无法在Swagger中进行身份验证

Question

Hi I have developed web application in .net core. I registered two application in azure ad. One for my web api and one for my swagger. As per http://www.sharepointconfig.com/2018/08/configure-swagger-to-authenticate-against-azure-ad/ We need to add api access in swagger to communicate with web api. But whenever I try to add permission in azure portal I dont see my web api app. I am not sure I do not see my web app to give api access. Next Whenever I click on authorize in swagger I get error message The client has requested access to a resource which is not listed in the requested permissions in the client's application registration. Below is error screen shot.

Below is code.

services.AddSwaggerGen(c =>
            {
                c.SwaggerDoc("v1", new Info { Title = "My API", Version = "v1" });
                c.AddSecurityDefinition("oauth2", new OAuth2Scheme
                {
                    Type = "oauth2",
                    Flow = "implicit",
                    AuthorizationUrl = "https://login.microsoftonline.com/8b95-448d-b259-98a44d112f7c/oauth2/authorize",
                    Scopes = new Dictionary<string, string>
                    {
                       { "openid", "Sign In Permissions" },
                       { "profile", "User Profile Permissions" } },
                    TokenUrl = "https://login.microsoftonline.com/98a44d112f7c/oauth2/token"
                });
            });

In configure,

 app.UseSwaggerUI(c =>
            {
                c.OAuthClientId(Configuration["Swagger:ClientId"]);
                c.OAuthClientSecret(Configuration["Swagger:ClientSecret"]);
                c.OAuthRealm(Configuration["AzureAD:ClientId"]);
                c.OAuthAppName("My API V1");
                c.OAuthScopeSeparator(" ");
                c.OAuthAdditionalQueryStringParams(new { resource = Configuration["AzureAD:ClientId"] });
                c.SwaggerEndpoint("/swagger/v1/swagger.json", "My API V1");
            });

May I know how can I fix the above issue? Can someone help me to find this issue? Any help would be appreciated. Thanks

Answer 1

One thing that is different in one of my apps is that we define the additional query parameters with a dictionary:

options.OAuthAdditionalQueryStringParams(new Dictionary<string, string>
{
    ["resource"] = _configuration["SwaggerUi:ApiResourceUri"]
});

But that's probably not the reason for the issue. You need to find the Swagger app registration in Azure AD, identified by the client id you have in Configuration["Swagger:ClientId"] . There you need to go to API permissions, and add all of the delegated permissions defined by your API.

If you haven't defined any scopes, find the app registration for your API and open the Expose an API tab. Guide for adding scopes: https://docs.microsoft.com/en-us/azure/active-directory/develop/scenario-protected-web-api-app-registration#exposing-delegated-permissions-scopes

Also, technically you don't need to specify scopes, since you are using the v1 endpoint.