.NET 7 Web API部署Azure App Service遇404及本地401问题求助

• 基于.NET 7创建了集成Microsoft Identity Platform（原Azure AD）的Web API示例，通过Visual Studio配置发布到Azure App Service后，输出窗口显示发布成功，但访问站点返回404未找到错误。
• 本地运行页面正常，但通过Swagger调用接口返回**401 www-authenticate bearer**认证错误。
• 已参考.NET 6快速入门指南，尝试手动创建web.config仍未解决。
• 疑问：当前生成的认证代码是否需要额外配置AddJwtBearer？

当前认证代码 #

builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
 .AddMicrosoftIdentityWebApi(builder.Configuration.GetSection("AzureAd"))
 .EnableTokenAcquisitionToCallDownstreamApi()
 .AddMicrosoftGraph(builder.Configuration.GetSection("MicrosoftGraph"))
 .AddInMemoryTokenCaches();

appsettings.json配置 #

{
  "AzureAd": {
    "Instance": "https://login.microsoftonline.com/",
    "Domain": "....onmicrosoft.com",
    "TenantId": "...",
    "ClientId": "...",
    "CallbackPath": "/signin-oidc",
    "Scopes": "access_as_user"
  },
  "Logging": {
    "LogLevel": {
      "Default": "Information",
      "Microsoft.AspNetCore": "Warning"
    }
  },
  "AllowedHosts": "*",
  "MicrosoftGraph": {
    "BaseUrl": "https://graph.microsoft.com/v1.0",
    "Scopes": "user.read"
  }
}

web.config内容 #

<?xml version="1.0" encoding="utf-8"?>
<configuration>
 <location path="." inheritInChildApplications="false">
 <system.webServer>
 <handlers>
 <add name="aspNetCore" path="*" verb="*" modules="AspNetCoreModuleV2" resourceType="Unspecified" />
 </handlers>
 <aspNetCore processPath="dotnet" arguments=".\MyWebApp.dll" stdoutLogEnabled="false" stdoutLogFile=".\logs\stdout" hostingModel="InProcess" />
 </system.webServer>
 <system.web>
 <httpRuntime targetFramework="net6.0" />
 </system.web>
 </location>
</configuration>

关于AddJwtBearer的疑问 #

不需要额外单独配置AddJwtBearer，AddMicrosoftIdentityWebApi已经封装了JWT Bearer的核心配置逻辑，包含令牌验证、 issuer校验等必要设置，无需重复添加。

针对Azure App Service 404错误的排查与修复 #

1. 修正web.config框架版本：项目基于.NET 7，但web.config中httpRuntime targetFramework设置为net6.0，需改为net7.0；同时确认aspNetCore节点的arguments中dll名称与实际发布的dll文件名一致。
2. 检查部署路径与文件完整性：在Azure门户的App Service -> 部署中心，查看部署日志确认文件是否全部上传成功，同时检查物理路径是否指向正确的发布目录。
3. 验证路由配置：确保Web API控制器标注了[ApiController]和[Route]属性（如[Route("api/[controller]")]），避免路由匹配失败导致404。

针对本地Swagger 401认证错误的修复 #

1. 配置Swagger支持Azure AD授权：需要为Swagger添加OAuth2配置，使其能获取Azure AD令牌，示例代码如下：

builder.Services.AddSwaggerGen(c =>
{
    c.SwaggerDoc("v1", new OpenApiInfo { Title = "MyWebApp", Version = "v1" });
    
    var securityScheme = new OpenApiSecurityScheme
    {
        Name = "Azure AD Bearer",
        Type = SecuritySchemeType.OAuth2,
        Flows = new OpenApiOAuthFlows
        {
            AuthorizationCode = new OpenApiOAuthFlow
            {
                AuthorizationUrl = new Uri($"https://login.microsoftonline.com/{builder.Configuration["AzureAd:TenantId"]}/oauth2/v2.0/authorize"),
                TokenUrl = new Uri($"https://login.microsoftonline.com/{builder.Configuration["AzureAd:TenantId"]}/oauth2/v2.0/token"),
                Scopes = new Dictionary<string, string>
                {
                    { builder.Configuration["AzureAd:Scopes"], "Access API as user" }
                }
            }
        },
        In = ParameterLocation.Header,
        Scheme = "Bearer"
    };
    
    c.AddSecurityDefinition("oauth2", securityScheme);
    c.AddSecurityRequirement(new OpenApiSecurityRequirement
    {
        {
            new OpenApiSecurityScheme
            {
                Reference = new OpenApiReference { Type = ReferenceType.SecurityScheme, Id = "oauth2" }
            },
            new[] { builder.Configuration["AzureAd:Scopes"] }
        }
    });
});

// 配置SwaggerUI授权参数
app.UseSwaggerUI(c =>
{
    c.SwaggerEndpoint("/swagger/v1/swagger.json", "MyWebApp v1");
    c.OAuthClientId(builder.Configuration["AzureAd:ClientId"]);
    c.OAuthUsePkce();
});

2. 完善Azure AD应用注册配置：
   • 添加Swagger的重定向URI：https://localhost:<端口号>/swagger/oauth2-redirect.html；
   • 确认已暴露access_as_user API范围，且客户端（Swagger）已获得该范围的授权权限。
3. 调整中间件顺序：确保app.UseAuthentication()在app.UseAuthorization()之前调用，且位于app.UseSwagger()和app.UseSwaggerUI()之后（本地开发环境）。

内容的提问来源于stack exchange，提问作者Prokurors