尝试激活图形 API 时无法解析类型“Microsoft.Identity.Web.ITokenAcquisition”的服务

Question

net core 2.2 project. I am implementing groups based authorization for my apis. I followed https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/886f2ad2bf6add922c7998fb592e3d4088f9cf4e/5-WebApp-AuthZ/5-2-Groups to implement this. First I added https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/886f2ad2bf6add922c7998fb592e3d4088f9cf4e/Microsoft.Identity.Web to my project. Then I started adding policy in my startup.cs as below.

services.AddAuthorization(options =>
            {
                options.AddPolicy("GroupsCheck", policy =>
                    policy.Requirements.Add(new GroupsCheckRequirement("2a39995a-8fd1-410e-99e2-11cf6046090d")));
            });

            services.AddScoped<IAuthorizationHandler, GroupsCheckHandler>();

Then I added GroupsCheckHandler.cs

public class GroupsCheckHandler : AuthorizationHandler<GroupsCheckRequirement>
    {
        private readonly ITokenAcquisition tokenAcquisition;
        private readonly IMSGraphService graphService;

        public GroupsCheckHandler(ITokenAcquisition tokenAcquisition, IMSGraphService MSGraphService)
        {
            this.tokenAcquisition = tokenAcquisition;
            this.graphService = MSGraphService;
        }
        protected override async Task HandleRequirementAsync(AuthorizationHandlerContext context,
                                                  GroupsCheckRequirement requirement)
        {
            string accessToken = await tokenAcquisition.GetAccessTokenOnBehalfOfUserAsync(new[] { Constants.ScopeUserRead, Constants.ScopeDirectoryReadAll });

            User me = await graphService.GetMeAsync(accessToken);

            IList<Group> groups = await graphService.GetMyMemberOfGroupsAsync(accessToken);

            var result = false;
            foreach (var group in groups)
            {
                if (requirement.groups.Equals(group.Id))
                {
                    result = true;
                }
            }

            if (result)
            {
                context.Succeed(requirement);
            }

        }
    }

Then I added authorize attribute in api as below.

[Authorize(Policy = "GroupsCheck")]
[Route("api/[controller]")]
[ApiController]

Now when ever I try to access any api I am getting below exception.

System.InvalidOperationException: Unable to resolve service for type 'Microsoft.Identity.Web.ITokenAcquisition' while attempting to activate 'LocationServicesAPI.Services.GroupsRequirements.GroupsCheckHandler'.

Can someone help me to figure out what might be the root cause of this issue or If I have done it wrongly or any configurations missing can someone help me in this regard. Any help would be greatly appreciated. Thanks

Answer 1

The dependency injection is trying to instantiate an instance of ITokenAcquisition and failing. This could be because of an issue with the configuration in Startup.cs. You need to ensure you have the calls to EnableTokenAcquisitionToCallDownstreamApi and AddInMemoryTokenCaches while configuring Authentication.

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddMicrosoftIdentityWebApi(Configuration, "AzureAd")
                .EnableTokenAcquisitionToCallDownstreamApi()
                .AddInMemoryTokenCaches();

Answer 2

You might have missed these lines on you Startup.cs :

services.AddSignIn(Configuration);

services.AddWebAppCallsProtectedWebApi(Configuration, new string[] { "YourApiScope" })
   .AddInMemoryTokenCaches(); // Or .AddDistributedTokenCaches(); depending on which token cache provider from Microsoft.Identity.Web you would like to use.

The DI registration for ITokenAcquisition happens inside AddWebAppCallsProtectedWebApi method, on Microsoft.Identity.Web.

Answer 3

我有一个几乎与使用 Blazor 类似的错误，并通过将 services.AddScoped() 更改为 services.AddHttpClient() 来解决它