Azure AD B2C - 角色管理

Question

Azure AD B2C - 角色管理

c#asp.net-mvcazureasp.net-mvc-5azure-ad-b2c

28

我有一个连接到Azure AD B2C的Asp.NET MVC应用程序。

在管理员设置中，我创建了一个管理员组：

在我的代码中，我想使用[Authorize(Roles = "Administrator")]

对于常规的Azure Active Directory，添加很容易（只需3行代码）。但是对于Azure AD B2C，我找不到任何可行的教程或示例。也许您可以告诉我需要修改什么。

这是我的Startup.Auth.cs的ConfigureAuth方法：

public void ConfigureAuth(IAppBuilder app)
{
    app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);

    app.UseCookieAuthentication(new CookieAuthenticationOptions());

    app.UseOpenIdConnectAuthentication(
        new OpenIdConnectAuthenticationOptions
        {
            // Generate the metadata address using the tenant and policy information
            MetadataAddress = String.Format(AadInstance, Tenant, DefaultPolicy),

            // These are standard OpenID Connect parameters, with values pulled from web.config
            ClientId = ClientId,
            RedirectUri = RedirectUri,
            PostLogoutRedirectUri = RedirectUri,

            // Specify the callbacks for each type of notifications
            Notifications = new OpenIdConnectAuthenticationNotifications
            {
                RedirectToIdentityProvider = OnRedirectToIdentityProvider,
                AuthorizationCodeReceived = OnAuthorizationCodeReceived,
                AuthenticationFailed = OnAuthenticationFailed,
            },

            // Specify the claims to validate
            TokenValidationParameters = new TokenValidationParameters
            {
                NameClaimType = "name"
            },

            // Specify the scope by appending all of the scopes requested into one string (separated by a blank space)
            Scope = $"openid profile offline_access {ReadTasksScope} {WriteTasksScope}"
        }
    );
}

- DarkWing89

1个回答

网页内容由stack overflow 提供, 点击上面的

可以查看英文原文，
原文链接

- Saca · Accepted Answer

Azure AD B2C尚未在发送到应用程序的令牌中包含组声明，因此您无法像在Azure AD中一样遵循您描述的相同方法（后者在令牌中包含组声明）。

您可以通过在Azure AD B2C反馈论坛中投票来支持此功能请求：Get user membership groups in the claims with Azure AD B2C

话虽如此，您可以在此应用程序中进行一些额外的工作，以手动检索这些组声明并将它们注入令牌中。

首先，注册另一个应用程序，该应用程序将调用Microsoft Graph以检索组声明。

前往https://apps.dev.microsoft.com
创建具有Application Permissions:Directory.Read.All的应用程序。
点击Generate new password添加应用程序秘密。
添加平台并选择Web，在其中提供任何重定向URI（例如https://yourtenant.onmicrosoft.com/groups）。
同意此应用程序，导航至：https://login.microsoftonline.com/YOUR_TENANT.onmicrosoft.com/adminconsent?client_id=YOUR_CLIENT_ID&state=12345&redirect_uri=YOUR_REDIRECT_URI

然后，您将需要在OnAuthorizationCodeReceived处理程序内添加以下代码，在兑换代码之后：

var authority = $"https://login.microsoftonline.com/{Tenant}";
var graphCca = new ConfidentialClientApplication(GraphClientId, authority, GraphRedirectUri, new ClientCredential(GraphClientSecret), userTokenCache, null);
string[] scopes = new string[] { "https://graph.microsoft.com/.default" };

try
{
    AuthenticationResult authenticationResult = await graphCca.AcquireTokenForClientAsync(scopes);
    string token = authenticationResult.AccessToken;

    using (var client = new HttpClient())
    {
        string requestUrl = $"https://graph.microsoft.com/v1.0/users/{signedInUserID}/memberOf?$select=displayName";

        HttpRequestMessage request = new HttpRequestMessage(HttpMethod.Get, requestUrl);
        request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", token);

        HttpResponseMessage response = await client.SendAsync(request);
        var responseString = await response.Content.ReadAsStringAsync();

        var json = JObject.Parse(responseString);

        foreach (var group in json["value"])
            notification.AuthenticationTicket.Identity.AddClaim(new System.Security.Claims.Claim(System.Security.Claims.ClaimTypes.Role, group["displayName"].ToString(), System.Security.Claims.ClaimValueTypes.String, "Graph"));

        //TODO: Handle paging. 
        // https://developer.microsoft.com/en-us/graph/docs/concepts/paging
        // If the user is a member of more than 100 groups, 
        // you'll need to retrieve the next page of results.
    }
} catch (Exception ex)
{
    //TODO: Handle
    throw;
}