MVC5 應用程序中來自 Azure ADB2C 的 AccessToken

Question

我們正在開發一個 MVC5 Web 應用程序，它使用 OpenIdConnect 對 Azure AD B2C 進行身份驗證。 當用戶通過身份驗證后，我們希望能夠從 Azure AD B2C 獲取訪問令牌，以便使用我們的 API。

這是我們的 Startup.cs 等效代碼：

protected override void ProcessCore(IdentityProvidersArgs args)
{
    Assert.ArgumentNotNull(args, nameof(args));

    List<B2CConfig> ssoSettings = _ssoConfigurationRepository.GetAllSettings();

    foreach (var config in ssoSettings)
    {
        args.App.UseOpenIdConnectAuthentication(CreateOptionsFromSiteConfig(config));
    }
}

private OpenIdConnectAuthenticationOptions CreateOptionsFromSiteConfig(B2CConfig config)
{
    OpenIdConnectAuthenticationOptions options = new OpenIdConnectAuthenticationOptions();
    options.MetadataAddress = string.Format(_aadInstance, _tenant, config.Policy);
    options.AuthenticationType = config.Policy;
    options.AuthenticationMode = AuthenticationMode.Passive;
    options.RedirectUri = config.AzureReplyUri;
    options.PostLogoutRedirectUri = config.LogoutRedirectUri;
    options.TokenValidationParameters = new TokenValidationParameters
    {
        NameClaimType = "emails"
    };

    var identityProvider = GetIdentityProvider();

    options.Notifications = new OpenIdConnectAuthenticationNotifications()
    {
        AuthenticationFailed = AuthenticationFailed,
        RedirectToIdentityProvider = notification =>
        {
            return Task.FromResult(notification.ProtocolMessage.UiLocales = config.UiLocale ?? string.Empty);
        },
        SecurityTokenValidated = notification =>
        {
            notification.AuthenticationTicket.Identity.AddClaim(new Claim("idp", "azureadb2c"));

            // transform all claims
            ClaimsIdentity identity = notification.AuthenticationTicket.Identity;
            notification.AuthenticationTicket.Identity.ApplyClaimsTransformations(new TransformationContext(FederatedAuthenticationConfiguration, identityProvider));

            return Task.CompletedTask;
        }
    };

    options.ClientId = config.ClientId;
    options.Scope = "openid";
    options.ResponseType = "id_token";

    return options;
}

private Task AuthenticationFailed(AuthenticationFailedNotification<OpenIdConnectMessage, OpenIdConnectAuthenticationOptions> notification)
{
    notification.HandleResponse();

    // Handle the error code that Azure AD B2C throws when trying to reset a password from the login page
    // because password reset is not supported by a "sign-up or sign-in policy"
    if (notification.ProtocolMessage.ErrorDescription != null && notification.ProtocolMessage.ErrorDescription.Contains("AADB2C90118"))
    {
        SsoLogger.Warn("User triggered reset password");
        notification.Response.Redirect(SsoConfiguration.Routes.ResetPassword);
    }
    else if (notification.Exception.Message == "access_denied")
    {
        notification.Response.Redirect("/");
    }
    else
    {
        SsoLogger.Warn("AuthenticationFailed", notification.Exception);
        notification.Response.Redirect(SsoConfiguration.Routes.LoginError);
    }

    return Task.FromResult(0);
}

在 Asp.Net 核心中，您似乎會在 HttpContext 上調用GetTokenAsync ，但該擴展方法在 .NET 4.72 中不可用。

任何人都可以幫助弄清楚如何從 AzureAD B2C 檢索可用於調用我們的 WebApi 的訪問令牌？ 或者我可以只存儲從 SecurityTokenValidated 事件中獲得的訪問令牌並將其用於所有 API 請求？

Answer 1

這是一個可能的解決方案： 將 access_token 存儲在用戶聲明中以獲得授權是否安全？

Notifications = new OpenIdConnectAuthenticationNotifications
{
    SecurityTokenValidated = notification =>
    {
        var identity = notification.AuthenticationTicket.Identity;
        identity.AddClaim(claim: new Claim(type: "auth_token", value: 
           notification.ProtocolMessage.AccessToken));
        return Task.CompletedTask;
    }
}

如果有人有更好的方法，我會很樂意接受另一個答案。