C# &引用；授权失败。认证方案：AzureAdjwt持有人被质疑”；在ASP.NET Core 3.1 Web API中-401未经授权

我正在尝试使用Azure AD验证我的web api

我遵循这一点，并成功地使用Angular应用程序进行身份验证

问题是，当我将

Authorize

属性放入控制器时，我的角度控制台甚至邮递员都会出现

401 Unauthorized

错误

当我查看我的web api日志时，它显示如下：

这是我的

Startup.cs

public void ConfigureServices(IServiceCollection services)
{
    // removed because this doesn't work either
    // services.AddAuthentication(AzureADDefaults.BearerAuthenticationScheme)           
    //          .AddAzureADBearer(options => Configuration.Bind("AzureActiveDirectory", options));

    services.AddAuthentication(AzureADDefaults.JwtBearerAuthenticationScheme)
            .AddAzureADBearer(options => Configuration.Bind("AzureActiveDirectory", options));

    services.Configure<JwtBearerOptions>(AzureADDefaults.JwtBearerAuthenticationScheme, options =>
    {
                // This is a Microsoft identity platform web API.
        options.Authority += "/v2.0";
    });
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
   if (env.IsDevelopment())
   {
        app.UseDeveloperExceptionPage();
   }

   app.UseRouting();

   app.UseAuthentication();
   app.UseAuthorization();

   app.UseEndpoints(endpoints =>
   {
        endpoints.MapControllers();
   }
}

在我的应用程序客户端中，这是我的

App.module.ts

// MSAL Imports
import {
   MsalModule,
   MsalInterceptor,
   MSAL_CONFIG,
   MSAL_CONFIG_ANGULAR,
   MsalService,
   MsalAngularConfiguration
 } from '@azure/msal-angular';
import { Configuration } from 'msal';

// MSAL Configs
export const protectedResourceMap:[string, string[]][]=[['https://localhost:5000/', ['api://WEB-API-CLIENTID/api-access']] ];

const isIE = window.navigator.userAgent.indexOf("MSIE ") > -1 || window.navigator.userAgent.indexOf("Trident/") > -1;

function MSALAngularConfigFactory(): MsalAngularConfiguration {
   return {
     popUp: !isIE,
     consentScopes: [
       "user.read",
       "openid",
       "profile",
       "api://WEBAPI-CLIENT-ID/api-access"
     ],
     unprotectedResources: ["https://www.microsoft.com/en-us/"],
     protectedResourceMap,
     extraQueryParameters: {}
   };
 }

 function MSALConfigFactory(): Configuration {
   return {
     auth: {
       clientId: 'ANGULAR-CLIENT-ID',
       authority: "https://login.microsoftonline.com/TENANT-ID", /// with tenant id
       validateAuthority: true,
       redirectUri: "http://localhost:4200/",
       postLogoutRedirectUri: "http://localhost:4200/",
       navigateToLoginRequestUrl: true,
     },
     cache: {
       cacheLocation: "localStorage",
       storeAuthStateInCookie: isIE, // set to true for IE 11
     },
   };
 }

@NgModule({
   declarations: [
      AppComponent
   ],
   imports: [
      BrowserModule,
      AppRoutingModule,
      HttpClientModule,
      RouterModule.forRoot(appRoutes),
      NgHttpLoaderModule.forRoot(),

      FormsModule,
      // msal angular
      MsalModule
   ],
   providers: [
      {
         provide: HTTP_INTERCEPTORS,
         useClass: MsalInterceptor,
         multi: true
       },
       {
         provide: MSAL_CONFIG,
         useFactory: MSALConfigFactory
       },
       {
         provide: MSAL_CONFIG_ANGULAR,
         useFactory: MSALAngularConfigFactory
       },
       MsalService
   ],
   bootstrap: [
      AppComponent
   ]
})
export class AppModule { }

其他信息：我已经看到了这一点，但这无助于解决我的问题

---

我期待有人的帮助。

BeareAuthenticationScheme

Azure Active Directory B2C承载的默认方案。如果您正在使用，

addazureadb2cbeer（AuthenticationBuilder，Action）。如果有效，则应使用邮递员。请确保您在此处使用
授权
承载您的访问令牌

您应该期望postman中出现
200 Ok
。现在，在您的angular应用程序上尝试它。
您如何在前端获取令牌？令牌版本2是否在应用程序清单中？：）当您成功登录a.D.时，令牌会自动添加到本地存储中。因为我选中了“隐式授权”访问令牌和令牌Id的选项。我还删除了
startup.cs
中的版本2选项，它仍然是未经授权的。好的，您需要检查发送到的令牌。例如，检查访问群体（aud）是否符合API的预期。我在angularapp的clientid中看到的访问群体（在我使用jwt.ms之后）是我在active directory中注册的angularapp的clientid。我还在我的webpi广告的“授权客户端应用程序（公开API菜单）”中添加了angular应用程序的clientid，所以它应该匹配在一起，对吗？但是，我还是收到了“未经授权”的请求。@JokerBench访问者应该是您的webapi应用程序id，而不是您的angular应用程序id。请检查angular应用程序中同意范围的值。应该是这样的api://webapi_client_id/api-access
// MSAL Imports
import {
   MsalModule,
   MsalInterceptor,
   MSAL_CONFIG,
   MSAL_CONFIG_ANGULAR,
   MsalService,
   MsalAngularConfiguration
 } from '@azure/msal-angular';
import { Configuration } from 'msal';

// MSAL Configs
export const protectedResourceMap:[string, string[]][]=[['https://localhost:5000/', ['api://WEB-API-CLIENTID/api-access']] ];

const isIE = window.navigator.userAgent.indexOf("MSIE ") > -1 || window.navigator.userAgent.indexOf("Trident/") > -1;

function MSALAngularConfigFactory(): MsalAngularConfiguration {
   return {
     popUp: !isIE,
     consentScopes: [
       "user.read",
       "openid",
       "profile",
       "api://WEBAPI-CLIENT-ID/api-access"
     ],
     unprotectedResources: ["https://www.microsoft.com/en-us/"],
     protectedResourceMap,
     extraQueryParameters: {}
   };
 }

 function MSALConfigFactory(): Configuration {
   return {
     auth: {
       clientId: 'ANGULAR-CLIENT-ID',
       authority: "https://login.microsoftonline.com/TENANT-ID", /// with tenant id
       validateAuthority: true,
       redirectUri: "http://localhost:4200/",
       postLogoutRedirectUri: "http://localhost:4200/",
       navigateToLoginRequestUrl: true,
     },
     cache: {
       cacheLocation: "localStorage",
       storeAuthStateInCookie: isIE, // set to true for IE 11
     },
   };
 }

@NgModule({
   declarations: [
      AppComponent
   ],
   imports: [
      BrowserModule,
      AppRoutingModule,
      HttpClientModule,
      RouterModule.forRoot(appRoutes),
      NgHttpLoaderModule.forRoot(),

      FormsModule,
      // msal angular
      MsalModule
   ],
   providers: [
      {
         provide: HTTP_INTERCEPTORS,
         useClass: MsalInterceptor,
         multi: true
       },
       {
         provide: MSAL_CONFIG,
         useFactory: MSALConfigFactory
       },
       {
         provide: MSAL_CONFIG_ANGULAR,
         useFactory: MSALAngularConfigFactory
       },
       MsalService
   ],
   bootstrap: [
      AppComponent
   ]
})
export class AppModule { }


services.AddAuthentication(AzureADDefaults.BearerAuthenticationScheme)
            .AddAzureADBearer(options => Configuration.Bind("AzureActiveDirectory", options));