do.net Web API - MSAL (Microsoft.Identity.Web) 注册多个身份验证提供程序

Question

I am developing a Web API and using the Microsoft.Identity.Web libraries for securing the APIs.

I have a scenario where different APIs / Controllers need to accept tokens issued by different Azure AD App Registrations

At the moment, I have something like this:

services.AddMicrosoftIdentityWebApiAuthentication(Configuration.GetSection("Api1"));

services.AddAuthorization(options =>
{
    options.DefaultPolicy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
        .Build();
});

...

//Controller1
[Authorize]
[ApiController]
public class Controller1 : ControllerBase
{...}

In the example Above, I use Api1 Configuration section to provide a ClientID / Tenant / Audience values for my Azure AD App registration.

I would like to be able to add another Authorization "rule" (?) in a way that I can configure Controller2 to accept tokens from a second App Registration:

services.AddMicrosoftIdentityWebApiAuthentication(Configuration.GetSection("Api1"));
services.AddMicrosoftIdentityWebApiAuthentication(Configuration.GetSection("Api2")); //this probably won't work as it will clobber the services instance?

services.AddAuthorization(options =>
{
    options.DefaultPolicy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme)
        .Build();
});

...

//Controller1
[Authorize] --- With Api1 settings?
[ApiController]
public class Controller1 : ControllerBase
{...}


//Controller2
[Authorize] --- With Api2 settings?
[ApiController]
public class Controller2 : ControllerBase
{...}

The requirements of why I need to use 2 different app registrations are outside of my scope and cannot change.

Currently, I solved this by creating 2 Web API projects / apps but it's come to a point where I really like to consolidate these if possible.

Answer 1

So, you can indeed register multiple Authentication profiles and you use the jwtBearerScheme as the differentiator when you want to validate against one or another.

For Authentication, you can define different authentication requirements for each of the schemes as follows:

services.AddMicrosoftIdentityWebApiAuthentication(
    Configuration.GetSection("Api1"),
    jwtBearerScheme: "Api1Scheme"
);
services.AddMicrosoftIdentityWebApiAuthentication(
    Configuration.GetSection("Api2"),
    jwtBearerScheme: "Api2Scheme"
); 

services.AddAuthorization(options =>
{
    options.AddPolicy("Api2Policy", new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .AddAuthenticationSchemes("Api2Scheme")
        .RequireRole("SomeRole")
        .Build());
    options.DefaultPolicy = new AuthorizationPolicyBuilder()
        .RequireAuthenticatedUser()
        .AddAuthenticationSchemes("Api1Scheme")
        .Build();
});

...

//Controller1
[Authorize] //Because ApiScheme1 is registered as the Default Authorization, no disambiguation needed here
[ApiController]
public class Controller1 : ControllerBase
{...}


//Controller2
[Authorize(AuthenticationSchemes = "Api2Scheme", Policy = "Api2Policy")] 
[ApiController]
public class Controller2 : ControllerBase
{...}