如何配置 Azure 应用服务（用于移动）和 B2C 身份验证以及访问 Azure SQL 数据库

Question

I have a xamarin.forms mobile App using Microsoft.WindowsAzure.MobileServices and Microsoft.Identity.Client. Using EasyAuth I successfully got the xamarin mobile app to post data to the AzureSQL tables linked via connection string in the App Service configuration section. I use the local and offline sync methods of MobileServiceClient. I then attempted to change to B2C authentication. I setup a Tenant and under this tenant registered a new App as a native client called "MobileB2C". Redirect URIs were added automatically. I then created the signinsignup UserFlows.

Back to the Azure App Service (Mobile) under Authentication section I added a provider and selected the B2C App, MobileB2C. I did not populate the "allowed token audiences" field and Azure automatically created Client secret setting name "MICROSOFT_PROVIDER_AUTHENTICATION_SECRET" and the issuer URL.

So when I run the xamarin mobile app I can login via azure B2C and I can see that the authResult returns the users correct info along with UserIdentifier,aud, iss, sub, oid etc.

Once authResult is returned the xamarin mobile then tries to use the sync methods of MobileServiceClient to save data to the AzureSQL table. Its at this point that it fails. When the line await mClient.SyncContext.PushAsync().ConfigureAwait(false); is hit an error occurs described as Microsoft.WindowsAzure.MobileServices.Sync.MobileServicePushStatus.CancelledByAuthentication . I continued to try and confirgure the Azure back end differently and now I no linger get the CancelledByAuthentication error but instead get Microsoft.WindowsAzure.MobileServices.Sync.MobileServicePushStatus.CancelledByNetworkError .

The relevant xamarin mobile app code to implement the authentication and AzureSQL table update is as follows;

private B2CAuthenticationService()
    {

        // default redirectURI; each platform specific project will have to override it with its own
        var builder = PublicClientApplicationBuilder.Create(B2CConstants.ClientID)
            .WithB2CAuthority(B2CConstants.AuthoritySignInSignUp)
            .WithIosKeychainSecurityGroup(B2CConstants.IOSKeyChainGroup)
            .WithRedirectUri($"msal{B2CConstants.ClientID}://auth");

        // Android implementation is based on https://github.com/jamesmontemagno/CurrentActivityPlugin
        // iOS implementation would require to expose the current ViewControler - not currently implemented as it is not required
        // UWP does not require this
        var windowLocatorService = DependencyService.Get<IParentWindowLocatorService>();

        if (windowLocatorService != null)
        {
            builder = builder.WithParentActivityOrWindow(() => windowLocatorService?.GetCurrentParentWindow());
        }

        _pca = builder.Build();
    }

    public async Task<UserContext> SignInAsync()
    {
        UserContext newContext;
        try
        {
            // acquire token silent
            newContext = await AcquireTokenSilent();
        }
        catch (MsalUiRequiredException)
        {
            // acquire token interactive
            newContext = await SignInInteractively();
        }
        return newContext;
    }
    private async Task<UserContext> SignInInteractively()
    {
        AuthenticationResult authResult = await _pca.AcquireTokenInteractive(B2CConstants.Scopes)
            .ExecuteAsync();

        var newContext = UpdateUserInfo(authResult);
        UserSingleton.Instance.UserId = newContext.UserIdentifier;
        return newContext;
    }

THe xamarin mobile app adds a record to the local database and then RefreshItemsAsync begins the synchronisation to the AzureSQL.

await azureService.AddUserSurveyAsync(newSurvey).ConfigureAwait(false); await azureService.RefreshItemsAsync(true).ConfigureAwait(false);

It is at the PushAsync line below that the the code fails.

    public async Task InitializeAsync()
        {
            using (await initializationLock.LockAsync())
            {
                if (!isInitialized)
                {
                    mClient = new MobileServiceClient(https://mobileservice.azurewebsites.net);

                    // Define the offline store.
                    mStore = new MobileServiceSQLiteStore("mobile3.db");
                    mStore.DefineTable<UserSurvey>();
                    await mClient.SyncContext.InitializeAsync(mStore, new MobileServiceSyncHandler()).ConfigureAwait(false);
                    UserSurveyTable = mClient.GetSyncTable<UserSurvey>();
                    isInitialized = true;
                }
            }
        }

    public async Task RefreshItemsAsync(bool syncItems)
    {
            if (syncItems)
            {
                await SynchronizeAsync().ConfigureAwait(false);
            }
    }

    public async Task SynchronizeAsync()
    {
        await InitializeAsync().ConfigureAwait(false);

        IReadOnlyCollection<MobileServiceTableOperationError> syncErrors = null;

        if (!CrossConnectivity.Current.IsConnected)
            return;

        try
        {
            await mClient.SyncContext.PushAsync().ConfigureAwait(false);
            await UserSurveyTable.PullAsync("usersurveys", UserSurveyTable.CreateQuery()).ConfigureAwait(false);
        }
        catch (MobileServicePushFailedException error)
        {
            if (error.PushResult != null)
            {
                foreach (var result in error.PushResult.Errors)
                {
                    await ResolveError(result);
                }
            }
        }
    }

What is wrong with the Azure back end configuration or perhaps I'm missing code as I can't understand how the xamarin mobile app can then attempt to communicate with the Azure Mobile App Service and AzureSQL as I don't send any token with those lines of code for PushAsync etc or perhaps this is abstracted away?

Here are images of the exceptions;

enter image description here

enter image description here

Answer 1

As promised, here is the succinct version of AAD authentication. For your purposes, B2C authentication is the same as AAD authentication.

There are two application definitions at play here - one for the mobile application (which basically says "this person is authenticated"), and one for the service (which says "a token authenticated for this mobile application can access this service"). So, you create an application ID for your mobile application, and an application ID for your service, and then you configure the service application ID to accept the mobile application.

The "WPF" tutorial for Azure Mobile Apps gives the general overview, although it's for WPF instead of Xamarin. The pieces you need are all the same.

The "WPF" tutorial here: https://docs.microsoft.com/en-us/azure/developer/mobile-apps/azure-mobile-apps/quickstarts/wpf/authentication