使用 Azure Active Directory 和使用 Entity Framework 的 Azure SQL 验证 ASP.NET Core 2.1 Web API

Question

我已经在 Azure SQL 数据库上实现了 Azure AD 身份验证，并想为其编写一个使用相同 AD 身份验证的 Web API，但我需要将该身份验证从 Web API 传递到 Azure SQL 连接。我们还希望在这个项目中使用实体框架。

Web API 的 Startup 类中的 UseSqlServer 函数通过带有身份验证详细信息的连接字符串，因此我认为解决此问题的方法是根据通过 Web API 进行身份验证的用户以某种方式使连接动态化。

这是我们正在查看的更图形化的地图：

                |    azure active directory     |

                     ||                   ||
                     \/                   \/

client ------>  | web api | ------> | azure sql |

最好的方法是什么？

Answer 1

您是否考虑过使用令牌进行身份验证？您将找到一个示例应用程序here。

using Microsoft.IdentityModel.Clients.ActiveDirectory;
using System;
using System.Collections.Generic;
using System.ComponentModel.DataAnnotations;
using System.Data.Entity;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace TodoListService.DAL
{

    public class PerWebUserCache
    {
        [Key]
        public int EntryId { get; set; }
        public string webUserUniqueId { get; set; }
        public byte[] cacheBits { get; set; }
        public DateTime LastWrite { get; set; }
    }

    public class DbTokenCache : TokenCache
    {
        private TodoListServiceContext db = new TodoListServiceContext();
        string User;
        PerWebUserCache Cache;

        // constructor
        public DbTokenCache(string user)
        {
            // associate the cache to the current user of the web app
            User = user;

            this.AfterAccess = AfterAccessNotification;
            this.BeforeAccess = BeforeAccessNotification;
            this.BeforeWrite = BeforeWriteNotification;

            // look up the entry in the DB
            Cache = db.PerUserCacheList.FirstOrDefault(c => c.webUserUniqueId == User);
            // place the entry in memory
            this.Deserialize((Cache == null) ? null : Cache.cacheBits);
        }

        // clean up the DB
        public override void Clear()
        {
            base.Clear();
            foreach (var cacheEntry in db.PerUserCacheList.Where(u => u.webUserUniqueId == User).ToList())
                db.PerUserCacheList.Remove(cacheEntry);
            db.SaveChanges();
        }

        // Notification raised before ADAL accesses the cache.
        // This is your chance to update the in-memory copy from the DB, if the in-memory version is stale
        void BeforeAccessNotification(TokenCacheNotificationArgs args)
        {
            if (Cache == null)
            {
                // first time access
                Cache = db.PerUserCacheList.FirstOrDefault(c => c.webUserUniqueId == User);
            }
            else
            {   // retrieve last write from the DB
                var status = from e in db.PerUserCacheList
                                where (e.webUserUniqueId == User)
                                select new
                                {
                                    LastWrite = e.LastWrite
                                };
                // if the in-memory copy is older than the persistent copy
                if (status.First().LastWrite > Cache.LastWrite)
                //// read from from storage, update in-memory copy
                {
                    Cache = db.PerUserCacheList.FirstOrDefault(c => c.webUserUniqueId == User);
                }
            }
            this.Deserialize((Cache == null) ? null : Cache.cacheBits);
        }
        // Notification raised after ADAL accessed the cache.
        // If the HasStateChanged flag is set, ADAL changed the content of the cache
        void AfterAccessNotification(TokenCacheNotificationArgs args)
        {
            // if state changed
            if (this.HasStateChanged)
            {
                Cache = new PerWebUserCache
                {
                    webUserUniqueId = User,
                    cacheBits = this.Serialize(),
                    LastWrite = DateTime.Now
                };
                //// update the DB and the lastwrite                
                db.Entry(Cache).State = Cache.EntryId == 0 ? EntityState.Added : EntityState.Modified;                
                db.SaveChanges();
                this.HasStateChanged = false;
            }
        }
        void BeforeWriteNotification(TokenCacheNotificationArgs args)
        {
            // if you want to ensure that no concurrent write take place, use this notification to place a lock on the entry
        }
    }
}