新手求助：FastAPI集成Azure AD B2C认证的可行资源与示例

稳定运行的代码示例 #

依赖安装 #

先安装必备包：

pip install fastapi uvicorn python-jose[cryptography] python-dotenv

核心实现代码 #

from fastapi import FastAPI, Depends, HTTPException, status
from fastapi.security import OAuth2AuthorizationCodeBearer
from jose import JWTError, jwt
from dotenv import load_dotenv
import os

# 加载环境变量
load_dotenv()

# Azure AD B2C 配置参数
AZURE_B2C_TENANT = os.getenv("AZURE_B2C_TENANT")
AZURE_B2C_CLIENT_ID = os.getenv("AZURE_B2C_CLIENT_ID")
AZURE_B2C_POLICY = os.getenv("AZURE_B2C_POLICY")
ISSUER = f"https://{AZURE_B2C_TENANT}.b2clogin.com/{AZURE_B2C_TENANT}.onmicrosoft.com/{AZURE_B2C_POLICY}/v2.0/"
JWKS_URL = f"{ISSUER}discovery/v2.0/keys"

# 定义OAuth2认证流程
oauth2_scheme = OAuth2AuthorizationCodeBearer(
    authorizationUrl=f"https://{AZURE_B2C_TENANT}.b2clogin.com/{AZURE_B2C_TENANT}.onmicrosoft.com/{AZURE_B2C_POLICY}/oauth2/v2.0/authorize",
    tokenUrl=f"https://{AZURE_B2C_TENANT}.b2clogin.com/{AZURE_B2C_TENANT}.onmicrosoft.com/{AZURE_B2C_POLICY}/oauth2/v2.0/token",
)

app = FastAPI()

# Token验证核心函数
async def verify_token(token: str = Depends(oauth2_scheme)):
    auth_error = HTTPException(
        status_code=status.HTTP_401_UNAUTHORIZED,
        detail="凭证无效或已过期",
        headers={"WWW-Authenticate": "Bearer"},
    )
    try:
        # 获取并解析JWKS密钥
        header = jwt.get_unverified_header(token)
        jwks = jwt.get_jwks(JWKS_URL)
        key = next(k for k in jwks if k["kid"] == header["kid"])
        # 验证Token签名、发行方、受众等
        payload = jwt.decode(
            token,
            key,
            algorithms=["RS256"],
            issuer=ISSUER,
            audience=AZURE_B2C_CLIENT_ID,
            options={"verify_exp": True}
        )
        # 确保用户ID存在
        if not payload.get("oid"):
            raise auth_error
        return payload
    except (JWTError, StopIteration):
        raise auth_error

# 受保护路由示例
@app.get("/api/protected")
async def protected_endpoint(user_data: dict = Depends(verify_token)):
    return {"status": "authorized", "user": {"id": user_data["oid"], "email": user_data.get("emails", [""])[0]}}

# 公开路由示例
@app.get("/api/public")
async def public_endpoint():
    return {"status": "public", "message": "无需认证即可访问"}

环境变量配置 #

创建.env文件，填入你的Azure B2C信息：

AZURE_B2C_TENANT=你的租户名称（如xxx.onmicrosoft.com）
AZURE_B2C_CLIENT_ID=应用注册的客户端ID
AZURE_B2C_POLICY=用户流策略名称（如B2C_1_signup_signin）

启动应用 #

uvicorn main:app --reload

实用学习资源 #

• fastapi-azure-auth GitHub Issues：重点查看「Token突然失效」「策略配置错误」相关案例，大部分临时失效问题都源于JWKS缓存未更新或策略名称拼写错误
• FastAPI安全模块文档：吃透OAuth2认证的底层逻辑，能帮你快速定位第三方库的问题
• python-jose官方示例：学习JWT解析与验证的核心流程，避免依赖库时的黑盒困惑

内容的提问来源于stack exchange，提问作者Fabian