多种身份验证方案 JWT + Azure AD

Question

我正在尝试让双重身份验证方案与 Azure Ad 和常规 jwt 令牌一起使用，我遇到的问题是，我可以只使用 JWT 令牌访问这两个控制器功能，而不管方案如何。我尝试从这篇文章中设置我的配置，但它没有用（显然我当前的配置也没有）：

Authenticating tokens from multiple sources (e.g Cognito and Azure)

[HttpGet]
    [Authorize(AuthenticationSchemes = "TestBearer")]
    [Route("Test1")]
    public async Task Test()
    {

    }

    [HttpGet]
    [Authorize(AuthenticationSchemes = "AzureAd")]
    [Route("Test2")]
    public async Task Test2()
    {

    }

启动配置

services.AddAuthentication(options =>
                {
                    options.DefaultScheme = "AzureAd";
                })
                .AddJwtBearer("TestBearer", x =>
                {
                    x.RequireHttpsMetadata = false;
                    x.TokenValidationParameters = new Microsoft.IdentityModel.Tokens.TokenValidationParameters
                    {
                        ValidateIssuer = false,
                        ValidateAudience = false,
                        ValidateLifetime = false,
                        ValidateIssuerSigningKey = true,
                        IssuerSigningKey = new SymmetricSecurityKey(Guid.Parse(jwtConfig.SecretKey).ToByteArray())
                    };
                })
            .AddMicrosoftIdentityWebApi(x =>
            {
                x.Audience = config.Audience;
                x.Authority = config.Authority;
                x.RequireHttpsMetadata = false;
            },
            x =>
            {
                x.Instance = config.Instance;
                x.ClientId = config.ClientId;
                x.TenantId = config.TenantId;
                x.Authority = config.Authority;
                x.RequireHttpsMetadata = false;
            }, "AzureAd");
            services.AddAuthorization(options =>
            {
                var defaultAuthorizationPolicyBuilder = new AuthorizationPolicyBuilder(
           "TestBearer", "AzureAd");
                defaultAuthorizationPolicyBuilder =
            defaultAuthorizationPolicyBuilder.RequireAuthenticatedUser();
                options.DefaultPolicy = defaultAuthorizationPolicyBuilder.Build();
            });


            var scopes = new string[] { "https://graph.microsoft.com/.default" };

            IConfidentialClientApplication confidentialClientApplication = ConfidentialClientApplicationBuilder
                .Create(config.ClientId)
                .WithTenantId(config.TenantId)
                .WithClientSecret(config.ClientSecret)
                .Build();

            //Build the Microsoft Graph client.As the authentication provider, set an async lambda
            //  which uses the MSAL client to obtain an app-only access token to Microsoft Graph,
            // and inserts this access token in the Authorization header of each API request.
            var authenticationProvider = (new DelegateAuthenticationProvider(async (requestMessage) =>
                 {
                     // Retrieve an access token for Microsoft Graph (gets a fresh token if needed).
                     var authResult = await confidentialClientApplication
                          .AcquireTokenForClient(scopes)
                          .ExecuteAsync();

                     //// Add the access token in the Authorization header of the API request.
                     requestMessage.Headers.Authorization =
                          new AuthenticationHeaderValue("Bearer", authResult.AccessToken);
                 }));

            services.AddScoped(_ => new GraphServiceClient(authenticationProvider));

我的 jwt 令牌生成

private string GenerateToken(TestEntity entity)
        {
            var tokenHandler = new JwtSecurityTokenHandler();
            var key = Guid.Parse(_jwtSettings.SecretKey).ToByteArray();

            var tokenDescriptor = new SecurityTokenDescriptor
            {
                Subject = new ClaimsIdentity(new Claim[]{
                            new Claim(ClaimTypes.NameIdentifier, entity.Id.ToString()),
                            new Claim(ClaimTypes.MobilePhone, entity.Phone.ToString()),
                            new Claim(ClaimTypes.Email, entity.Email)
                        }),
                Expires = DateTime.UtcNow.AddHours(_jwtSettings.ExpiryTimeInHours),
                SigningCredentials = new SigningCredentials(new SymmetricSecurityKey(key), SecurityAlgorithms.HmacSha256Signature),

            Audience = "https://localhost:5001", 
             Issuer = _jwtSettings.Issuer,
            };

            var token = tokenHandler.CreateToken(tokenDescriptor);
            return tokenHandler.WriteToken(token);
        }

Answer 1

所以我最终分离了这些策略（将 azure AD 作为我的默认策略）并创建了一个额外的组合策略，以防我希望多个策略中的一个起作用。现在似乎一切正常。

services.AddAuthorization(options =>
            {
                options.AddPolicy("Test", policy =>
                {
                    policy.AuthenticationSchemes.Add("TestBearer");
                    policy.RequireAuthenticatedUser();
                });

            options.AddPolicy("AzureOrTest", policy =>
                {
                policy.AuthenticationSchemes.Add("TestBearer");
                    policy.AuthenticationSchemes.Add(JwtBearerDefaults.AuthenticationScheme);
                    policy.RequireAuthenticatedUser();
                });

                options.DefaultPolicy = new AuthorizationPolicyBuilder(JwtBearerDefaults.AuthenticationScheme)
                .RequireAuthenticatedUser()
                .Build();
            });