我认为我的目标很简单。我有一个客户端，它调用Web API（在Azure B2C租户中注册）以接收访问令牌。到目前为止一切顺利。当我使用此访问令牌调用使用[Authorize]标记保护的Web API方法时，我只返回了401 Unauthorized错误。
我使用的是ASP.NET核心3.1。

• • 1. Web Api**-我获取令牌的方法：

IPublicClientApplication app = PublicClientApplicationBuilder.Create(_clientId)
                      .WithB2CAuthority(_authority)
                      .Build();

result = await app.AcquireTokenByUsernamePassword(_scopes, _username, _password)
                  .ExecuteAsync();

return Ok(result.AccessToken);

This returns a token and when I enter it in jwt.io it looks okay, with the right username and scopes, but at the bottom it says "Invalid Signature". This could be the problem, but someone also had a similar issue and claimed that it worked for him anyway. It makes me uncomfortable and maybe someone can tell me reasons why the signature could be invalid or what this means exactly.

• • 2.本地客户端**-发送我的请求：

HttpRequestMessage request = new HttpRequestMessage()
{
      Method = method,
      RequestUri = new Uri(_httpClient.BaseAddress + requestUri),
};

request.Headers.Authorization = new AuthenticationHeaderValue("Bearer", _token);

return await _httpClient.SendAsync(request);

• • 3. Web Api**-Startup.cs服务配置：

在这里，我尝试了太多的方法，我说不出哪一种效果最好，因为它们似乎都不起作用。我认为这个版本看起来很有希望：

services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
            .AddMicrosoftIdentityWebApi(Configuration, "AzureB2C")
            .EnableTokenAcquisitionToCallDownstreamApi()
            .AddMicrosoftGraph(Configuration.GetSection("MicrosoftGraph"))
            .AddInMemoryTokenCaches();

• • 4.应用程序设置. json**

我还尝试了不同的设置，我不知道我的ROPC策略使用什么，所以我输入到"SignUpSignInPolicyId"，这可能是一个问题：

"AzureB2C": {
        "Instance": "https://[tenant].b2clogin.com/",
        "Domain": "[domain name]",
        "TenantId": "[tenantId]",
        "ClientId": "[clientId]",
        "SignUpSignInPolicyId": "[ropc policy name]",
        "B2cExtensionAppClientId": "[client id of b2cextensionapp]",
        "Scopes": "[scopeurl]"
}

我对Azure、授权和Web API都很陌生，但我在过去几周里研究了很多，我仍然不明白为什么这不起作用，特别是因为我正在为正确的用户取回访问令牌。
谢谢你，谢谢你