如何使用msal-node构建适配各类应用的通用认证库

问题描述 #

我正在使用@azure/msal-node开发认证库，但不同类型的应用对应特定的客户端类：例如ConfidentialClientApplication适用于Web应用、Web API、服务/守护程序；PublicClientApplication适用于桌面应用、无浏览器API、移动应用。请问是否可以开发一款适配各类应用的通用认证库？目前我测试的代码仅适配Web应用，无法覆盖非Web应用场景，代码如下：

class MicrosoftUserSigninController {
  async handle(request: Request, response: Response): Promise<void> {

    const confidentialClientConfig = {
      auth: {
        clientId: process.env.CLIENT_ID,
        authority: process.env.AUTHORITY,
        clientSecret: process.env.CLIENT_SECRET,
        redirectUri: process.env.REDIRECT_URI,
        scopes: ['user.read'],
        state: state,
      },
    };

    const confidentialClientApplication =
      new msal.ConfidentialClientApplication(confidentialClientConfig);

    const authCodeRequest = {
      redirectUri: confidentialClientConfig.auth.redirectUri,
      authority: confidentialClientConfig.auth.authority,
      scopes: confidentialClientConfig.auth.scopes,
      state: confidentialClientConfig.auth.state,
    };

    const getAuthCode = async (authority, scopes, state, res) => {
      console.log('Auth code: ');
      authCodeRequest.authority = authority;
      authCodeRequest.scopes = scopes;
      authCodeRequest.state = state;

      try {
        const authCodeUrl = await confidentialClientApplication.getAuthCodeUrl(
          authCodeRequest
        );
        console.log(`URL: ${authCodeUrl}`);
        res.redirect(authCodeUrl);
      } catch (error) {
        console.error('Error:', error);
        res.status(500).send(error.message || 'Error');
      }
    };

    await getAuthCode(
      confidentialClientConfig.auth.authority,
      confidentialClientConfig.auth.scopes,
      confidentialClientConfig.auth.state,
      response
    );

    const tokenRequest = {
      //code: code,
    
      redirectUri: confidentialClientConfig.auth.redirectUri,
      scopes: confidentialClientConfig.auth.scopes,
    };

    confidentialClientApplication
      .acquireTokenByCode(tokenRequest)
      .then((response) => {
        console.log('\nResponse: \n:', response);
      })
      .catch((error) => {
        console.log(error);
      });
  }
}

可行性分析 #

完全可以开发适配各类应用的通用认证库，核心思路是基于应用类型动态选择对应的MSAL客户端类，封装统一的认证接口，屏蔽不同客户端的实现差异。MSAL Node的两类客户端虽然API有所差异，但核心认证逻辑（令牌获取、刷新等）可抽象为通用流程，只需针对不同应用场景做针对性适配。

改造方案 #

1. 抽象通用配置与客户端工厂 #

先定义覆盖两类客户端的通用配置结构，再通过工厂函数根据应用类型创建对应客户端：

interface CommonAuthConfig {
  clientId: string;
  authority: string;
  scopes: string[];
}

interface ConfidentialClientConfig extends CommonAuthConfig {
  clientSecret: string;
  redirectUri: string;
}

interface PublicClientConfig extends CommonAuthConfig {
  redirectUri?: string; // 桌面应用可能用自定义协议作为redirectUri
}

type AuthConfig = ConfidentialClientConfig | PublicClientConfig;

class MsalClientFactory {
  static createClient(appType: 'confidential' | 'public', config: AuthConfig) {
    if (appType === 'confidential') {
      return new msal.ConfidentialClientApplication({
        auth: config as ConfidentialClientConfig
      });
    } else {
      return new msal.PublicClientApplication({
        auth: config as PublicClientConfig
      });
    }
  }
}

2. 封装统一的认证方法 #

针对不同认证流程（授权码流、设备码流、客户端凭证流等）封装通用方法，根据应用类型自动匹配合适流程：

class UniversalAuthLibrary {
  private client: msal.ConfidentialClientApplication | msal.PublicClientApplication;
  private appType: 'confidential' | 'public';
  private config: AuthConfig;

  constructor(appType: 'confidential' | 'public', config: AuthConfig) {
    this.appType = appType;
    this.config = config;
    this.client = MsalClientFactory.createClient(appType, config);
  }

