我一直在这里关注最近的 MS 项目示例：https://github.com/Azure-Samples/active-directory-aspnetcore-webapp-openidconnect-v2/tree/master/5-WebApp-AuthZ/5-1-Roles
我找不到 Razor 项目的任何示例，只有 MVC 移植了我认为支持使用 Azure AD 应用角色和使用与项目示例中相同的 AuthorizationPolicyBuilder 库进行授权所需的所有内容。
我通过更新应用清单文件并将用户分配给此 WebApp 所需的角色，在 Azure AD 中创建了一个应用角色。我相信我已经涵盖了 Azure 中所需的步骤，因为我可以清楚地看到所需的角色“ViewLogs”包含在成功登录后从 Azure 返回的 ID 令牌中。
问题是一个受“ViewLogs”授权策略保护的页面，每次我尝试加载该页面时都会给我一条拒绝访问消息。我不确定如何诊断它以了解为什么它不让我进入。
启动.cs
public void ConfigureServices(IServiceCollection services)
{
// Added to original .net core template.
// ASP.NET Core apps access the HttpContext through the IHttpContextAccessor interface and
// its default implementation HttpContextAccessor. It's only necessary to use IHttpContextAccessor
// when you need access to the HttpContext inside a service.
// Example usage - we're using this to retrieve the details of the currrently logged in user in page model actions.
services.AddHttpContextAccessor();
// DO NOT DELETE (for now...)
// This 'Microsoft.AspNetCore.Authentication.AzureAD.UI' library was originally used for Azure Ad authentication
// before we implemented the newer Microsoft.Identity.Web and Microsoft.Identity.Web.UI NuGet packages.
// Note after implememting the newer library for authetication, we had to modify the _LoginPartial.cshtml file.
//services.AddAuthentication(AzureADDefaults.AuthenticationScheme)
// .AddAzureAD(options => Configuration.Bind("AzureAd", options));
///////////////////////////////////
// Add services required for using options.
// e.g used for calling Graph Api from WebOptions class, from config file.
services.AddOptions();
// Add service for MS Graph API Service Client.
//services.AddTransient<OidcConnectEvents>();
// Sign-in users with the Microsoft identity platform
services.AddSignIn(Configuration);
// Token acquisition service based on MSAL.NET
// and chosen token cache implementation
services.AddWebAppCallsProtectedWebApi(Configuration, new string[] { Constants.ScopeUserRead })
.AddInMemoryTokenCaches();
// Add the MS Graph SDK Client as a service for Dependancy Injection.
services.AddGraphService(Configuration);
// The following lines code instruct the asp.net core middleware to use the data in the "roles" claim in the Authorize attribute and User.IsInrole()
// See https://docs.microsoft.com/aspnet/core/security/authorization/roles?view=aspnetcore-2.2 for more info.
services.Configure<OpenIdConnectOptions>(OpenIdConnectDefaults.AuthenticationScheme, options =>
{
// The claim in the Jwt token where App roles are available.
options.TokenValidationParameters.RoleClaimType = "roles";
});
// Adding authorization policies that enforce authorization using Azure AD roles. Polices defined in seperate classes.
services.AddAuthorization(options =>
{
options.AddPolicy(AuthorizationPolicies.AssignmentToUserReaderRoleRequired, policy => policy.RequireRole(AppRole.UserReaders));
options.AddPolicy(AuthorizationPolicies.AssignmentToViewLogsRoleRequired, policy => policy.RequireRole(AppRole.ViewLogs));
});
services.AddRazorPages().AddMvcOptions(options =>
{
var policy = new AuthorizationPolicyBuilder()
.RequireAuthenticatedUser()
.Build();
options.Filters.Add(new AuthorizeFilter(policy));
}).AddMicrosoftIdentityUI();
// Adds the service for creating the Jwt Token used for calling microservices.
// Note we are using our independant bearer token issuer service here, NOT Azure AD
services.AddScoped<JwtService>();
}
应用角色类.cs
/// <summary>
/// Contains a list of all the Azure AD app roles this app depends on and works with.
/// </summary>
public static class AppRole
{
/// <summary>
/// User readers can read basic profiles of all users in the directory.
/// </summary>
public const string UserReaders = "UserReaders";
/// <summary>
/// View Logs can review system logs and run all log queries.
/// </summary>
public const string ViewLogs = "ViewLogs";
}
/// <summary>
/// Wrapper class the contain all the authorization policies available in this application.
/// </summary>
public static class AuthorizationPolicies
{
public const string AssignmentToUserReaderRoleRequired = "AssignmentToUserReaderRoleRequired";
public const string AssignmentToViewLogsRoleRequired = "AssignmentToViewLogsRoleRequired";
}
我想访问的页面：
//[Authorize]
//[AllowAnonymous]
[Authorize(Policy = AuthorizationPolicies.AssignmentToViewLogsRoleRequired)] // Not working
public class IndexModel : PageModel
{
private readonly ILogger<IndexModel> _logger;
public readonly JwtService _jwtService;
public IndexModel(ILogger<IndexModel> logger, JwtService jwtService)
{
_logger = logger;
_jwtService = jwtService;
}
public void OnGet()
{
var username = HttpContext.User.Identity.Name;
var forename = HttpContext.User.Claims.FirstOrDefault(c => c.Type == ClaimTypes.GivenName)?.Value;
var surname = HttpContext.User.Claims.FirstOrDefault(c => c.Type == ClaimTypes.Surname)?.Value;
_logger.LogInformation("" + username + " requested the Index page");
}
public JsonResult OnGetJwtToken()
{
var token = _jwtService.GenerateSecurityToken();
return new JsonResult(token);
}
}
提前致谢...