如何为多客户端访问的ASP.NET Core Web API配置Azure AD认证启动项

1. 配置允许的客户端白名单 #

先在appsettings.json的AzureAd节点下添加允许访问API的客户端ID列表：

"AzureAd": {
  "Instance": "https://login.microsoftonline.com/",
  "Domain": "your-tenant-domain.com",
  "TenantId": "your-tenant-guid",
  "ClientId": "your-api-client-id",
  "AllowedClientIds": [
    "client-app-id-1",
    "client-app-id-2",
    "client-app-id-3"
  ]
}

2. 扩展JWT验证逻辑 #

修改Startup.cs中的认证配置，添加客户端ID校验逻辑，确保只有白名单内的客户端能访问API：

public void ConfigureServices(IServiceCollection services)
{
    Essilor.Common.AwsMfaHelper.ProfileHelper.UseProfile("ride-dev", true);
    InitializeEnvironment();

    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApi(options =>
            {
                Configuration.Bind("AzureAd", options);

                // 配置令牌验证核心参数
                options.TokenValidationParameters.ValidAudiences = new[] { options.ClientId };
                options.TokenValidationParameters.ValidIssuer = $"{options.Instance}{options.TenantId}/";

                // 新增客户端ID校验事件
                options.Events = new JwtBearerEvents
                {
                    OnTokenValidated = context =>
                    {
                        // 从配置读取允许的客户端ID列表
                        var allowedClientIds = Configuration.GetSection("AzureAd:AllowedClientIds").Get<string[]>();
                        // 从JWT中提取客户端ID（优先取标准azp claim，兼容旧场景的appid claim）
                        var clientId = context.Principal.Claims.FirstOrDefault(c => c.Type == "azp" || c.Type == "appid")?.Value;

                        // 校验客户端ID是否在白名单内
                        if (string.IsNullOrEmpty(clientId) || !allowedClientIds.Contains(clientId))
                        {
                            context.Fail("客户端ID未被授权访问该API");
                        }

                        return Task.CompletedTask;
                    }
                };
            }, Configuration);

    services.AddAuthorization();
    services.AddAuthZClient();

    services.AddDefaultAWSOptions(Configuration.GetAWSOptions());
    services.AddAWSService<Amazon.S3.IAmazonS3>();

    RegisterServices(services);

    services.AddMvcCore();
    services.AddRazorPages();
    services.AddControllersWithViews(options =>
            {
                options.Filters.Add(typeof(AuditTrailAttribute));
            });
}

3. （可选）按客户端ID配置细粒度授权 #

如果需要针对不同客户端开放不同API接口，可以定义专属授权策略：

services.AddAuthorization(options =>
{
    options.AddPolicy("Client1Only", policy =>
        policy.RequireClaim("azp", "client-app-id-1"));
    
    options.AddPolicy("Client2Only", policy =>
        policy.RequireClaim("azp", "client-app-id-2"));
});

然后在控制器或Action上绑定策略：

[Authorize(Policy = "Client1Only")]
[ApiController]
[Route("api/client1")]
public class Client1Controller : ControllerBase
{
    // 仅允许client-app-id-1访问的接口逻辑
}

核心说明 #

• JWT中的azp（Authorized Party）是标识发起请求的客户端应用ID的标准Claim，部分旧版应用可能使用appid Claim，因此需要兼容两种取值
• 同一租户下，令牌的Issuer格式固定为https://login.microsoftonline.com/{TenantId}/，验证Issuer可确保令牌来自指定租户，避免跨租户非法访问
• 所有需要访问API的客户端应用ID必须加入AllowedClientIds白名单，否则请求会被拦截

内容的提问来源于stack exchange，提问作者vinayak shettar