  // 通用获取授权入口方法
  async getAuthorizationInitiation(options?: any) {
    if (this.appType === 'confidential') {
      const confidentialClient = this.client as msal.ConfidentialClientApplication;
      return confidentialClient.getAuthCodeUrl({
        redirectUri: (this.config as ConfidentialClientConfig).redirectUri,
        scopes: this.config.scopes,
        ...options
      });
    } else {
      const publicClient = this.client as msal.PublicClientApplication;
      const deviceCodeResult = await publicClient.acquireTokenByDeviceCode({
        scopes: this.config.scopes,
        ...options
      });
      // 返回设备码流的验证信息
      return {
        verificationUrl: deviceCodeResult.verificationUri,
        userCode: deviceCodeResult.userCode,
        deviceCodeResult
      };
    }
  }

  // 通用获取令牌方法
  async acquireToken(options?: any) {
    if (this.appType === 'confidential') {
      const confidentialClient = this.client as msal.ConfidentialClientApplication;
      if (options.code) {
        // 授权码流（Web应用回调用）
        return confidentialClient.acquireTokenByCode({
          code: options.code,
          redirectUri: (this.config as ConfidentialClientConfig).redirectUri,
          scopes: this.config.scopes,
          ...options
        });
      } else {
        // 客户端凭证流（服务/守护程序用）
        return confidentialClient.acquireTokenByClientCredential({
          scopes: this.config.scopes,
          ...options
        });
      }
    } else {
      const publicClient = this.client as msal.PublicClientApplication;
      if (options.deviceCodeResult) {
        // 设备码流（桌面/无浏览器应用用）
        return publicClient.acquireTokenByDeviceCode({
          scopes: this.config.scopes,
          deviceCodeResult: options.deviceCodeResult,
          ...options
        });
      } else if (options.username && options.password) {
        // 用户名密码流（内部桌面应用用）
        return publicClient.acquireTokenByUsernamePassword({
          username: options.username,
          password: options.password,
          scopes: this.config.scopes,
          ...options
        });
      }
    }
  }
}

3. 改造原有Web应用代码 #

将原Web应用控制器改为使用通用认证库，同时保留原有逻辑：

class MicrosoftUserSigninController {
  async handle(request: Request, response: Response): Promise<void> {
    // 初始化通用认证库（Web应用指定为confidential类型）
    const authLibrary = new UniversalAuthLibrary('confidential', {
      clientId: process.env.CLIENT_ID!,
      authority: process.env.AUTHORITY!,
      clientSecret: process.env.CLIENT_SECRET!,
      redirectUri: process.env.REDIRECT_URI!,
      scopes: ['user.read']
    });

    try {
      // 获取授权URL并跳转
      const authCodeUrl = await authLibrary.getAuthorizationInitiation({
        state: request.query.state || ''
      });
      response.redirect(authCodeUrl);

      // 回调阶段处理令牌获取（需在单独的回调路由中执行，此处仅为示例）
      if (request.query.code) {
        const tokenResponse = await authLibrary.acquireToken({
          code: request.query.code as string
        });
        console.log('令牌响应:', tokenResponse);
        // 后续业务逻辑处理
      }
    } catch (error) {
      console.error('认证错误:', error);
      response.status(500).send(error.message || '认证失败');
    }
  }
}

注意事项 #

• 流程差异处理：不同应用类型的认证流程差异显著（如Web应用用授权码流，桌面应用用设备码流），通用库需封装这些流程，给调用方暴露简洁接口。
• 配置校验：在工厂函数和通用方法中添加配置校验，确保不同应用类型传入符合要求的参数（如机密客户端必须传入clientSecret）。
• 状态管理：Web应用需处理state参数防范CSRF，桌面应用无需此操作，通用库可根据应用类型自动处理细节。

内容的提问来源于stack exchange，提问作者Simone