使用服务主体凭据获取第三方应用的访问令牌

Question

我正在尝试在我的 AAD 租户中使用 Azure AD 服务主体来获取 Azure AD 应用程序代理服务的访问令牌，以用于注册新的连接器。服务主体在我的租户中具有执行此操作所需的权限。基本上我正在尝试采用以下代码来支持使用主体进行身份验证，而不是执行交互式身份验证流程。这将允许从安全存储中获取服务主体信息和秘密/证书并在自动化管道中使用。但是，我的技能已经用完了！有谁知道怎么做？

# Locate AzureAD PowerShell Module
 # Change Name of Module to AzureAD after what you have installed
 $AADPoshPath = (Get-InstalledModule -Name AzureAD).InstalledLocation
 # Set Location for ADAL Helper Library
 $ADALPath = $(Get-ChildItem -Path $($AADPoshPath) -Filter Microsoft.IdentityModel.Clients.ActiveDirectory.dll -Recurse ).FullName | Select-Object -Last 1

 # Add ADAL Helper Library
 Add-Type -Path $ADALPath

 #region constants

 # The AAD authentication endpoint uri
 [uri]$AadAuthenticationEndpoint = "https://login.microsoftonline.com/common/oauth2/token?api-version=1.0/" 

 # The application ID of the connector in AAD
 [string]$ConnectorAppId = "55747057-9b5d-4bd4-b387-abf52a8bd489"

 # The reply address of the connector application in AAD
 [uri]$ConnectorRedirectAddress = "urn:ietf:wg:oauth:2.0:oob" 

 # The AppIdUri of the registration service in AAD
 [uri]$RegistrationServiceAppIdUri = "https://proxy.cloudwebappproxy.net/registerapp"

 #endregion

 #region GetAuthenticationToken

 # Set AuthN context
 $authContext = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationContext" -ArgumentList $AadAuthenticationEndpoint

 # Build platform parameters
 $promptBehavior = [Microsoft.IdentityModel.Clients.ActiveDirectory.PromptBehavior]::Always
 $platformParam = New-Object "Microsoft.IdentityModel.Clients.ActiveDirectory.PlatformParameters" -ArgumentList $promptBehavior

 # Do AuthN and get token
 $authResult = $authContext.AcquireTokenAsync($RegistrationServiceAppIdUri.AbsoluteUri, $ConnectorAppId, $ConnectorRedirectAddress, $platformParam).Result

 # Check AuthN result
 If (($authResult) -and ($authResult.AccessToken) -and ($authResult.TenantId) ) {
 $token = $authResult.AccessToken
 $tenantId = $authResult.TenantId
 }
 Else {
 Write-Output "Authentication result, token or tenant id returned are null"
 }

 #endregion

我的尝试总是在 AcquireTokenAsync 步骤失败。

谢谢！

Answer 1

当你想使用秘密对 SP 进行身份验证时，你应该考虑使用 AuthenticationContext 的重载（参见文档here）：

public System.Threading.Tasks.Task<Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationResult> AcquireTokenAsync (string resource, Microsoft.IdentityModel.Clients.ActiveDirectory.ClientCredential clientCredential);

// Sample code
var authContext = new AuthenticationContext("<authority uri>");
var clientCreds = new ClientCredential("<app id associated to sp>", "<app secret>");
authContext.AcquireTokenAsync("<resource>", clientCreds);

另一方面，如果您想使用证书对 SP 进行身份验证，您应该考虑使用 AuthenticationContext 的这种重载（参见文档here）：

public System.Threading.Tasks.Task<Microsoft.IdentityModel.Clients.ActiveDirectory.AuthenticationResult> AcquireTokenAsync (string resource, Microsoft.IdentityModel.Clients.ActiveDirectory.IClientAssertionCertificate clientCertificate);

// Sample code
// fetch certificate first
var storeName = StoreName.My;
var storeLocation = StoreLocation.LocalMachine; // if cert lives in local machine store, code needs to run as administrator
string certName = "<my cert subject name>"; // e.g. "CN = myspcertficate"
X509Store store = new X509Store(storeName, storeLocation);
store.Open(OpenFlags.ReadOnly);
X509Certificate2Collection certCollection = store.Certificates;
X509Certificate2Collection signingCert = currentCerts.Find(X509FindType.FindBySubjectDistinguishedName, certName, false);
X509Certificate2 cert = signingCert.OfType<X509Certificate2>().OrderByDescending(c => c.NotBefore).FirstOrDefault();
store.Close();
if (cert != null)
{
    var authContext = new AuthenticationContext("<authority uri>");
    authContext.AcquireTokenAsync("<resource>", "<app id associated to sp>", cert);
}