Visual Studio部署Azure函数时出现Entra ID AADSTS1100001错误排查

我为Azure Function应用使用Microsoft Entra ID自定义身份验证扩展。通过Azure门户手动创建函数并配置该扩展时，一切正常：函数URL可返回JSON响应，扩展能在请求中返回预期的claims（如用户信息）。

以下是从Azure门户创建函数时使用的代码（来自微软官方文档）：

#r "Newtonsoft.Json"
using System.Net;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Extensions.Primitives;
using Newtonsoft.Json;

public static async Task<IActionResult> Run(HttpRequest req, ILogger log)
{
    log.LogInformation("C# HTTP trigger function processed a request.");
    string requestBody = await new StreamReader(req.Body).ReadToEndAsync();
    dynamic data = JsonConvert.DeserializeObject(requestBody);

    // 读取Microsoft Entra请求中的关联ID
    string correlationId = data?.data.authenticationContext.correlationId;

    // 返回给Microsoft Entra的Claims
    ResponseContent r = new ResponseContent();
    r.data.actions[0].claims.CorrelationId = correlationId;
    r.data.actions[0].claims.ApiVersion = "1.0.0";
    r.data.actions[0].claims.DateOfBirth = "01/01/2000";
    r.data.actions[0].claims.CustomRoles.Add("Writer");
    r.data.actions[0].claims.CustomRoles.Add("Editor");
    return new OkObjectResult(r);
}

public class ResponseContent
{
    [JsonProperty("data")]
    public Data data { get; set; }

    public ResponseContent()
    {
        data = new Data();
    }
}

public class Data
{
    [JsonProperty("@odata.type")]
    public string odatatype { get; set; }
    public List<Action> actions { get; set; }

    public Data()
    {
        odatatype = "microsoft.graph.onTokenIssuanceStartResponseData";
        actions = new List<Action>();
        actions.Add(new Action());
    }
}

public class Action
{
    [JsonProperty("@odata.type")]
    public string odatatype { get; set; }
    public Claims claims { get; set; }

    public Action()
    {
        odatatype = "microsoft.graph.tokenIssuanceStart.provideClaimsForToken";
        claims = new Claims();
    }
}

public class Claims
{
    [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
    public string CorrelationId { get; set; }
    [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
    public string DateOfBirth { get; set; }
    public string ApiVersion { get; set; }
    public List<string> CustomRoles { get; set; }

    public Claims()
    {
        CustomRoles = new List<string>();
    }
}

浏览器访问函数URL的结果及成功获取claims的验证截图：

通过Visual Studio使用发布配置文件部署相同函数时，函数URL仍能正常返回JSON，但自定义身份验证扩展无法返回claims，且出现AADSTS1100001错误。仅有的差异是VS以包形式部署，而门户是直接上传代码。

以下是Visual Studio中的函数代码：

using System;
using System.IO;
using System.Threading.Tasks;
using Microsoft.AspNetCore.Mvc;
using Microsoft.Azure.WebJobs;
using Microsoft.Azure.WebJobs.Extensions.Http;
using Microsoft.AspNetCore.Http;
using Microsoft.Extensions.Logging;
using Newtonsoft.Json;
using Microsoft.Data.SqlClient;
using System.Collections.Generic;

namespace AzureTestFunction
{
    public static class Function1
    {
        [FunctionName("Function1")]
        public static async Task<IActionResult> Run(
            [HttpTrigger(AuthorizationLevel.Function, "get", Route = null)] HttpRequest req,
            ILogger log)
        {
            log.LogInformation("C# HTTP trigger function processed a request.");
            string requestBody = await new StreamReader(req.Body).ReadToEndAsync();
            dynamic data = JsonConvert.DeserializeObject(requestBody);

            // 读取Microsoft Entra请求中的关联ID
            string correlationId = data?.data.authenticationContext.correlationId;
            
