使用Azure用户托管身份从客户端调用受保护的Web API(AADSTS700222错误)

qni6mghb  于 2023-06-30  发布在  其他
关注(0)|答案(1)|浏览(139)

我试图用基于this和this的用户管理身份和这个example/docs来替换clientid & secret。
我可以使用以下命令连接到Key Vault（例如）

builder.Configuration.AddAzureKeyVault(
    new Uri($"https://{builder.Configuration["KeyVaultName"]}.vault.azure.net/"),
    new DefaultAzureCredential(new DefaultAzureCredentialOptions
    {
        ManagedIdentityClientId = "68223c16-976d-....24b"
    }
        ),
        new AzureKeyVaultConfigurationOptions()
        {
            ReloadInterval = TimeSpan.FromMinutes(1)
        });

}
当我添加任何下游服务时：

builder.Services.AddAuthentication(OpenIdConnectDefaults.AuthenticationScheme)
    .AddMicrosoftIdentityWebApp(builder.Configuration.GetSection("AzureAd"))
                .EnableTokenAcquisitionToCallDownstreamApi() 
        .AddMicrosoftGraph(builder.Configuration.GetSection("MicrosoftGraph"))
                .AddDownstreamApi("MyDownstreamAPI", builder.Configuration.GetSection("MyDownstreamAPI"))          
                .AddInMemoryTokenCaches();

