c# - 通过 Azure AD 应用程序代理从客户端发出的请求中缺少授权标头

Question

我遇到了一个问题，即在从客户端应用程序通过 Azure Active Directory 应用程序代理到 REST Web 服务的 HTTP 请求中缺少带有承载令牌的授权标头。

Web 服务托管在本地，客户端应用程序使用 Azure AD 应用程序代理 URL 从 Internet 使用，并且请求已针对 ADFS 进行身份验证。身份验证标头是在向 Azure AD 应用程序代理 URL 发送请求时添加的，我猜它已被代理连接器删除。

请在下面找到请求内容和帮助。如何在对应用程序代理的原始请求中包含 Authenticator 标头？

GET /TimelogSvc/rest/Timelog/GetTimeLog?EmailId=[e-mail]&Fromdate=2019-04-21&Todate=2019-04-27 HTTP/1.1
Connection: Keep-Alive
Host: agileuat.BizNext.com.sg
X-Forwarded-For: 203.126.130.140
X-MS-Proxy: AzureAD-Application-Proxy
OS-Host: agileuat.BizNext.com.sg
OS-Path: /TimelogSvc
OS-Pta: /rest/Timelog
OS-Page: /GetTimeLog?EmailId=[e-mail]&Fromdate=2019-04-21&Todate=2019-04-27

另请参阅下面的客户代码。

AuthenticationContext authContext = new AuthenticationContext(authority + tenantID);
HttpClient httpClient = new HttpClient();
string s = string.Empty;

result = await authContext.AcquireTokenAsync(resourceUri, clientId, new Uri(redirectUri), new PlatformParameters(PromptBehavior.Auto));

// Append the token as bearer in the request header.
httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("Bearer", result.AccessToken);

// Call the API.
HttpResponseMessage response = await httpClient.GetAsync("https://timelogapitest-BizNext.msappproxy.net/TimelogSvc/rest/Timelog/GetTimeLog?EmailId=[e-mail]&Fromdate=2019-04-21&Todate=2019-04-27");

s = await response.Content.ReadAsStringAsync();

标签： c#azureazure-active-directoryazure-function-app-proxy

Answer 1

移动应用

我通过在自定义标头中包含访问令牌（第二次）解决了这个问题。这假设您可以控制后端，以便您可以读取该自定义标头。如有必要，您甚至可以将其写入后端的 AuthHeader 以确保从那里正常授权流程。

            HttpClient client = new HttpClient();
            HttpRequestMessage message = new HttpRequestMessage(HttpMethod.Get, "API/URL/GoesHere");
            // Add token to authentication header as per usual
            message.Headers.Authorization = new System.Net.Http.Headers.AuthenticationHeaderValue("Bearer", token);
            // Custom header containing the token a second time.
            // Name if whatever you like, just make sure you look for the
            // exact name on the backend
            message.Headers.Add("JwtAccessToken", token);
            HttpResponseMessage response = await client.SendAsync(message);
            string responseString = await response.Content.ReadAsStringAsync();

网络客户端

这似乎现在有效：

https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/32386468-forward-incoming-jwt-token-to-backend-service#{toggle_previous_statuses}