angular - 在Web API上验证Azure AD令牌的问题

我有2个Web应用程序。

• 站点A既是前端（Angular）也是用.NET Core编写的Web API。
• 站点B是用.NET核心编写的Web API。

两个站点中的Web API相同。身份验证是相同的。

测试1：当我要求站点A使用其自己的API来获取数据（在启用站点A的身份验证的情况下）时，它运行良好。

测试2：当我要求站点A使用站点B来获取数据（在站点B的身份验证已关闭的情况下）时，它的工作原理很好。

测试3：当我要求站点A使用站点B来获取数据（在站点B的身份验证处于打开状态）时，它失败，并显示未经授权的错误401。

这是我用来验证的代码...

services.AddAuthentication(options =>
{
    options.DefaultAuthenticateScheme = JwtBearerDefaults.AuthenticationScheme;
    options.DefaultChallengeScheme = JwtBearerDefaults.AuthenticationScheme;
})
.AddJwtBearer(o =>
{
    o.MetadataAddress = String.Format("https://login.microsoftonline.com/{0}/v2.0/.well-known/openid-configuration", Configuration["AzureAd:TenantId"]);
    o.Audience = Configuration["AzureAd:ClientId"];
});

所以...

I know the tokens are getting passed correctly (because of Test A).

I know the Site B API being called is accessible and correct (because of Test B).

Therefore, I assume, the issue is with the values being passed to Azure AD. I assume Azure doesn't think the tokens being obtained in Site A and validated in Site B (that have different URIs) are not "the same" and therefore not authorised.

What do I need to pass to Azure to get it to work?

Thanks

查看更多