我得到一个恒定的登录重试（400坏请求）和
AADSTS700222：AAD颁发的令牌不能用于联合身份流
：

2023-06-30 01:39:55.088 +00:00 [Information] Microsoft.Identity.Web.TokenAcquisition: [MsIdWeb] Using Managed identity for client credentials.
2023-06-30 01:39:55.088 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z] ConfidentialClientApplication 45523402 created
2023-06-30 01:39:55.095 +00:00 [Information] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] MSAL MSAL.NetCore with assembly version '4.54.1.0'. CorrelationId(9c30ff44-bf8f-423d-8151-a5b4f6b049bf)
2023-06-30 01:39:55.096 +00:00 [Information] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf]=== Request Data ===Authority Provided? - TrueScopes -Extra Query Params Keys (space separated) -ApiId - AcquireTokenByAuthorizationCodeIsConfidentialClient - TrueSendX5C - FalseLoginHint ? FalseIsBrokerConfigured - FalseHomeAccountId - FalseCorrelationId - 9c30ff44-bf8f-423d-8151-a5b4f6b049bfUserAssertion set: FalseLongRunningOboCacheKey set: FalseRegion configured:
2023-06-30 01:39:55.096 +00:00 [Information] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] === Token Acquisition (ConfidentialAuthCodeRequest) started:Scopes:Authority Host: login.microsoftonline.com
2023-06-30 01:39:55.151 +00:00 [Warning] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Only in-memory caching is used. The cache is not persisted and will be lost if the machine is restarted. It also does not scale for a web app or web API, where the number of users can grow large. In production, web apps and web APIs should use distributed caching like Redis. See https://aka.ms/msal-net-cca-token-cache-serialization
2023-06-30 01:39:55.151 +00:00 [Information] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] [Instance Discovery] Instance discovery is enabled and will be performed
2023-06-30 01:39:55.151 +00:00 [Information] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] [Region discovery] Not using a regional authority.
2023-06-30 01:39:55.151 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] [Instance Discovery] Tried to use network cache provider for login.microsoftonline.com. Success? True.
2023-06-30 01:39:55.151 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] [Instance Discovery] The network provider found an entry for login.microsoftonline.com.
2023-06-30 01:39:55.152 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Starting TokenClient:SendTokenRequestAsync
2023-06-30 01:39:55.152 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] [TokenClient] Before adding the client assertion / secret
2023-06-30 01:39:55.152 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] [TokenClient] After adding the client assertion / secret
2023-06-30 01:39:55.152 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] [Token Client] Fetching MsalTokenResponse ....
2023-06-30 01:39:55.152 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Starting [Oauth2Client] Sending POST request
2023-06-30 01:39:55.152 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Starting [HttpManager] ExecuteAsync
2023-06-30 01:39:55.152 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] [HttpManager] Sending request. Method: POST. Host: https://login.microsoftonline.com.
2023-06-30 01:39:55.153 +00:00 [Information] System.Net.Http.HttpClient.Default.LogicalHandler: Start processing HTTP request POST https://login.microsoftonline.com/tenantREDACTED/oauth2/v2.0/token
2023-06-30 01:39:55.153 +00:00 [Trace] System.Net.Http.HttpClient.Default.LogicalHandler: Request Headers:x-client-SKU: MSAL.NetCorex-client-Ver: 4.54.1.0x-client-CPU: x64x-client-OS: Microsoft Windows 10.0.14393x-client-current-telemetry: 5|1000,0,,,|0,0,1x-client-last-telemetry: 5|0|||x-ms-PKeyAuth: 1.0x-anchormailbox: upn:oid:redacted-ms-lib-capability: retry-after, h429client-request-id: 9c30ff44-bf8f-423d-8151-a5b4f6b049bfreturn-client-request-id: truex-app-name: UnknownClientx-app-ver: 0.0.0.0x-client-brkrver: IDWeb.2.11.1.0Content-Type: application/x-www-form-urlencoded
2023-06-30 01:39:55.153 +00:00 [Information] System.Net.Http.HttpClient.Default.ClientHandler: Sending HTTP request POST https://login.microsoftonline.com/tenantredacted/oauth2/v2.0/token
2023-06-30 01:39:55.153 +00:00 [Trace] System.Net.Http.HttpClient.Default.ClientHandler: Request Headers:x-client-SKU: MSAL.NetCorex-client-Ver: 4.54.1.0x-client-CPU: x64x-client-OS: Microsoft Windows 10.0.14393x-client-current-telemetry: 5|1000,0,,,|0,0,1x-client-last-telemetry: 5|0|||x-ms-PKeyAuth: 1.0x-anchormailbox: upn:oid:redacted-ms-lib-capability: retry-after, h429client-request-id: 9c30ff44-bf8f-423d-8151-a5b4f6b049bfreturn-client-request-id: truex-app-name: UnknownClientx-app-ver: 0.0.0.0x-client-brkrver: IDWeb.2.11.1.0Content-Type: application/x-www-form-urlencoded
2023-06-30 01:39:55.528 +00:00 [Information] System.Net.Http.HttpClient.Default.ClientHandler: Received HTTP response headers after 375.3276ms - 400
2023-06-30 01:39:55.528 +00:00 [Trace] System.Net.Http.HttpClient.Default.ClientHandler: Response Headers:Cache-Control: no-store, no-cachePragma: no-cacheStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Content-Type-Options: nosniffP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"client-request-id: 9c30ff44-bf8f-423d-8151-a5b4f6b049bfx-ms-request-id: 06809f60-483b-42f1-b1af-9fa137214500x-ms-ests-server: 2.1.15723.3 - NCUS ProdSlicesx-ms-clitelem: 1,700222,0,,X-XSS-Protection: 0Set-Cookie: fpc=ArxWNjTNAK5NvjxwUi64bTyW2jeqAQAAAGspMNwOAAAA; expires=Sun, 30-Jul-2023 01:39:55 GMT; path=/; secure; HttpOnly; SameSite=None, x-ms-gateway-slice=estsfd; path=/; secure; httponly, stsservicecookie=estsfd; path=/; secure; httponlyDate: Fri, 30 Jun 2023 01:39:54 GMTContent-Type: application/json; charset=utf-8Expires: -1Content-Length: 498
2023-06-30 01:39:55.529 +00:00 [Information] System.Net.Http.HttpClient.Default.LogicalHandler: End processing HTTP request after 376.0046ms - 400
2023-06-30 01:39:55.529 +00:00 [Trace] System.Net.Http.HttpClient.Default.LogicalHandler: Response Headers:Cache-Control: no-store, no-cachePragma: no-cacheStrict-Transport-Security: max-age=31536000; includeSubDomainsX-Content-Type-Options: nosniffP3P: CP="DSP CUR OTPi IND OTRi ONL FIN"client-request-id: 9c30ff44-bf8f-423d-8151-a5b4f6b049bfx-ms-request-id: 06809f60-483b-42f1-b1af-9fa137214500x-ms-ests-server: 2.1.15723.3 - NCUS ProdSlicesx-ms-clitelem: 1,700222,0,,X-XSS-Protection: 0Set-Cookie: fpc=ArxWNjTNAK5NvjxwUi64bTyW2jeqAQAAAGspMNwOAAAA; expires=Sun, 30-Jul-2023 01:39:55 GMT; path=/; secure; HttpOnly; SameSite=None, x-ms-gateway-slice=estsfd; path=/; secure; httponly, stsservicecookie=estsfd; path=/; secure; httponlyDate: Fri, 30 Jun 2023 01:39:54 GMTContent-Type: application/json; charset=utf-8Expires: -1Content-Length: 498
2023-06-30 01:39:55.529 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] [HttpManager] Received response. Status code: BadRequest.
2023-06-30 01:39:55.529 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Finished [HttpManager] ExecuteAsync in 376 ms
2023-06-30 01:39:55.529 +00:00 [Information] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Response status code does not indicate success: 400 (BadRequest).
2023-06-30 01:39:55.534 +00:00 [Warning] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Request retry failed.
2023-06-30 01:39:55.534 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Finished [Oauth2Client] Sending POST request  in 381 ms
2023-06-30 01:39:55.534 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] [Oauth2Client] Processing error response
2023-06-30 01:39:55.534 +00:00 [Information] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] HttpStatusCode: 400: BadRequest
2023-06-30 01:39:55.542 +00:00 [Error] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] === Token Acquisition (1000) failed.Host: login.microsoftonline.com.
2023-06-30 01:39:55.546 +00:00 [Error] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Exception type: Microsoft.Identity.Client.MsalServiceException, ErrorCode: invalid_requestHTTP StatusCode 400CorrelationId 9c30ff44-bf8f-423d-8151-a5b4f6b049bf
2023-06-30 01:39:55.547 +00:00 [Debug] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Finished TokenClient:SendTokenRequestAsync in 395 ms
2023-06-30 01:39:55.560 +00:00 [Error] Microsoft.Identity.Web.TokenAcquisition: False MSAL 4.54.1.0 MSAL.NetCore .NET 6.0.16 Microsoft Windows 10.0.14393 [2023-06-30 01:39:55Z - 9c30ff44-bf8f-423d-8151-a5b4f6b049bf] Exception type: Microsoft.Identity.Client.MsalServiceException, ErrorCode: invalid_requestHTTP StatusCode 400CorrelationId 9c30ff44-bf8f-423d-8151-a5b4f6b049bf
at Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func`2 onBeforePostRequestData)at Microsoft.Identity.Client.OAuth2.OAuth2Client.GetTokenAsync(Uri endPoint, RequestContext requestContext, Boolean addCommonHeaders, Func`2 onBeforePostRequestHandler)at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)at Microsoft.Identity.Client.OAuth2.TokenClient.SendHttpAndClearTelemetryAsync(String tokenEndpoint, ILoggerAdapter logger)at Microsoft.Identity.Client.OAuth2.TokenClient.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, String scopeOverride, String tokenEndpointOverride, CancellationToken cancellationToken)at Microsoft.Identity.Client.Internal.Requests.RequestBase.SendTokenRequestAsync(IDictionary`2 additionalBodyParameters, CancellationToken cancellationToken)at Microsoft.Identity.Client.Internal.Requests.ConfidentialAuthCodeRequest.ExecuteAsync(CancellationToken cancellationToken)at Microsoft.Identity.Client.Internal.Requests.RequestBase.RunAsync(CancellationToken cancellationToken)
2023-06-30 01:39:55.562 +00:00 [Information] Microsoft.Identity.Web.TokenAcquisition: [MsIdWeb] An error occured during token acquisition: Exception occurred while adding an account to the cache from the auth code.MSAL.NetCore.4.54.1.0.MsalServiceException:ErrorCode: invalid_requestMicrosoft.Identity.Client.MsalServiceException: AADSTS700222: AAD-issued tokens may not be used for federated identity flows.Trace ID: 06809f60-483b-42f1-b1af-9fa137214500Correlation ID: 9c30ff44-bf8f-423d-8151-a5b4f6b049bfTimestamp: 2023-06-30 01:39:55Zat Microsoft.Identity.Client.OAuth2.OAuth2Client.ThrowServerException(HttpResponse response, RequestContext requestContext)at Microsoft.Identity.Client.OAuth2.OAuth2Client.CreateResponse[T](HttpResponse response, RequestContext requestContext)at Microsoft.Identity.Client.OAuth2.OAuth2Client.ExecuteRequestAsync[T](Uri endPoint, HttpMethod method, RequestContext requestContext, Boolean expectErrorsOn200OK, Boolean addCommonHeaders, Func`2 onBeforePostRequestData)at...

