ASP.NET Core MVC中AuthorizeForScopes跨租户Graph API请求的端点适配问题

默认的[AuthorizeForScopes]属性依赖当前用户的默认租户上下文（即你的租户A）或配置里的通用organizations端点，跨租户访问时无法自动切换到目标租户的授权页面。要解决这个问题，你可以通过自定义扩展或手动处理授权逻辑来实现，以下是具体方案：

1. 自定义带租户ID的AuthorizeForScopes属性 #

原属性未暴露租户参数，你可以继承它扩展一个支持指定目标租户的版本，在授权挑战时强制使用目标租户的端点：

public class TenantAuthorizeForScopesAttribute : AuthorizeForScopesAttribute
{
    public string TargetTenantId { get; set; }

    public override async Task OnAuthorizationAsync(AuthorizationFilterContext context)
    {
        await base.OnAuthorizationAsync(context);

        // 检测到需要授权挑战时，修改跳转端点的租户信息
        if (context.Result is ChallengeResult challengeResult)
        {
            if (!string.IsNullOrEmpty(TargetTenantId))
            {
                // 获取OpenID Connect配置，替换租户ID构建正确的授权端点
                var oidcOptions = context.HttpContext.RequestServices
                    .GetRequiredService<IOptions<OpenIdConnectOptions>>().Value;
                
                // 构建目标租户的授权URL
                var authority = oidcOptions.Authority.Replace("organizations", TargetTenantId);
                var authorizeUrl = $"{authority}/oauth2/v2.0/authorize";
                
                // 更新挑战结果的重定向地址
                challengeResult.Properties.RedirectUri = authorizeUrl;
                // 传递租户ID到认证中间件
                challengeResult.Properties.Items["tenant"] = TargetTenantId;
            }
        }
    }
}

在控制器动作中直接指定目标租户ID使用：

[TenantAuthorizeForScopes(ScopeKeySection = "AllRequiredScopes", TargetTenantId = "租户B的ID")]
public async Task<IActionResult> FetchTenantBData()
{
    var tokenAcquisition = HttpContext.RequestServices.GetRequiredService<ITokenAcquisition>();
    // 明确获取租户B的访问令牌
    var accessToken = await tokenAcquisition.GetAccessTokenForUserAsync(
        Configuration.GetSection("AllRequiredScopes").Get<string[]>(),
        tenantId: "租户B的ID");

    // 使用该令牌调用Graph API访问租户B数据
    var graphClient = new GraphServiceClient(new DelegateAuthenticationProvider((requestMessage) =>
    {
        requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
        return Task.CompletedTask;
    }));

    var tenantBData = await graphClient.Tenant...; // 替换为实际的Graph API端点
    return View(tenantBData);
}

2. 手动捕获Graph API异常并处理重定向 #

如果不想自定义属性，也可以在控制器中直接捕获Graph API的ServiceException，当遇到401/403权限问题时，手动构建目标租户的授权URL并跳转：

public async Task<IActionResult> FetchTenantBData()
{
    try
    {
        var tokenAcquisition = HttpContext.RequestServices.GetRequiredService<ITokenAcquisition>();
        var accessToken = await tokenAcquisition.GetAccessTokenForUserAsync(
            Configuration.GetSection("AllRequiredScopes").Get<string[]>(),
            tenantId: "租户B的ID");

        var graphClient = new GraphServiceClient(new DelegateAuthenticationProvider((requestMessage) =>
        {
            requestMessage.Headers.Authorization = new AuthenticationHeaderValue("Bearer", accessToken);
            return Task.CompletedTask;
        }));

        var tenantBData = await graphClient.Tenant...;
        return View(tenantBData);
    }
    catch (ServiceException ex) when (ex.StatusCode == HttpStatusCode.Unauthorized || ex.StatusCode == HttpStatusCode.Forbidden)
    {
        // 构建目标租户的授权请求URL
        var oidcOptions = HttpContext.RequestServices.GetRequiredService<IOptions<OpenIdConnectOptions>>().Value;
        var authorizeUrl = $"{oidcOptions.Authority.Replace("organizations", "租户B的ID")}/oauth2/v2.0/authorize";
        
        // 添加必要的参数：客户端ID、重定向地址、权限、响应类型等
        var queryParams = new Dictionary<string, string>
        {
            { "client_id", oidcOptions.ClientId },
            { "redirect_uri", Url.Action("FetchTenantBData", "YourController", null, Request.Scheme) },
            { "scope", string.Join(" ", Configuration.GetSection("AllRequiredScopes").Get<string[]>()) },
            { "response_type", "code" },
            { "prompt", "consent" }, // 强制用户授权租户B的权限
            { "tenant", "租户B的ID" }
        };

        var fullAuthorizeUrl = $"{authorizeUrl}?{string.Join("&", queryParams.Select(kv => $"{kv.Key}={Uri.EscapeDataString(kv.Value)}"))}";
        return Redirect(fullAuthorizeUrl);
    }
}

关键注意点 #

• 调用Graph API时必须明确指定tenantId参数获取对应租户的令牌，不能依赖默认的用户主租户令牌。
• 授权时强制指定目标租户ID，才能让用户跳转到对应租户的登录/授权页面，解决跨租户权限缺失的问题。

内容的提问来源于stack exchange，提问作者Agyss