C# 通过Azure AD应用程序代理从客户端发出的请求中缺少授权标头

我面临一个问题，客户端应用程序通过Azure Active Directory应用程序代理向REST web服务发出的HTTP请求中缺少带有承载令牌的授权标头

web服务托管在内部部署中，客户端应用程序使用Azure AD应用程序代理URL从internet进行消费，并根据ADF对请求进行身份验证。身份验证头是在向Azure AD应用程序代理URL发送请求时添加的，我猜它已被代理连接器删除

请在下面找到请求内容并提供帮助。如何在对应用程序代理的原始请求中包含验证器标头

GET /TimelogSvc/rest/Timelog/GetTimeLog?EmailId=John@BizNext.com.sg&Fromdate=2019-04-21&Todate=2019-04-27 HTTP/1.1
Connection: Keep-Alive
Host: agileuat.BizNext.com.sg
X-Forwarded-For: 203.126.130.140
X-MS-Proxy: AzureAD-Application-Proxy
OS-Host: agileuat.BizNext.com.sg
OS-Path: /TimelogSvc
OS-Pta: /rest/Timelog
OS-Page: /GetTimeLog?EmailId=John08@BizNext.com.sg&Fromdate=2019-04-21&Todate=2019-04-27

请同时查看我的客户代码

AuthenticationContext authContext = new AuthenticationContext(authority + tenantID);
HttpClient httpClient = new HttpClient();
string s = string.Empty;

result = await authContext.AcquireTokenAsync(resourceUri, clientId, new Uri(redirectUri), new PlatformParameters(PromptBehavior.Auto));

// Append the token as bearer in the request header.
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);

// Call the API.
HttpResponseMessage response = await httpClient.GetAsync("https://timelogapitest-BizNext.msappproxy.net/TimelogSvc/rest/Timelog/GetTimeLog?EmailId=John@bizNext.com.sg&Fromdate=2019-04-21&Todate=2019-04-27");

s = await response.Content.ReadAsStringAsync();

---

移动应用程序

我通过在自定义头中包含访问令牌（第二次）解决了这个问题。这假设您可以控制后端，以便可以读取该自定义标头。如有必要，您甚至可以将其写入后端的AuthHeader中，以确保正常的授权流

            HttpClient client = new HttpClient();
            HttpRequestMessage message = new HttpRequestMessage(HttpMethod.Get, "API/URL/GoesHere");
            // Add token to authentication header as per usual
            message.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
            // Custom header containing the token a second time.
            // Name if whatever you like, just make sure you look for the
            // exact name on the backend
            message.Headers.Add("JwtAccessToken", token);
            HttpResponseMessage response = await client.SendAsync(message);
            string responseString = await response.Content.ReadAsStringAsync();

网络客户端

这似乎现在起作用了：

---

移动应用程序

我通过在自定义头中包含访问令牌（第二次）解决了这个问题。这假设您可以控制后端，以便可以读取该自定义标头。如有必要，您甚至可以将其写入后端的AuthHeader中，以确保正常的授权流

            HttpClient client = new HttpClient();
            HttpRequestMessage message = new HttpRequestMessage(HttpMethod.Get, "API/URL/GoesHere");
            // Add token to authentication header as per usual
            message.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
            // Custom header containing the token a second time.
            // Name if whatever you like, just make sure you look for the
            // exact name on the backend
            message.Headers.Add("JwtAccessToken", token);
            HttpResponseMessage response = await client.SendAsync(message);
            string responseString = await response.Content.ReadAsStringAsync();

网络客户端

这似乎现在起作用了：

---

您好，您找到问题的解决方案了吗？您好，您找到问题的解决方案了吗？