.net - 具有应用程序角色的守护程序应用程序无法访问具有相同角色的已定义 AuthorizeAttribute 的端点

Question

我的项目由两个应用程序的 Web 应用程序、守护程序应用程序和通用 API 组成。这是Common API的应用注册清单中应用角色的定义：

"appRoles": [
    {
        "allowedMemberTypes": [
            "Application", "User"
        ],
        "description": "Access the Synchronizator as an application",
        "displayName": "access_as_sync_application",
        "id": "XXX",
        "isEnabled": true,
        "lang": null,
        "origin": "Application",
        "value": "access_as_sync_application"
    },
    {
        "allowedMemberTypes": [
            "User"
        ],
        "description": "Access to everybody timeentries",
        "displayName": "TimeEntries.Administrator",
        "id": "XXX",
        "isEnabled": true,
        "lang": null,
        "origin": "Application",
        "value": "TimeEntries.Administrator"
    },
    {
        "allowedMemberTypes": [
            "User"
        ],
        "description": "Access to own timeentries",
        "displayName": "TimeEntries.User",
        "id": "XXX",
        "isEnabled": true,
        "lang": null,
        "origin": "Application",
        "value": "TimeEntries.User"
    }
],

如你看到的。我已经为 MemberType "Application" 和用于 Daemon Application 的 "User" 定义了角色 "access_as_sync_application"。两个应用程序之间的关系在 Enterprise applications\API app\Users and groups 中定义：

但是一旦我尝试从守护程序应用程序调用 API，我就会收到 403 禁止响应。这就是我保护端点的方式：

    [HttpPost]
    [Authorize(Roles = "access_as_sync_application")]
    public async Task<ActionResult<LogSyncResult>> LogSync([FromBody] LogSyncCommand command)
    {
        LogSyncResult result = await Mediator.Send(command);
        return Ok(result);
    }

在我使用 AuthorizeAttribute 之前一切正常。我检查了访问令牌的内容，它包含所需的角色：

标签： .netazureazure-active-directorydaemonmsal