Azure B2C和令牌认证

Question

I'm creating some webapi in .NET Core with C# . I'm using Azure B2C as identity manager . When a user does the login, its application receives a token : I think it is a JWT .

How can I validate the token from my webapi against Azure B2C ? Can I refresh automatically this token before the expired date?

Answer 1

Could this be what you are looking for?: An ASP.NET Core 2.0 web API with Azure AD B2C

Basically you handle validation in ASP.NET Core with the JWT Bearer middleware:

services.AddAuthentication(options =>
  { 
    options.DefaultScheme = JwtBearerDefaults.AuthenticationScheme; 
  })
  .AddJwtBearer(jwtOptions =>
  {
    jwtOptions.Authority = $"https://login.microsoftonline.com/tfp/{Configuration["AzureAdB2C:Tenant"]}/{Configuration["AzureAdB2C:Policy"]}/v2.0/";
    jwtOptions.Audience = Configuration["AzureAdB2C:ClientId"];
    jwtOptions.Events = new JwtBearerEvents
    {
      OnAuthenticationFailed = AuthenticationFailed
    };
  });

...and validates scopres like this:

var scopes = HttpContext.User.FindFirst("http://schemas.microsoft.com/identity/claims/scope")?.Value;
  if (!string.IsNullOrEmpty(TheScope) && scopes != null && scopes.Split(' ').Any(s => s.Equals(TheScope)))
      // Do stuff
  else 
      // Unauthorized