如何从Azure应用代理预身份验证获取Azure AD访问令牌

核心逻辑 #

Azure应用代理的预身份验证会将用户的Azure AD访问令牌通过请求头传递给后端API，我们可以直接提取该令牌，或借助Azure AD身份验证中间件完成令牌验证与调用MS Graph的流程。

具体实现步骤 #

1. 前置配置 #

• 确保.NET Core API已通过Azure应用代理发布，且启用Azure AD预身份验证
• 在Azure AD中为API注册应用，添加所需的MS Graph委托权限（如User.Read、Mail.Read等，按需选择），并完成管理员同意（针对需管理员权限的范围）
• 在应用代理的「后端应用」设置中，开启「传递用户身份标头」，确保令牌能被传递到后端API

2. 直接提取请求头令牌调用MS Graph #

Azure应用代理会在请求中添加X-MS-TOKEN-AAD-ACCESS-TOKEN头，携带用户的访问令牌，直接提取即可使用：

[ApiController]
[Route("api/[controller]")]
public class GraphController : ControllerBase
{
    private readonly IHttpClientFactory _httpClientFactory;

    public GraphController(IHttpClientFactory httpClientFactory)
    {
        _httpClientFactory = httpClientFactory;
    }

    [HttpGet("user-profile")]
    public async Task<IActionResult> GetUserProfile()
    {
        var accessToken = Request.Headers["X-MS-TOKEN-AAD-ACCESS-TOKEN"].FirstOrDefault();
        if (string.IsNullOrEmpty(accessToken))
        {
            return Unauthorized("无法获取用户身份令牌");
        }

        var graphClient = _httpClientFactory.CreateClient();
        graphClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
        
        var response = await graphClient.GetAsync("https://graph.microsoft.com/v1.0/me");
        if (!response.IsSuccessStatusCode)
        {
            return StatusCode((int)response.StatusCode, "调用MS Graph API失败");
        }

        var userProfile = await response.Content.ReadFromJsonAsync<dynamic>();
        return Ok(userProfile);
    }
}

3. 借助Azure AD中间件规范处理 #

如果需要更严谨的身份验证流程（比如自动验证令牌合法性、处理令牌刷新），可以配置Azure AD身份验证中间件：

1. 在appsettings.json中添加配置：

"AzureAd": {
  "Instance": "https://login.microsoftonline.com/",
  "TenantId": "你的Azure AD租户ID",
  "ClientId": "API的应用注册ID",
  "Audience": "API的应用注册ID"
}

2. 在Program.cs中注册中间件：

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"));

builder.Services.AddHttpClient("MsGraphClient", client =>
{
    client.BaseAddress = new Uri("https://graph.microsoft.com/v1.0/");
})
.AddMicrosoftIdentityWebApiAuthentication(builder.Configuration);

app.UseAuthentication();
app.UseAuthorization();

3. 在控制器中注入客户端调用：

[ApiController]
[Route("api/[controller]")]
[Authorize]
public class GraphController : ControllerBase
{
    private readonly HttpClient _graphClient;

    public GraphController(IHttpClientFactory httpClientFactory)
    {
        _graphClient = httpClientFactory.CreateClient("MsGraphClient");
    }

    [HttpGet("user-emails")]
    public async Task<IActionResult> GetUserEmails()
    {
        var response = await _graphClient.GetAsync("me/messages?$top=10");
        if (!response.IsSuccessStatusCode)
        {
            return StatusCode((int)response.StatusCode, "获取用户邮件失败");
        }

        var emails = await response.Content.ReadFromJsonAsync<dynamic>();
        return Ok(emails);
    }
}

注意事项 #

• 令牌默认有效期为1小时，若需长期调用，可结合Azure AD的刷新令牌流程处理；在应用代理场景下，用户重新访问API时会自动获取新令牌
• 确保MS Graph权限范围与实际业务需求匹配，避免过度授权

内容的提问来源于stack exchange，提问作者Gowtham k