求助：.NET 8 API无法通过授权客户端JWT识别Azure AD用户，返回401

场景概述 #

我正尝试让登录到NextJS客户端应用（使用msal-react）的Azure Active Directory用户访问.NET 8 API的[Authorize]端点，但将客户端获取的JWT发送到API后，收到401响应，API日志显示DenyAnonymousAuthorizationRequirement。

已完成的配置 #

Azure应用注册 #

• 注册了两个应用：客户端应用和API应用
• 在API应用注册中暴露了API，创建access_as_user范围并授权客户端应用使用该范围，客户端注册中已确认这是一项委派权限

.NET 8 API配置 #

1. appsettings.json中的AzureAd配置

"AzureAd": {
  "Instance": "https://login.microsoftonline.com/",
  "Domain": "qualified.domain.name",
  "TenantId": "API-TENANT-ID",
  "ClientId": "API-CLIENT-ID",
  "Scopes": "access_as_user",
  "CallbackPath": "/signin-oidc"
},

2. Program.cs中的认证服务配置

...
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(config.GetSection("AzureAd"));
...
app.UseAuthorization();
app.UseAuthentication();
...

3. 控制器端点

[Controller]
[Route("api")]
public class GeneralController : Controller
{
    [Authorize]
    [HttpGet("get")]
    public Task<IActionResult> Test()
    {
        return Task.FromResult<IActionResult>(Ok());
    }
}

NextJS客户端配置 #

用户登录Azure AD后获取令牌的代码：

const { instance, accounts } = useMsal();
...
instance.acquireTokenSilent({
   scopes: [
     "api://API-CLIENT-ID/access_as_user",
   ],
     account: account,
})

客户端获取的JWT内容 #

解码后相关属性：

{
  "aud": "API-CLIENT-ID",
  "iss": "https://login.microsoftonline.com/CLIENT-TENANT-ID/v2.0",
  "azp": "CLIENT-CLIENT-ID",
  "name": "LOGGED-IN-USER-NAME",
  "scp": "access_as_user",
  "tid": "CLIENT-TENANT-ID",
  "ver": "2.0"
}

错误情况 #

将令牌放入请求的Authorization头调用端点时，收到401响应，API日志如下：

info: Microsoft.AspNetCore.Authorization.DefaultAuthorizationService[2]
      Authorization failed. These requirements were not met:
      DenyAnonymousAuthorizationRequirement: Requires an authenticated user.
info: Microsoft.AspNetCore.Authentication.JwtBearer.JwtBearerHandler[12]
      AuthenticationScheme: Bearer was challenged.

内容的提问来源于stack exchange，提问作者Griffin