我为webapp的托管身份（客户端和API）添加了一个角色定义：

az role assignment create --role $role --assignee-object-id $principalId --assignee-principal-type ServicePrincipal --scope $apiAppId

我还将托管身份添加到Identity blade中的webapp和API中，用于用户管理的身份。
我想做的是可能的还是推荐的？Azure API管理讨论了它（但我目前没有使用它）：https://learn.microsoft.com/en-us/azure/api-management/authentication-authorization-overview。

Azure

1条答案

按热度按时间
c0vxltue

c0vxltue1#

产品团队给出了this answer，这似乎是不可能的：
托管身份仅可用于守护程序方案...，即使用客户端凭据流（AcquireTokenForApp）。
Microsoft.Identity.Web提供了所有机密的客户端应用程序流（Web应用程序中的身份验证代码流和刷新令牌、Web API中的用户/应用程序以及守护程序方案的客户端凭据），并且它确实使用托管身份从KeyVault获取证书，并使用工作负载身份进行工作。

赞(0）分享  回复(0）举报  2023-06-30
我来回答

相关问题

    查看更多

    热门标签

    更多
    JavaquerypythonNode开发语言requestUtil数据库Table后端算法LoggerMessageElementParser

    最新问答

    更多
    • 蜀ICP备13028337号-1 大数据知识库 https://www.saoniuhuo.com © All rights reserved
    • 本站内容来源互联网,如果侵犯您的权益请联系我们删除, 联系方式：448109455@qq.com