Konfigurieren von Azure AD OAuth2 mithilfe von Node-Adal und OWIN?

Question

Wie kann ich das OWIN konfigurieren, um eine Access-Anfrage zu authentifizieren, die von Azure AD mithilfe von Node-Adal gesammelt wurde?

Startup-Klasse unter:

app.UseJwtBearerAuthentication(new JwtBearerAuthenticationOptions 
    { 
    AuthenticationMode = AuthenticationMode.Active, 
    AllowedAudiences = new [] 
    { 
     ConfigurationManager.AppSettings["ida:ClientId"] // AAD clientid from registered application 
    }, 
    IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[] 
    { 
     new SymmetricKeyIssuerSecurityTokenProvider(
     ConfigurationManager.AppSettings["ida:Issuer"], // https://sts.windows.net/<tenantid-guid>/ retrieved from AAD federationmetadata.xml 
     TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings["ida:ClientSecret"]) // AAD secret from registered application 
    ) 
    } 
    }); 

Token Antwort von Knoten-adal unten: implementation described here

{ 
    tokenType: "Bearer", 
    expiresIn: 3599, 
    expiresOn: "2016-10-19T13:49:47.649Z", 
    resource: "spn:00000002-0000-0000-c000-000000000000", 
    accessToken: "removed for brevity", 
    refreshToken: "removed for brevity", 
    userId: "user@domain.com", 
    isUserIdDisplayable: true, 
    familyName: "familyName", 
    givenName: "givenName", 
    identityProvider: "live.com", 
    oid: "oid-guid", 
    tenantId: "tenantid-guid" 
} 

Die accesstoken aus der obigen Knoten-adal Reaktion wird unter Verwendung von

gesendet

Authorization: Bearer accesstoken-here 

zu einem gesicherten Endpunkt ein [Authorize] Attribut, das

{"message":"Authorization has been denied for this request."} 

EDIT kehrt alter und neuer Ansatz zu zeigen, alte Werke - neu nicht

// this is new version (using clientsecret, aka AD web app) 
    var issuer = ConfigurationManager.AppSettings["ida:Issuer"]; 
    var secret = TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings["ida:ClientSecret"]); 
    app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions 
    { 
    AuthenticationMode = AuthenticationMode.Active, 
    AuthenticationType = OAuthDefaults.AuthenticationType, 
    Provider = new OAuthBearerAuthenticationProvider(), 
    AccessTokenFormat = new JwtFormat(
     new[] { ConfigurationManager.AppSettings["ida:ClientId"] }, 
     new IIssuerSecurityTokenProvider[] { new SymmetricKeyIssuerSecurityTokenProvider(issuer, secret) } 
    ) 
    }); 

    // this is old version (not using clientsecret, aka AD native app), this works but all my code is in the Angular Single Page app, I am trying to move the auth code into the node server to secure all access 
    app.UseWindowsAzureActiveDirectoryBearerAuthentication(new WindowsAzureActiveDirectoryBearerAuthenticationOptions 
    { 
    Tenant = ConfigurationManager.AppSettings["ida:Tenant"], 
    TokenValidationParameters = new TokenValidationParameters 
    { 
     ValidAudiences = new[] 
     { 
     ConfigurationManager.AppSettings["ida:AudienceImplicit"], 
     ConfigurationManager.AppSettings["ida:AudienceDaemon"] 
     } 
    } 
    }); 

Answer 1

Wir haben eine spezifische OWIN Middleware zum Validieren von Token von Azure AD:

app.UseWindowsAzureActiveDirectoryBearerAuthentication(
    new WindowsAzureActiveDirectoryBearerAuthenticationOptions 
    { 
     Audience = ConfigurationManager.AppSettings["ida:Audience"], 
     Tenant = ConfigurationManager.AppSettings["ida:Tenant"], 

    } 
); 

Weitere Informationen finden Sie in den .NET-Beispielen unter aka.ms/aaddev.