            // 返回给Microsoft Entra的Claims
            ResponseContent r = new ResponseContent();
            r.data.actions[0].claims.CorrelationId = correlationId;
            r.data.actions[0].claims.ApiVersion = "1.0.0";
            r.data.actions[0].claims.DateOfBirth = "01/01/2000";
            r.data.actions[0].claims.CustomRoles.Add("Writer");
            r.data.actions[0].claims.CustomRoles.Add("Editor");
            
            // 获取数据库值
            
            string connectionString = Environment.GetEnvironmentVariable("SqlServerConnection");
            var resultList = new List<string>();

            using (SqlConnection conn = new SqlConnection(connectionString))
            {
                await conn.OpenAsync();
                var query = "SELECT Name from auth.Permissions"; // 调整你的表/查询

                using (SqlCommand cmd = new SqlCommand(query, conn))
                using (SqlDataReader reader = await cmd.ExecuteReaderAsync())
                {
                    while (await reader.ReadAsync())
                    {
                        resultList.Add(reader.GetString(0)); // 假设Name是第一列
                    }
                }
            }

            // 添加来自数据库的claims
            foreach (var result in resultList)
            {
                r.data.actions[0].claims.Permissions.Add(result);
            }

            return new OkObjectResult(r);
        }
    }

    public class ResponseContent
    {
        [JsonProperty("data")]
        public Data data { get; set; }

        public ResponseContent()
        {
            data = new Data();
        }
    }

    public class Data
    {
        [JsonProperty("@odata.type")]
        public string odatatype { get; set; }
        public List<Action> actions { get; set; }

        public Data()
        {
            odatatype = "microsoft.graph.onTokenIssuanceStartResponseData";
            actions = new List<Action>();
            actions.Add(new Action());
        }
    }

    public class Action
    {
        [JsonProperty("@odata.type")]
        public string odatatype { get; set; }
        public Claims claims { get; set; }

        public Action()
        {
            odatatype = "microsoft.graph.tokenIssuanceStart.provideClaimsForToken";
            claims = new Claims();
        }
    }

    public class Claims
    {
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        public string CorrelationId { get; set; }
        [JsonProperty(NullValueHandling = NullValueHandling.Ignore)]
        public string DateOfBirth { get; set; }
        public string ApiVersion { get; set; }
        public List<string> CustomRoles { get; set; }
        public List<string> Permissions { get; set; }

        public Claims()
        {
            CustomRoles = new List<string>();
            Permissions = new List<string>();
        }
    }
}

浏览器访问函数URL的结果及登录后的错误截图：

• 检查函数名称与扩展配置匹配性：门户部署的函数名称是OnTokenIssuanceStart_CustomClaimsExtension，VS部署的是Function1。确认Entra ID扩展中配置的函数URL是否指向正确的函数路由，扩展需精准匹配路径。
• 修正HTTP请求方法：Microsoft Entra扩展调用自定义函数使用POST请求，但VS代码中HttpTrigger仅允许GET。修改属性为[HttpTrigger(AuthorizationLevel.Function, "get", "post", Route = null)]，确保支持POST请求。
• 验证数据库配置与权限：检查Azure Function应用的应用程序设置中是否已正确配置SqlServerConnection环境变量；确认Function应用的托管身份或连接字符串凭据具有SQL数据库的读取权限，避免数据库连接失败导致响应结构异常。
• 启用日志分析请求响应：在Azure门户开启Function应用的日志流，记录Entra扩展调用时的请求体和函数响应。对比门户与VS部署的函数输入输出，确认JSON结构是否符合Microsoft Graph要求（如@odata.type字段、Claims嵌套层级）。
• 模拟POST请求测试：用Postman或curl向VS部署的函数发送模拟Entra请求的POST请求（包含data.authenticationContext.correlationId字段），验证函数是否返回正确的响应结构。
• 检查部署包依赖项：通过Kudu工具查看VS部署包的bin目录，确认Newtonsoft.Json、Microsoft.Data.SqlClient等依赖项是否完整，避免因缺失依赖导致函数运行异常。

内容的提问来源于stack exchange，提问作者Zeeshanwebdev