如何在跨平台Java程序中为SignalR连接添加Azure BC2认证？

依赖准备 #

添加必要的Maven依赖（Gradle可对应转换），包含SignalR Java客户端和跨平台Azure认证库MSAL4J：

<dependencies>
    <!-- ASP.NET Core SignalR Java Client -->
    <dependency>
        <groupId>com.microsoft.signalr</groupId>
        <artifactId>signalr</artifactId>
        <version>7.0.15</version>
    </dependency>
    <!-- MSAL4J for Azure AD B2C cross-platform authentication -->
    <dependency>
        <groupId>com.microsoft.azure.msal4j</groupId>
        <artifactId>msal4j</artifactId>
        <version>1.24.0</version>
    </dependency>
</dependencies>

实现B2C令牌获取逻辑 #

编写通用方法通过用户名密码流获取Azure AD B2C访问令牌，该逻辑无平台依赖：

private static String getB2CAccessToken(String tenantId, String clientId, String username, String password, String userFlow, String signalRHubUrl) throws Exception {
    // 构造B2C认证权威地址
    String authority = String.format("https://%s.b2clogin.com/%s/%s/v2.0/", tenantId.split("\\.")[0], tenantId, userFlow);
    
    // 定义SignalR Hub的权限作用域，格式为<Hub地址>/.default
    Set<String> scopes = Collections.singleton(signalRHubUrl + "/.default");
    
    // 初始化MSAL客户端
    PublicClientApplication pca = PublicClientApplication.builder(clientId)
            .authority(authority)
            .build();
    
    // 组装用户名密码认证参数
    UserNamePasswordParameters parameters = UserNamePasswordParameters
            .builder(scopes, username, password.toCharArray())
            .build();
    
    // 获取并返回访问令牌
    IAuthenticationResult result = pca.acquireToken(parameters).join();
    return result.accessToken();
}

集成认证的SignalR连接代码 #

修改原有连接逻辑，将B2C令牌添加到SignalR请求头，完成认证连接：

public static void main(String[] args) {
    if (args.length != 7) {
        System.out.print("\nUsage: ");
        System.out.print(Example.class);
        System.out.println(" signalr_url hubname tenantId clientId username password userFlow");
        return;
    }
    
    String signalRUrl = args[0];
    String hubName = args[1];
    String tenantId = args[2];
    String clientId = args[3];
    String username = args[4];
    String password = args[5];
    String userFlow = args[6];
    
    try {
        // 获取B2C访问令牌
        String accessToken = getB2CAccessToken(tenantId, clientId, username, password, userFlow, signalRUrl);
        
        // 构建带认证头的SignalR连接
        final HttpHubConnectionBuilder builder = HubConnectionBuilder.create(signalRUrl)
                .withHeader("Authorization", "Bearer " + accessToken);
        
        final HubConnection hubConnection = builder.build();
        
        final Action1<Object> callback = param1 -> {
            System.out.print("Signalr hub connection ID: ");
            System.out.println(hubConnection.getConnectionId());
            System.out.println(param1);
        };
        
        hubConnection.on(hubName, callback, Object.class);
        
        // 启动连接并保持程序运行监听事件
        hubConnection.start().blockingAwait();
        System.out.println("Connected to SignalR Hub successfully.");
        Thread.currentThread().join();
        
    } catch (Exception ex) {
        ex.printStackTrace();
    }
}

关键注意事项 #

• 跨平台兼容性：MSAL4J为纯Java实现，无平台绑定API，可在Windows、macOS、Linux上一致运行
• Serverless模式URL格式：Azure SignalR Serverless模式的连接URL需为https://<hub-name>.service.signalr.net/client/?hub=<hub-name>格式
• 作用域要求：必须将作用域设置为SignalR Hub完整URL加/.default，确保令牌拥有Hub访问权限
• 认证限制：用户名密码流要求Azure AD B2C已启用该认证方式，且目标用户未开启多因素认证（MFA）

内容的提问来源于stack exchange，提问作者ISTI Kevin