Azure B2C Active Directory OpenIDConnect 和授权代码

Question

我已经使用 OpenIDConnectAuthentication 设置了我的网络应用程序，如下所示。 OnAuthorizationCodeReceived 通知使用 Microsoft.IdentityModel.Clients.ActiveDirectory 3.13.8。

app.UseOpenIdConnectAuthentication(
    new OpenIdConnectAuthenticationOptions
    {
        MetadataAddress = Settings.AADB2CAuth.SignInPolicyMetaAddress, // https://login.microsoftonline.com/{tenant}/v2.0/.well-known/openid-configuration?p={policy} policy = B2C_1_SignIn
        AuthenticationType = Settings.AADB2CAuth.SignInPolicyId, // B2C_1_SignIn

        ClientId = Settings.AADB2CAuth.ClientId, // {guid}

        Notifications = new OpenIdConnectAuthenticationNotifications
        {
            AuthenticationFailed = OnAuthenticationFailed,
            AuthorizationCodeReceived = OnAuthorizationCodeReceived 
        },

        RedirectUri = Settings.AADB2CAuth.RedirectUri,

        Scope = "openid",
        ResponseType = "id_token",
    });

private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification context)
{
    var code = context.Code;
    ClientCredential clientCredential = new ClientCredential(Settings.AADB2CAuth.ClientId, Settings.AADB2CAuth.ClientSecret);
    string userObjectID = context.AuthenticationTicket.Identity.FindFirst(Settings.ClaimTypes.ObjectIdentifier).Value;

    string authority = Settings.AADB2CAuth.Authority; // https://login.microsoftonline.com/{tenant}

    AuthenticationContext authContext = new AuthenticationContext(authority, new ADAL.ADALTokenCache(userObjectID));

    Uri redirectUri = new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path));

    AuthenticationResult result = await authContext.AcquireTokenByAuthorizationCodeAsync(code, redirectUri, clientCredential, Settings.AADGraphApi.GraphResourceId);
}

这很好用。但是，id_token 不会返回授权代码。如果将其更改为code id_token 或只是code，则会触发AuthorizationCodeReceived 通知，但随后我会遇到错误

AADSTS70000：身份验证失败：授权代码格式错误或无效

基本上，我要做的是以当前登录用户的身份访问 B2C AD。这有可能吗？

---

我将身份验证选项更新为

new OpenIdConnectAuthenticationOptions
{
    AuthenticationType = Settings.AADB2CAuth.SignInPolicyId,
    Authority = string.Format("https://login.microsoftonline.com/tfp/{0}/{1}", Settings.AADB2CAuth.Tenant, Settings.AADB2CAuth.SignInPolicyId),
    ClientId = Settings.AADB2CAuth.ClientId,

    Notifications = new OpenIdConnectAuthenticationNotifications
    {
        AuthenticationFailed = OnAuthenticationFailed,
        AuthorizationCodeReceived = OnAuthorizationCodeReceived
    },

    RedirectUri = Settings.AADB2CAuth.RedirectUri,

    Scope = "openid",
    ResponseType = "code id_token",
});

private async Task OnAuthorizationCodeReceived(AuthorizationCodeReceivedNotification context)
{
    var code = context.Code;
    ClientCredential clientCredential = new ClientCredential(Settings.AADB2CAuth.ClientId, Settings.AADB2CAuth.ClientSecret);
    string userObjectID = context.AuthenticationTicket.Identity.FindFirst(Settings.ClaimTypes.ObjectIdentifier).Value;
    string authority = string.Format("https://login.microsoftonline.com/tfp/{0}/{1}", Settings.AADB2CAuth.Tenant, Settings.AADB2CAuth.SignInPolicyId);
    AuthenticationContext authContext = new AuthenticationContext(authority, new ADAL.ADALTokenCache(userObjectID));

    Uri redirectUri = new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path));

    AuthenticationResult result = await authContext.AcquireTokenByAuthorizationCodeAsync(code, redirectUri, clientCredential, Settings.AADGraphApi.GraphResourceId);
}

我现在遇到一个异常，其详细信息是 404 页面的 HTML 内容。查看请求，我认为这是因为 AcquireTokenByAuthorizationCodeAsync 正在查看 https://login.microsoftonline.com/tfp/oauth2/token 以将授权码发送到，我认为它不应该这样做？

---

值得注意的是，我得到的授权码标头如下：

{
  "kid": "cpimcore_09252015",
  "ver": "1.0"
}

在 Google 上对此进行快速搜索会产生 one result，这引用了 Android ADAL 上的 following issue。不过，我不确定这是否与我的问题有关。

Answer 1

如果你看一下这个错误的开头：

AADSTSXXXXXX

表示当您尝试交换身份验证码时，您转到的是 AAD sts，而不是预期的 B2C sts：

AADB2CXXXXX

这意味着您的身份验证代码发布请求被我们的端点错误地解释了。这通常是在 B2C 的 policy (p=B2C_1_xxxx) 参数被附加到帖子 URL 而不是请求内部时引起的。

选项 1： 重构您的代码和库使用，以将策略参数粘贴在身份验证代码发布请求中，而不是令牌端点 URL 的末尾。

选项 2： 使用备用令牌端点，不要添加任何 poliy 参数。您的新端点将如下所示

https://login.microsoftonline.com/tfp/{tenant}/B2C_1_myB2CPolicy/oauth2/v2.0/token