RestSharp 108.0.2 Azure AD认证遇Uri格式错误求助

错误原因 #

你当前代码里构造Authority的逻辑完全错误：

string Authority = String.Format(TenantID);

Azure AD的Authority必须是完整URI格式，标准格式为https://login.microsoftonline.com/{TenantID}，直接传入TenantID字符串不符合AuthenticationContext对参数的URI格式要求，因此触发该错误。

修复步骤及RestSharp适配实现 #

1. 修正Authority构造逻辑并获取Token #

先修复获取Azure AD Token的代码，确保Authority合法：

using Microsoft.IdentityModel.Clients.ActiveDirectory;

string authority = $"https://login.microsoftonline.com/{TenantID}";
AuthenticationContext ac = new AuthenticationContext(authority);
string resourceID = ResourceID;
string clientID = ClientID;
string clientSecret = ClientSecret;

try
{
    // 若使用非交互式客户端凭证认证，替换原UserCredential为ClientCredential
    ClientCredential credential = new ClientCredential(clientID, clientSecret);
    Task<AuthenticationResult> task = ac.AcquireTokenAsync(resourceID, credential);
    task.Wait(10000);
    AuthenticationResult result = task.Result;
    return result.AccessToken;
}
catch (Exception ex)
{
    if (ex.InnerException?.Message.ToLower().Contains("interactive authorization") ?? false)
    {
        return "prompt";
    }
    throw; // 直接抛出异常便于上层处理，不要返回错误消息
}

注意：Microsoft.IdentityModel.Clients.ActiveDirectory是旧版ADAL库，微软已停止维护，推荐迁移到MSAL库（Microsoft.Identity.Client），更简洁的实现：

using Microsoft.Identity.Client;

var app = ConfidentialClientApplicationBuilder
    .Create(ClientID)
    .WithClientSecret(ClientSecret)
    .WithAuthority(new Uri($"https://login.microsoftonline.com/{TenantID}"))
    .Build();

var result = await app.AcquireTokenForClient(new[] { $"{ResourceID}/.default" })
    .ExecuteAsync();
return result.AccessToken;

2. 在RestSharp中添加认证头 #

拿到Token后，直接给RestSharp请求添加Bearer授权头即可：

// 初始化RestClient
var client = new RestClient("你的API基础地址");

// 构造Put请求
var request = new RestRequest(uri, Method.Put);
// 添加授权头
request.AddHeader("Authorization", $"Bearer {token}");
// 添加JSON请求体
request.AddStringBody(JsonConvert.SerializeObject(body), ContentType.Json);

// 发送请求
var response = await client.ExecuteAsync<string>(request);

3. 封装全局认证器（可选） #

如果多个请求都需要认证，可以封装成RestSharp的IAuthenticator，实现全局自动添加认证：

public class AzureAdAuthenticator : IAuthenticator
{
    private readonly string _tenantId;
    private readonly string _clientId;
    private readonly string _clientSecret;
    private readonly string _resourceId;

    public AzureAdAuthenticator(string tenantId, string clientId, string clientSecret, string resourceId)
    {
        _tenantId = tenantId;
        _clientId = clientId;
        _clientSecret = clientSecret;
        _resourceId = resourceId;
    }

    public async Task Authenticate(IRestClient client, IRestRequest request)
    {
        var app = ConfidentialClientApplicationBuilder
            .Create(_clientId)
            .WithClientSecret(_clientSecret)
            .WithAuthority(new Uri($"https://login.microsoftonline.com/{_tenantId}"))
            .Build();

        var result = await app.AcquireTokenForClient(new[] { $"{_resourceId}/.default" })
            .ExecuteAsync();

        request.AddHeader("Authorization", $"Bearer {result.AccessToken}");
    }
}

// 使用方式
var client = new RestClient("你的API基础地址")
    .UseAuthenticator(new AzureAdAuthenticator(TenantID, ClientID, ClientSecret, ResourceID));

var request = new RestRequest(uri, Method.Put)
    .AddStringBody(JsonConvert.SerializeObject(body), ContentType.Json);

var response = await client.ExecuteAsync<string>(request);

关键注意点 #

• Authority格式必须完整：必须包含https://login.microsoftonline.com/前缀+租户ID，不能只传租户ID字符串。
• 优先使用MSAL库：ADAL已停止维护，MSAL支持更多Azure AD特性，兼容性更好。
• RestSharp认证逻辑：无需依赖原HttpClient的封装，直接通过添加请求头或自定义认证器实现，更贴合RestSharp的使用方式。

内容的提问来源于stack exchange，提问作者VENKATESH BOYAPATI