Azure AD和Azure AD B2C令牌之間的區別

Question

我一直在努力研究Azure AD授權代碼流，並且突然開始將所有事情都轉移到Azure AD B2C，並且我遇到了Azure AD和Azure AD B2C之間的很多差異。有人可以回答我的問題。

1. 在天青AD當我們登記本機應用程序，它允許http或https作爲重定向網址。 Azure AD B2C不支持此功能（因爲遵循OAuth規範都應該表現相似）

2. Azure AD智能接入令牌具有x5c條目，其中B2C沒有此條目。任何特殊原因。我試圖從Azure AD複製公鑰並嘗試將相同的簽名密鑰上傳到B2C，但這不起作用。不知道我錯過了什麼，但我的問題是爲什麼這些訪問令牌的簽名不同。

Answer 1

對於第一個問題，如果您需要此功能，我建議您在此提出反饋from。

而對於第二個問題，驗證來自Azure AD B2C和普通Azure AD的令牌也是一樣的。我們可以使用指數（e）和模數（n）生成公鑰。 但是按鍵終點是不同的，我們需要使用像下面的鏈接來檢索Azure的AD B2C鍵：

https://login.microsoftonline.com/{tenant}/discovery/v2.0/keys?p={signInPolicy} 

下面是代碼來驗證通過Azure的AD B2C供您參考發佈的令牌：

static void Main(string[] args) 
{   
    var idtoken = ""; 

    var exponent = "AQAB"; 
    var modulus = ""; 
    var result= VerifyTokenDetails(idtoken, exponent, modulus); 
} 
private static bool VerifyTokenDetails(string idToken, string exponent, string modulus) 
{ 
    try 
    {    
     var parts = idToken.Split('.'); 
     var header = parts[0]; 
     var payload = parts[1]; 
     string signedSignature = parts[2]; 
     //Extract user info from payload 
     string userInfo = Encoding.UTF8.GetString(Base64UrlDecode(payload)); 
     //Which will be Verified 
     string originalMessage = string.Concat(header, ".", payload); 
     byte[] keyBytes = Base64UrlDecode(modulus); 
     string keyBase = Convert.ToBase64String(keyBytes); 
     string key = @"<RSAKeyValue> <Modulus>" + keyBase + "</Modulus> <Exponent>" + exponent + "</Exponent> </RSAKeyValue>"; 
     bool result = VerifyData(originalMessage, signedSignature, key); 
     if (result) 
      return true; 
     else 
      return false; 
    } 
    catch (Exception ex) { } 
    return false; 
} 

/// <summary> 
/// Verifies encrypted signed message with public key encrypted original message. 
/// </summary> 
/// <param name="originalMessage">Original message as string. (Encrypted form)</param> 
/// <param name="signedMessage">Signed message as string. (Encrypted form)</param> 
/// <param name="publicKey">Public key as XML string.</param> 
/// <returns>Boolean True if successful otherwise return false.</returns> 
private static bool VerifyData(string originalMessage, string signedMessage, string publicKey) 
{ 
    bool success = false; 
    using (var rsa = new RSACryptoServiceProvider()) 
    { 
     var encoder = new UTF8Encoding(); 
     byte[] bytesToVerify = encoder.GetBytes(originalMessage); 
     byte[] signedBytes = Base64UrlDecode(signedMessage); 
     try 
     { 

      rsa.FromXmlString(publicKey); 
      SHA256Managed Hash = new SHA256Managed(); 
      byte[] hashedData = Hash.ComputeHash(signedBytes); 
      // Summary: 
      //  Verifies that a digital signature is valid by determining the hash value in the 
      //  signature using the provided public key and comparing it to the hash value of 
      //  the provided data. 
      success = rsa.VerifyData(bytesToVerify, CryptoConfig.MapNameToOID("SHA256"), signedBytes); 
     } 
     catch (CryptographicException e) 
     { 
      success = false; 
     } 
     finally 
     { 
      rsa.PersistKeyInCsp = false; 
     } 
    } 
    return success; 
} 

private static byte[] Base64UrlDecode(string input) 
{ 
    var output = input; 
    output = output.Replace('-', '+'); // 62nd char of encoding 
    output = output.Replace('_', '/'); // 63rd char of encoding 
    switch (output.Length % 4) // Pad with trailing '='s 
    { 
     case 0: break; // No pad chars in this case 
     case 2: output += "=="; break; // Two pad chars 
     case 3: output += "="; break; // One pad char 
     default: throw new System.Exception("Illegal base64url string!"); 
    } 
    var converted = Convert.FromBase64String(output); // Standard base64 decoder 
    return converted; 
}