我正在使用Azure Active Directory向运行Umbraco版本11.0的网站上的后台提供身份验证。
这运行良好，我可以登录，但我想通过使用Azure中的应用角色来管理Umbraco中的用户组来改善体验。

• • 我的Azure设置**

我已使用以下配置在Azure中创建了应用注册：

• 已添加重定向URI：
• 统一资源标识符：https：//本地主机：44391/
• 已启用Access tokens (used for implicit flows)
• 已启用ID tokens (used for implicit and hybrid flows)
• 支持的帐户类型：Accounts in this organizational directory only (Example only - Single tenant)
• 添加的应用程序角色
• 管理人
• 编辑

在企业应用程序中，我还向我的用户添加了上述应用程序角色：

• • 我的密码**

登录提供程序

namespace Example.Api.Features.Authentication.Extensions;

public static class UmbracoBuilderExtensions
{
    public static IUmbracoBuilder ConfigureAuthentication(this IUmbracoBuilder builder)
    {
        builder.Services.ConfigureOptions<OpenIdConnectBackOfficeExternalLoginProviderOptions>();

        builder.AddBackOfficeExternalLogins(logins =>
        {
            const string schema = MicrosoftAccountDefaults.AuthenticationScheme;
                
            logins.AddBackOfficeLogin(
                backOfficeAuthenticationBuilder =>
                {
                    backOfficeAuthenticationBuilder.AddMicrosoftAccount(
                        // the scheme must be set with this method to work for the back office
                        backOfficeAuthenticationBuilder.SchemeForBackOffice(OpenIdConnectBackOfficeExternalLoginProviderOptions.SchemeName) ?? string.Empty,
                        options =>
                        {
                            //By default this is '/signin-microsoft' but it needs to be changed to this
                            options.CallbackPath = "/umbraco-signin-microsoft/";
                            //Obtained from the AZURE AD B2C WEB APP
                            options.ClientId = "CLIENT_ID";
                            //Obtained from the AZURE AD B2C WEB APP
                            options.ClientSecret = "CLIENT_SECRET";
                            options.TokenEndpoint = $"https://login.microsoftonline.com/TENANT/oauth2/v2.0/token";
                            options.AuthorizationEndpoint = $"https://login.microsoftonline.com/TENANT/oauth2/v2.0/authorize";
                        });
                });
        });

        return builder;
    }
}

自动链接帐户

namespace Example.Api.Features.Configuration;

public class OpenIdConnectBackOfficeExternalLoginProviderOptions : IConfigureNamedOptions<BackOfficeExternalLoginProviderOptions>
{
    public const string SchemeName = "OpenIdConnect";

    public void Configure(string name, BackOfficeExternalLoginProviderOptions options)
    {
        if (name != "Umbraco." + SchemeName)
        {
            return;
        }

        Configure(options);
    }

    public void Configure(BackOfficeExternalLoginProviderOptions options)
    {
        options.AutoLinkOptions = new ExternalSignInAutoLinkOptions(
            // must be true for auto-linking to be enabled
            autoLinkExternalAccount: true,

            // Optionally specify default user group, else
            // assign in the OnAutoLinking callback
            // (default is editor)
            defaultUserGroups: new[] { Constants.Security.EditorGroupAlias },

            // Optionally you can disable the ability to link/unlink
            // manually from within the back office. Set this to false
            // if you don't want the user to unlink from this external
            // provider.
            allowManualLinking: false
        )
        {
            // Optional callback
            OnAutoLinking = (autoLinkUser, loginInfo) =>
            {
                // You can customize the user before it's linked.
                // i.e. Modify the user's groups based on the Claims returned
                // in the externalLogin info

                autoLinkUser.IsApproved = true;
            },
            OnExternalLogin = (user, loginInfo) =>
            {
                // You can customize the user before it's saved whenever they have
                // logged in with the external provider.
                // i.e. Sync the user's name based on the Claims returned
                // in the externalLogin info

                return true; //returns a boolean indicating if sign in should continue or not.
            }
        };

        // Optionally you can disable the ability for users
        // to login with a username/password. If this is set
        // to true, it will disable username/password login
        // even if there are other external login providers installed.
        options.DenyLocalLogin = true;

        // Optionally choose to automatically redirect to the
        // external login provider so the user doesn't have
        // to click the login button. This is
        options.AutoRedirectLoginToExternalProvider = true;
    }
}

在这个文件中，我最好按照注解和i.e. Modify the user's groups based on the Claims returned in the externalLogin info的要求去做。
也在我的启动文件中注册

services.AddUmbraco(_env, _config)
            .AddBackOffice()
            .AddWebsite()
            .AddComposers()
            .ConfigureAuthentication()
            .Build();

我尝试给应用程序以下权限，但没有成功：

目前的情况是，我可以很好地登录，但如果我调试externalInfo，那里没有任何关于用户具有如上所述配置的Administrator或Editor应用程序角色的信息。
我的直觉是，我错过了Azure Active Directory设置的一些东西，但我已经尝试了一些不同的配置，似乎无法让应用程序角色回来。
谢谢你，
本

• • 编辑日期：2023年2月15日：**

我可以看到，当我使用client_credentials作为grant_type访问https://login.microsoftonline.com/{tenantId}/oauth2/v2.0/token端点时，角色返回。它看起来像是. NET应用程序使用authorization_code。我已经解码了从中检索到的令牌，它不包含角色。
我想知道. NET应用程序上是否有某种配置允许我添加角色。