如何使用Azure为.NET 5 API实现JWT令牌认证与授权

一、实现/token端点获取Azure JWT令牌 #

1. 安装依赖包 #

安装用于调用Azure AD令牌服务的NuGet包：

Install-Package Microsoft.Identity.Client

2. 定义请求模型 #

创建接收scopes参数的模型类：

public class TokenRequest
{
    public string[] Scopes { get; set; }
}

3. 完善TokenController逻辑 #

注入配置项，调用Azure AD令牌端点获取JWT：

using Microsoft.Identity.Client;
using Microsoft.Extensions.Configuration;

public class TokenController : ControllerBase
{
    private readonly IConfiguration _configuration;

    public TokenController(IConfiguration configuration)
    {
        _configuration = configuration;
    }

    [HttpPost]
    public async Task<ActionResult<string>> GetToken([FromBody] TokenRequest request)
    {
        if (request.Scopes == null || !request.Scopes.Any())
        {
            return BadRequest("Scopes参数不能为空");
        }

        // 从配置文件读取Azure AD应用信息
        var tenantId = _configuration["AzureAd:TenantId"];
        var clientId = _configuration["AzureAd:ClientId"];
        var clientSecret = _configuration["AzureAd:ClientSecret"];
        var authority = $"https://login.microsoftonline.com/{tenantId}/v2.0";

        // 构建机密客户端实例
        var app = ConfidentialClientApplicationBuilder
            .Create(clientId)
            .WithClientSecret(clientSecret)
            .WithAuthority(new Uri(authority))
            .Build();

        try
        {
            // 通过客户端凭证流获取令牌
            var result = await app.AcquireTokenForClient(request.Scopes)
                .ExecuteAsync();

            return Ok(result.AccessToken);
        }
        catch (MsalException ex)
        {
            return StatusCode((int)System.Net.HttpStatusCode.Unauthorized, ex.Message);
        }
    }
}

4. 配置Azure AD参数 #

在appsettings.json中添加Azure应用的配置信息：

{
  "AzureAd": {
    "TenantId": "你的Azure租户ID",
    "ClientId": "API应用的客户端ID",
    "ClientSecret": "API应用的客户端密钥"
  }
}

二、配置API的JWT授权保护 #

1. 添加认证服务 #

在Startup.cs的ConfigureServices方法中注册JWT认证：

using Microsoft.AspNetCore.Authentication.JwtBearer;
using Microsoft.Identity.Web;

public void ConfigureServices(IServiceCollection services)
{
    // 集成Azure AD JWT认证
    services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
        .AddMicrosoftIdentityWebApi(_configuration.GetSection("AzureAd"));

    // 自定义授权策略（根据scopes控制访问）
    services.AddAuthorization(options =>
    {
        options.AddPolicy("ReadAccess", policy =>
            policy.RequireClaim("scp", "api://你的API应用ID/access_as_user"));
        options.AddPolicy("WriteAccess", policy =>
            policy.RequireClaim("scp", "api://你的API应用ID/write_data"));
    });

    services.AddControllers();
}

2. 启用认证授权中间件 #

在Startup.cs的Configure方法中添加中间件：

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // 其他中间件（如异常处理、静态文件）

    app.UseAuthentication();
    app.UseAuthorization();

    app.UseEndpoints(endpoints =>
    {
        endpoints.MapControllers();
    });
}

3. 保护API端点 #

在需要授权的控制器或方法上添加[Authorize]特性：

[ApiController]
[Route("api/[controller]")]
[Authorize] // 全局保护该控制器下所有端点
public class DataController : ControllerBase
{
    [HttpGet]
    [Authorize(Policy = "ReadAccess")] // 仅允许拥有指定scope的令牌访问
    public IActionResult GetData()
    {
        return Ok("已通过JWT认证授权，返回受保护数据");
    }

    [HttpPost]
    [Authorize(Policy = "WriteAccess")]
    public IActionResult PostData([FromBody] object data)
    {
        return Ok("数据已写入，操作已授权");
    }
}

注意事项 #

• 确保Azure门户中API应用的「Expose an API」部分已配置对应scopes，且调用方应用已被授予这些scopes的权限
• 上述示例使用客户端凭证流，适用于服务对服务的调用场景；如果是用户登录后访问API，需改用授权码流等用户参与的OAuth2.0流程

内容的提问来源于stack exchange，提问作者Liam Kenny