controllerContext);
        EducaterAPIDevContext context = new EducaterAPIDevContext();
        DomainManager = new EntityDomainManager<TodoItem>(context, Request);

        //// Get the SID of the current user.
        //var claimsPrincipal = this.User as ClaimsPrincipal;
        //string sid = claimsPrincipal.FindFirst(ClaimTypes.NameIdentifier).Value;
    }

    // GET tables/TodoItem
    public IQueryable<TodoItem> GetAllTodoItems()
    {
        return Query();
    }
    ...
    ...
}

On calling the query method from the Xamarin App, it returns with 401 even though the X-ZUMO-AUTH is in the headers and contains the correct token issued by the login method.

Have I missed something or has anyone come across this issue before - any help would be appreciated?

Answer 1

Have you turned on Authentication/Authorization in your App Service? Without it, the token will never be decoded.

This is the most common issue.

Answer 2

After digging I found the issue, initially there was a configuration issue - the above comments helped thanks. The Audiences and Issuers must match your azure site including including the trailing slash.

The issue once the configuration had been corrected was that the token which is passed correctly from my App did not get processed at the server side so all Authorized areas where out-of-bounds. This was because of the order of calls in the ConfigureMobileApp method. I was calling the app.UseWebApi method before the app.UseAppServiceAuthentication method, changing the order suddenly had the token being tested again.

The dummy site I have working now has the following:

    public static void ConfigureMobileApp(IAppBuilder app)
    {
        HttpConfiguration config = new HttpConfiguration();

        //For more information on Web API tracing, see http://go.microsoft.com/fwlink/?LinkId=620686 
        SystemDiagnosticsTraceWriter traceWriter = config.EnableSystemDiagnosticsTracing();

        new MobileAppConfiguration()
            .UseDefaultConfiguration()
            .MapApiControllers()
            .ApplyTo(config);

        config.MapHttpAttributeRoutes();

        // Use Entity Framework Code First to create database tables based on your DbContext
        //Database.SetInitializer(new EducaterAPIDevInitializer());

        // To prevent Entity Framework from modifying your database schema, use a null database initializer
        // Database.SetInitializer<EducaterAPIDevContext>(null);

        MobileAppSettingsDictionary settings = config.GetMobileAppSettingsProvider().GetMobileAppSettings();
        if (string.IsNullOrEmpty(settings.HostName))
        {
            var options = new AppServiceAuthenticationOptions
            {
                SigningKey = ConfigurationManager.AppSettings["SigningKey"],
                ValidAudiences = new[] { ConfigurationManager.AppSettings["ValidAudience"] },
                ValidIssuers = new[] { ConfigurationManager.AppSettings["ValidIssuer"] },
                TokenHandler = config.GetAppServiceTokenHandler()
            };
            app.UseAppServiceAuthentication(options);
        }
        app.UseWebApi(config);
    }