如何在使用JWT令牌保護asp.net核心Web API時從Azure AD獲取用戶

Question

我在React JS中擁有.net核心Web API和SPA客戶端。我想允許用戶使用在Azure AD中註冊的電子郵件從客戶端登錄，並使用JWT令牌保護我的web api。我嘗試使用簡單的硬編碼用戶名和密碼生成令牌，但我不知道如何從Azure AD獲取用戶並生成JWT令牌。

這裏是我的JWTController：

[Route("api/[controller]")] 
public class JwtController : Controller 
{ 
    private readonly JwtIssuerOptions _jwtOptions; 
    private readonly ILogger _logger; 
    private readonly JsonSerializerSettings _serializerSettings; 

    public JwtController(IOptions<JwtIssuerOptions> jwtOptions, ILoggerFactory loggerFactory) 
    { 
     _jwtOptions = jwtOptions.Value; 
     ThrowIfInvalidOptions(_jwtOptions); 

     _logger = loggerFactory.CreateLogger<JwtController>(); 

     _serializerSettings = new JsonSerializerSettings 
     { 
      Formatting = Formatting.Indented 
     }; 
    } 

    [HttpPost] 
    [AllowAnonymous] 
    public async Task<IActionResult> Get([FromForm] string Username, string Password) 
    { 
     var applicationUser = new ApplicationUser(); 
     applicationUser.UserName = Username; 
     applicationUser.Password = Password; 
     var identity = await GetClaimsIdentity(applicationUser); 
     if (identity == null) 
     { 
      _logger.LogInformation($"Invalid username({applicationUser.UserName}) or password ({applicationUser.Password})"); 
      return BadRequest("Invalid credentials"); 
     } 

     var claims = new[] 
     { 
      new Claim(JwtRegisteredClaimNames.Sub, applicationUser.UserName), 
      new Claim(JwtRegisteredClaimNames.Jti, await _jwtOptions.JtiGenerator()), 
      new Claim(JwtRegisteredClaimNames.Iat, 
       ToUnixExpochDate(_jwtOptions.IssuedAt).ToString(), 
       ClaimValueTypes.Integer64), 
      identity.FindFirst("Disney") 
     }; 

     //Create the JWT security token and encode it. 
     var jwt = new JwtSecurityToken(
      issuer: _jwtOptions.Issuer, 
      audience: _jwtOptions.Audience, 
      claims:claims, 
      notBefore:_jwtOptions.NotBefore, 
      expires:_jwtOptions.Expiration, 
      signingCredentials:_jwtOptions.SigningCredentials); 

     var encodedJwt = new JwtSecurityTokenHandler().WriteToken(jwt); 

     //Serialize and return the response. 
     var response = new 
     { 
      access_token = encodedJwt, 
      expires_in = (int)_jwtOptions.ValidFor.TotalSeconds 
     }; 

     var json = JsonConvert.SerializeObject(response, _serializerSettings); 
     return new OkObjectResult(json); 
    } 

    private static void ThrowIfInvalidOptions(JwtIssuerOptions options) 
    { 
     if (options == null) throw new ArgumentNullException(nameof(options)); 

     if (options.ValidFor <= TimeSpan.Zero) 
     { 
      throw new ArgumentException("Must be a non-zero TimeSpan.", nameof(JwtIssuerOptions.ValidFor)); 
     } 

     if (options.SigningCredentials == null) 
     { 
      throw new ArgumentNullException(nameof(JwtIssuerOptions.SigningCredentials)); 
     } 

     if (options.JtiGenerator == null) 
     { 
      throw new ArgumentNullException(nameof(JwtIssuerOptions.JtiGenerator)); 
     } 
    } 

    private static long ToUnixExpochDate(DateTime date) 
     => (long)Math.Round((date.ToUniversalTime() - 
      new DateTimeOffset(1970, 1, 1, 0, 0, 0, TimeSpan.Zero)) 
      .TotalSeconds); 

    private Task<ClaimsIdentity> GetClaimsIdentity(ApplicationUser user) 
    { 
     if (user.UserName == "mickey" && user.Password == "mouse") 
     { 
      return Task.FromResult(new ClaimsIdentity(
       new GenericIdentity(user.UserName, "Token"), 
       new[] 
       { 
        new Claim("Disney", "mickey") 
       })); 
     } 

     if (user.UserName == "notmickey" && user.Password == "mouse") 
     { 
      return Task.FromResult(new ClaimsIdentity(
       new GenericIdentity(user.UserName, "Token"), 
       new Claim[] { })); 
     } 

     return Task.FromResult<ClaimsIdentity>(null); 
    } 
} 

人有一個想法如何實現這一點？

Answer 1

我想你已經有點倒退了。

您的React客戶端應該重定向到Azure AD登錄頁面，然後從Azure AD獲取JWT 以調用您的API。然後你的API只需要驗證傳入的令牌併爲請求建立一個用戶標識。在ASP.NET Core中有現成的組件。使用Adal.js與之反應的

一個例子：https://blog.mastykarz.nl/building-office-365-web-applications-react/

在ASP.NET MVC核心API Azure的AD V2使用示例：https://contos.io/protecting-a-net-core-api-with-azure-active-directory-59bbcd5b3429